开源软件构建与测试

Changes of Revision 2

_service:tar_scm:tpm2-tools.spec Changed

@@ -1,13 +1,11 @@
 Name:          tpm2-tools
-Version:       5.0
-Release:       5
+Version:       5.4
+Release:       1
 Summary:       A TPM2.0 testing tool based on TPM2.0-TSS
 License:       BSD
 URL:           https://github.com/tpm2-software/tpm2-tools
 Source0:       https://github.com/tpm2-software/tpm2-tools/releases/download/%{version}/%{name}-%{version}.tar.gz
 
-Patch0:        backport-Don-t-assume-end-of-argv-is-NULL.patch
-Patch1:        backport-CVE-2021-3565.patch
 
 BuildRequires: gcc-c++ libtool autoconf-archive pkgconfig(cmocka) pkgconfig(libcurl) pkgconfig(openssl)
 BuildRequires: pkgconfig(tss2-mu) pkgconfig(tss2-sys) pkgconfig(tss2-esys) pkgconfig(uuid) libgcrypt
@@ -49,16 +47,19 @@
 
 %files
 %defattr(-,root,root)
-%license doc/LICENSE
+%license docs/LICENSE
 %{_bindir}/*
 %{_datadir}/bash-completion/completions/tpm2*
 %{_datadir}/bash-completion/completions/tss2*
 
 %files help
-%doc README.md doc/CHANGELOG.md
+%doc docs/README.md docs/CHANGELOG.md
 %{_mandir}/*/*
 
 %changelog
+* Tue Dec 20 2022 wangyunjia <yunjia.wang@huawei.com> - 5.4-1
+- update to 5.4
+
 * Mon Sep 27 2021 fuanan <fuanan3@huawei.com> - 5.0-5
 - fix CVE-2021-3565

_service:tar_scm:backport-CVE-2021-3565.patch Deleted

@@ -1,46 +0,0 @@
-From c069e4f179d5e6653a84fb236816c375dca82515 Mon Sep 17 00:00:00 2001
-From: William Roberts <william.c.roberts@intel.com>
-Date: Fri, 21 May 2021 12:22:31 -0500
-Subject: PATCH tpm2_import: fix fixed AES key CVE-2021-3565
-
-tpm2_import used a fixed AES key for the inner wrapper, which means that
-a MITM attack would be able to unwrap the imported key. Even the
-use of an encrypted session will not prevent this. The TPM only
-encrypts the first parameter which is the fixed symmetric key.
-
-To fix this, ensure the key size is 16 bytes or bigger and use
-OpenSSL to generate a secure random AES key.
-
-Fixes: #2738
-
-Signed-off-by: William Roberts <william.c.roberts@intel.com>
----
- tools/tpm2_import.c | 12 +++++++++++-
- 1 file changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/tools/tpm2_import.c b/tools/tpm2_import.c
-index cfb6f20..f44326c 100644
---- a/tools/tpm2_import.c
-+++ b/tools/tpm2_import.c
-@@ -118,7 +118,17 @@ static tool_rc key_import(ESYS_CONTEXT *ectx, TPM2B_PUBLIC *parent_pub,
-     TPM2B_DATA enc_sensitive_key = {
-         .size = parent_pub->publicArea.parameters.rsaDetail.symmetric.keyBits.sym / 8
-     };
--    memset(enc_sensitive_key.buffer, 0xFF, enc_sensitive_key.size);
-+
-+    if(enc_sensitive_key.size < 16) {
-+        LOG_ERR("Calculated wrapping keysize is less than 16 bytes, got: %u", enc_sensitive_key.size);
-+        return tool_rc_general_error;
-+    }
-+
-+    int ossl_rc = RAND_bytes(enc_sensitive_key.buffer, enc_sensitive_key.size);
-+    if (ossl_rc != 1) {
-+        LOG_ERR("RAND_bytes failed: %s", ERR_error_string(ERR_get_error(), NULL));
-+        return tool_rc_general_error;
-+    }
- 
-     /*
-      * Calculate the object name.
--- 
-1.8.3.1
-

_service:tar_scm:backport-Don-t-assume-end-of-argv-is-NULL.patch Deleted

@@ -1,43 +0,0 @@
-From fb1e0d98eca5279bf33304deedd9019b0130393a Mon Sep 17 00:00:00 2001
-From: Erik Larsson <who+github@cnackers.org>
-Date: Sat, 21 Nov 2020 10:59:13 +0100
-Subject: PATCH Don't assume end of argv is NULL
-
-On a musl based system argvoptind && strcmp(...) where optind > argc might read random memory and segfault.
-
-Signed-off-by: Erik Larsson <who+github@cnackers.org>
----
- lib/tpm2_options.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/lib/tpm2_options.c b/lib/tpm2_options.c
-index e9aaa0364..9fa583c60 100644
---- a/lib/tpm2_options.c
-+++ b/lib/tpm2_options.c
-@@ -300,7 +300,7 @@ tpm2_option_code tpm2_handle_options(int argc, char **argv,
-             if (argvoptind - 1) {
-                 if (!strcmp(argvoptind - 1, "--help=no-man") ||
-                     !strcmp(argvoptind - 1, "-h=no-man") ||
--                    (argvoptind && !strcmp(argvoptind, "no-man"))) {
-+                    (argc < optind && !strcmp(argvoptind, "no-man"))) {
-                     manpager = false;
-                     optind++;
-                 /*
-@@ -309,7 +309,7 @@ tpm2_option_code tpm2_handle_options(int argc, char **argv,
-                  */
-                 } else if (!strcmp(argvoptind - 1, "--help=man") ||
-                            !strcmp(argvoptind - 1, "-h=man") ||
--                           (argvoptind && !strcmp(argvoptind, "man"))) {
-+                           (argc < optind && !strcmp(argvoptind, "man"))) {
-                     manpager = true;
-                     explicit_manpager = true;
-                     optind++;
-@@ -318,7 +318,7 @@ tpm2_option_code tpm2_handle_options(int argc, char **argv,
-                      * argv0 = "tool name"
-                      * argv1 = "--help" argv2 = 0
-                      */
--                    if (!argvoptind && argc == 2) {
-+                    if (optind >= argc && argc == 2) {
-                         manpager = false;
-                     } else {
-                         /*

_service Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/README.md Deleted

@@ -1,44 +0,0 @@
-!Build Status(https://travis-ci.org/tpm2-software/tpm2-tools.svg?branch=master)(https://travis-ci.org/tpm2-software/tpm2-tools)
-!FreeBSD Build Status(https://api.cirrus-ci.com/github/tpm2-software/tpm2-tools.svg?branch=master)(https://cirrus-ci.com/github/tpm2-software/tpm2-tools)
-!codecov(https://codecov.io/gh/tpm2-software/tpm2-tools/branch/master/graph/badge.svg)(https://codecov.io/gh/tpm2-software/tpm2-tools)
-!Coverity Scan(https://img.shields.io/coverity/scan/3997.svg)(https://scan.coverity.com/projects/01org-tpm2-0-tools)
-!Language grade: C/C++(https://img.shields.io/lgtm/grade/cpp/g/tpm2-software/tpm2-tools.svg?logo=lgtm&logoWidth=18)(https://lgtm.com/projects/g/tpm2-software/tpm2-tools/context:cpp)
-
-**This site contains the code for the TPM (Trusted Platform Module) 2.0 tools based on tpm2-tss**
-
-## Build and Installation instructions:
-Instructions for building and installing the tpm2-tools are provided in the INSTALL.md(doc/INSTALL.md) file.
-
-## Release Procedures
-Instructions for how releases are conducted, including our QA practices, please see the RELEASE.md(doc/RELEASE.md) file.
-
-## Support
-Please use the mailing list at https://lists.01.org/postorius/lists/tpm2.lists.01.org/ for general questions. The Issue Tracker on
-github should be reserved for actual feature requests or bugs. For security bugs, please see CONTRIBUTING.md(doc/CONTRIBUTING.md)
-for information on how to submit those.
-
-## Resources
-
-Reference the tutorials at tpm2-software.github.io(https://tpm2-software.github.io).
-
-TPM 2.0 specifications can be found at Trusted Computing Group(http://www.trustedcomputinggroup.org/).
-
-Specifically, the following sections:
-
-### The Library Specification
-This specifies the external programatic interface to the TPM:
-<https://trustedcomputinggroup.org/tpm-library-specification/>
-
-### The Enhanced System API Specification
-This is the *ESAPI* dependency mentioned in INSTALL.md(doc/INSTALL.md). This is the enhanced software API to the tpm. The tpm2-tools
-project relies heavily on this. <https://trustedcomputinggroup.org/wp-content/uploads/TSS_ESAPI_Version-0.9_Revision-04_reviewEND030918.pdf>
-
-### The TCTI Specification
-This specifies the transmission interfaces or how bytes get from the system api to the tpm.
-<https://trustedcomputinggroup.org/wp-content/uploads/TSS_TCTI_v1.0_r04_Public-Review.pdf>
-
-### Books
-  * A Practical Guide to TPM 2.0(https://link.springer.com/book/10.1007%2F978-1-4302-6584-9) `ISBN: 978-1-4302-6583-2 (Print) 978-1-4302-6584-9 (Online)`
-
-## Contributing
-Instructions for contributing to the project are provided in the CONTRIBUTING.md(doc/CONTRIBUTING.md) file.

_service:tar_scm:tpm2-tools-5.0.tar.gz/doc Deleted

_service:tar_scm:tpm2-tools-5.0.tar.gz/doc/CHANGELOG.md Deleted

@@ -1,1220 +0,0 @@
-## Changelog
-
-### 5.0 - 2020-11-16
-
-#### Non Backwards Compatible Changes
-
-  * Default hash algorithm is now sha256. Prior versions claimed sha1, but were
-    inconsistent in choice. Best practice is to specify the hash algorithm to
-    avoid suprises.
-   
-  * tpm2_tools and tss2_tools are now a busybox style commandlet. Ie
-    tpm2\_getrandom becomes tpm2 getrandom. make install will install symlinks
-    to the old tool names and the tpm2 commandlet will interogate argv0 for
-    the command to run. This will provide backwards compatibility if they are
-    installed. If you wish to use the old names not installed system wide, set
-    DESTDIR during install to a seperate path and set the proper directory on
-    PATH.
-
-  * tpm2\_eventlog's output changed to be YAML compliant. The output before
-    was intended to be YAML compliant but was never properly checked and tested.
-
-  * umask set to 0117 for all tools.
-
-  * tpm2\_getekcertificate now outputs the INTC EK certificates in PEM format
-    by default. In order to output the URL safe variant of base64 encoded
-    output of the INTC EK certificate use the added option **--raw**.
-
-#### Dependency update
-
-  * Update tpm2-tss dependency version to
-    3.0.1(https://github.com/tpm2-software/tpm2-tss/releases/tag/3.0.1)
-
-  * Update tpm2-abrmd dependency version to
-    2.3.3(https://github.com/tpm2-software/tpm2-abrmd/releases/tag/2.3.3)
-
-#### New tools and features
-
-  * tpm2\_zgen2phase:
-    - Add new tool to support command TPM2\_CC\_ZGen\_2Phase.
-
-  * tpm2\_ecdhzgen:
-    - Add new tool to support command TPM2\_CC\_ECDH\_ZGen.
-
-  * tpm2\_ecdhkeygen:
-    - Add new tool to support command TPM2\_CC\_ECDH\_KeyGen.
-
-  * tpm2\_commit:
-    - Add new tool to support command TPM2\_CC\_Commit.
-
-  * tpm2\_ecephemeral:
-    - Add new tool to support command TPM2\_CC\_EC\_Ephemeral.
-
-  * tpm2\_geteccparameters:
-    - Add new tool to support command TPM2\_CC\_ECC\_Parameters.
-
-  * tpm2\_setcommandauditstatus:
-    - Added new tool to support command TPM2\_CC\_SetCommandCodeAuditStatus.
-
-  * tpm2\_getcommandauditstatus:
-    - Added new tool to support command TPM2\_CC\_GetCommandAuditDigest.
-
-  * tpm2\_getsessionauditdigest:
-    - Added new tool to support command TPM2\_CC\_GetSessionAuditDigest.
-
-  * tpm2\_certifyX509certutil:
-    - Added new tool for creating partial x509 certrificates required to support
-      the TPM2\_CC\_CertifyX509 command.
-
-  * tpm2\_policysigned:
-    - Added option **\--cphash-input** to specify the command parameter hash
-      (cpHashA), enforcing the TPM command to be authorized as well as its handle
-      and parameter values.
-
-  * tpm2\_createprimary:
-    - Added option to specify the unique data from the stdin by adding provision
-      for specifying the option value for unique file as **-**.
-
-  * tpm2\_startauthsession:
-    - Added new feature/option **\--audit-session** to start an HMAC session to
-      be used as an audit session.
-
-  * tpm2\_getrandom:
-    - Added new feature/option **-S**, **\--session** to specify a HMAC session
-      to be used as an audit session. This adds support for auditing the command
-      using an audit session.
-    - Added new feature/option **\--rphash** to specify file path to record the
-      hash of the response parameters. This is commonly termed as rpHash.
-    - Added new feature/option **\--cphash** to specify a file path to record
-      the hash of the command parameters. This is commonly termed as cpHash.
-      NOTE: In absence of **\--rphash** option, when this option is selected,
-      The tool will not actually execute the command, it simply returns a
-      cpHash.
-
-  * tpm2_getcap:
-    - tpm2_getcap was missing raw on a property TPM2_PT_REVISION, and it should
-      always be specified.
-
-  * tpm2_sign:
-    - Add option **--commit-index** to specify the commit index to use when
-      performing an ECDAA signature.
-    - Add support for ECDAA signature.
-
-  * tpm2_getekcertificate:
-    - Add option **--raw** to output EK certificate in URL safe variant base64
-      encoded format. By default it outputs a PEM formatted certificate.
-    - The tool can now output INTC and non INTC EK certificates from NV indices
-      specified by the TCG EK profile specification.
-
-  * tpm2_activatecredential:
-    - The secret data input can now be specified as stdin with **-s** option.
-    - The public key used for encryption can be specified as **-u** to make it
-      similar to rest of the tools specifying a public key. The old **-e**
-      option is retained for backwards compatibility.
-    - Add option to specify the key algorithm when the input public key is in
-      PEM format using the new option **-G**, **--key-algorithm**. Can specify
-      either RSA/ECC. When this option is used, input public key is expected to
-      be in PEM format and the default TCG EK template is used for the key
-      properties.
-
-  * tpm2\_checkqoute:
-    - Add EC support.
-    - Support loading *tss* signatures.
-    - Support loading tpm2 pcrread PCR values by specifying the PCR selection
-      using the new option **-l**, **\--pcr-list**.
-    - Added support for automatically detecting the signature format. With this
-      **-F**, **\--format** option is retained for backwards compatibility but
-      it is deprecated.
-
-  * tpm2\_createak:
-    - add option to output qualified name with new option
-      **-q**, **\--ak-qualified-name**.
-
-  * tpm2\_policypcr:
-    - Add option for specifying cumulative hash of PCR's as an argument.
-
-  * tpm2\_readpublic:
-    - Add option to output qualified name using the new option
-      **-q**, **\--qualified-name**.
-
-  * tpm2\_print:
-    - Support printing TPM2B\_PUBLIC data structures.
-    - Support printing TPMT\_PUBLIC data structures.
-
-  * tpm2\_send:
-    - Add support for handling sending and receiving command and response buffer
-     for multiple commands.
-
-  * tpm2\_verifysignature:
-    - Added support for verifying RSA-PSS signatures.
-
-  * tpm2\_eventlog:
-    - Add handling of sha1 log format.
-    - Add fixes for eventlog output to be proper YAML.
-    - Add support for sha384, sha512, sm3_256 PCR hash algorithms.
-    - Add support for computing PCR values based on the events.
-
-  * tpm2_tools (all):
-    - Set stdin/stdout to non-buffering.
-    - Added changes for FreeBSD portability.
-
-#### Bug fixes
-
-  * Fix printing short options when no ascii character is used.
-
-  * OpenSSL: Fix deprecated OpenSSL functions. ECC Functions with suffix GFp
-    will become deprecated (DEPRECATED_1_2_0).
-
-  * tpm2\_eventlog: output EV_POST_CODE as string not firmware blob to be
-    compliant with TCG PC Client FPF section 2.3.4.1 and 9.4.12.3.4.1
-
-  * Fix missing handle maps for ESY3 handle breaks. See #1994.
-
-  * tpm2\_rsaencrypt: fix OAEP RSA encryption failing to invalid hash selection.
-
-  * tpm2\_rsadecrypt: fix OAEP RSA decryption failing to invalid hash selection.
-
-  * tpm2\_sign: fix for signing failures with restricted signing keys when
-    input data to sign is not a digest, rather the full message. The validation
-    ticket creation process defaults to the owner hierarchy and so in order to
-    choose other hierarchies the **tpm2\_hash** tool should be used instead.
-
-  * tpm2\_print: fix segfault when **-t** option is omitted by appropriately
-    warning of the required option.
-
-  * tpm2\_nvdefine: fix for default size when size is not specified by invoking
-    TPM2_CC_GetCapability.
-
-  * Fix for an issue where the return code for unsupported algorithms was
-    tool_rc_general instead of tool_rc_unsupported in **tpm2_create** and
-    **tpm2_createprimary** tools.
-
-  * Fix for an issue where RSA_PSS signature verification caused failures.
-
-  * **tpm2_nvreadpublic**, **tpm2_kdfa**, **tpm2_checkquote**, **tpm2_quote**:
-    Fixes for issues with interoperability of the attestation tools between big
-    and little endian platforms.
-
-  * tss2\_\*:
-    - Fix bash-completion for tss2_pcrextend and tss2_verifysignature
-    - Add force option to tss2_list
-    - Make force option consistent in all fapi tools
-    - Do not decode non-TPM errors
-    - Enhance integration tests to test changes of optional/mandatory parameters
-    - Add --hex parameter to tss2_getrandom
-    - Fix autocompletion issue
-    - Switch tss2\_\* to with-"="-style
-    - Add size parameter to tss2_createseal
-    - References to the cryptographic profile (fapi-profile(5)) and config file
-      (fapi-config(5)) man pages from all relevant tss2\_\* man pages.
-    - Fix policy branch selection menu item from 1 to 0.
-
-#### CI changes
-
-  * Travis-CI
-    - Drop Ubuntu-16.04 and add Ubuntu-20.04.
-    - Added unit/integration test instance to verify we are not breaking tool
-      options and or maintaining backwards compatibility with 4.X version.
-
-  * Cirrus-CI:
-    - Added support for testing on FreeBSD.
-
-#### Documentation
-
-  * wiki pages have been removed and data has been migrated to
-    tpm2-software.github.io portal's tutorial section.
-
-  * Fix the problem with man and no-man help output for tools were not correctly
-    displayed.
-
-  * man:
-    - tpm2_create: Correct max seal data size from 256 bytes to 128 bytes.
-
-    - tpm2_nvread: Fix manpage example.
-
-    - tpm2_nvwrite: Added missing information on how to specify the NV index as
-     an argument.
-
-    - tpm2_unseal: Add end-to-end example.
-
-    - tpm2_nvincrement: Fix incorrect commands in example section.
-
-    - tpm2_hmac: Fix the example section.
-
-### 4.3.0 - 2020-08-24
-
- * tss2_*: Fix double-free errors in commands asking for password authorization
-
- * tss2_*: Fix shorthand command -f that was falsely requiring an argument
-
- * tss2_*: Update tss2_encrypt to the new FAPI interface
-   - The argument 'policyPath' is removed which was never read anyway
-
- * tss2_*: Remove the additional '\n' that was appended when redirecting to stdout
-
- * tss2_*: Update mandatory vs optional treatment of arguments according to latest Fapi spec
-
- * tss2_*: tss2_getinfo now retrieves the correct FAPI version from Fapi_GetInfo
-
- * tss2_*: Fix the error handling in case of multiple inputs and/or outputs from stdin/stdout
-
- * tss2_*: Fix syntax errors and update content of man pages according to latest Fapi spec
-
- * tss2_*: Add parameter types to all man page
-
- * tss2_*: tss2_setappdata now reads from file or stdin allowing to store also binary data
-
- * tss2_*: Memory leaks are fixed in cases when a returned empty non-char output value was passed to file output
-
- * tss2_pcrextend: fix extending PCR 0
-
- * tss2_quote: fix unused TSS2_RC in LOG_ERR
-
-### 4.2.1 - 2020-05-25
-
-* Fix missing handle maps for ESY3 handle breaks. See #1994.
-
-* Bump ESYS minimum dependency version from 2.3.0 to 2.4.0.
-
-* Fix for loop declarations build error.
-
-### 4.2 2020-04-08
-
- * Fix various issues reported by static analysis tools.
-
- * Add integration test for ECC based getekcertificate.
-
- * Fix for issue #1959 where ARM builds were failing.
-
- * Add a check in autotools to add "expect" as a package dependency for fapi tools.
-
- * tpm2_createek: Drop the unused -p or --ek-auth option
-
- * tpm2_policyor: List of policy files should be specified as an argument
-   instead of -l option. The -l option is still retained for backwards
-   compatibility. See issue#1894.
-
- * tpm2\_eventlog: add a tool for parsing and displaying the event log.
-
- * tpm2_createek: Fix an issue where the `template` option looked for args
-
- * tpm2_hierarchycontrol: Fixed bug where tool operation failed silently
-
- * tpm2_nvdefine: Fixed an issue where text output suggested failures as passes
-
- * tpm2_certify: Add an example usage in man page
-
- * tpm2_policyor: Fix a bug where tool failed silently when no input were given
-
- * tpm2_getekcertificate: Intel (R) PTT EK cert web portal is set as default address
-
- * tpm2_alg_util.c: Fix a bug where string rsa3072 was not parsed
-
- * .ci/download-deps.sh: Change tss dependency to 2.4.0 to acquire SAPI handles for cpHash calculations
-
- * tpm2_policycphash: Add a tool to implement enhanced authorization with cpHash of a command
-
- * Add options to tools to enable cpHash outputs: tpm2_nvsetbits, tpm2_nvextend,
-   tpm2_nvincrement, tpm2_nvread, tpm2_nvreadlock, tpm2_writelock, tpm2_nvdefine,
-   tpm2_nvundefine, tpm2_nvcertify, tpm2_policynv, tpm2_policyauthorizenv,
-   tpm2_policysecret, tpm2_create, tpm2_load, tpm2_activatecredential, tpm2_unseal,
-   tpm2_changeauth, tpm2_duplicate, tpm2_import, tpm2_rsadecrypt, tpm2_certify,
-   tpm2_certifycreation, tpm2_hierarchycontrol, tpm2_setprimarypolicy, tpm2_clearcontrol,
-   tpm2_dictionarylockout, tpm2_evictcontrol, tpm2_setclock, tpm2_clockrateadjust,
-   tpm2_clear, tpm2_nvwrite, tpm2_encryptdecrypt, tpm2_hmac.
-
- * tpm2_import: Fix an issue where the imported key always required to have a policy
-
- * tpm2_policysecret: Fix an issue where authorization model was fixed to password only
-
- * Feature API (FAPI) tools added. These additional set of tools implement utilities
-   using the FAPI which was added to the tpm2-tss v2.4.4:
-   tss2_decrypt, tss2_encrypt, tss2_list, tss2_changeauth, tss2_delete,
-   tss2_import, tss2_getinfo, tss2_createkey, tss2_createseal, tss2_exportkey,
-   tss2_getcertificate, tss2_getplatformcertificates, tss2_gettpmblobs,
-   tss2_getappdata, tss2_setappdata, tss2_setcertificate, tss2_sign,
-   tss2_verifysignature, tss2_verifyquote, tss2_createnv, tss2_nvextend,
-   tss2_nvincrement, tss2_nvread, tss2_nvsetbits, tss2_nvwrite,
-   tss2_getdescription, tss2_setdescription, tss2_pcrextend, tss2_quote,
-   tss2_pcrread, tss2_authorizepolicy, tss2_exportpolicy, tss2_import,
-   tss2_provision, tss2_getrandom, tss2_unseal, tss2_writeauthorizenv
-
- * tpm2_policycountertimer: Fix an issue where operandB array was reversed causing faulty comparisons.
-
-### 4.1.3 - 2020-06-02
-
-* tpm2\_create: Fix issue with userauth attribute being cleared if policy is specified.
-
-### 4.1.2 - 2020-05-18
-
-* Fix missing handle maps for ESY3 handle breaks. See #1994.
-
-### 4.1.1 - 2020-01-21
-
-* tpm2\_certify: Fix output of attestation data including size field. Now outputs just bytes.
-* tpm2\_certifycreation: Fix tool to match manpage where the code had the -C and -c options reversed.
-* tpm2\_gettime: Fix output of attestation data including size field. Now outputs just bytes.
-* tpm2\_nvcertify: Fix output of attestation data including size field. Now outputs just bytes.
-* tpm2\_nvreadpublic: add name hash output.
-* tpm2\_import: Support object policies when importing raw key material.
-* Fix overflow in pcrs.h where sizeof() was used instead of ARRAY\_LEN().
-* build:
-  - Fix compilation issue: lib/tpm2\_hash.c:17:19: note: 'left' was declared here.
-* man:
-    - Fix manpage examples that have "sha" instead of "sha1"
-    - tpm2\_shutdown manpage was missing, add it to build.
-    - Fix manpage example for tpm2\_createak's tpm2\_evictcontrol example.
-
-### 4.1 2019-11-25
-
-* tpm2\_certifycreation: New tool enabling command TPM2\_CertifyCreation.
-
-* tpm2\_checkquote:
-   - Fix YAML output bug.
-   - \-g option for specifying hash algorithm is optional and defaults to
-     sha256.
-
-* tpm2\_changeeps: A new tool for changing the Endorsement hierarchy primary seed.
-
-* tpm2\_changepps: A new tool for changing the Platform hierarchy primary seed.
-
-* tpm2\_clockrateadjust: Add a new tool for modifying the period on the TPM.
-
-* tpm2\_create: Add tool options for specifying output data for use in
-certification
-  - \--creation-data to save the creation data
-  - \--creation-ticket or -t to save the creation ticket
-  - \--creation-hash or -d to save the creation hash
-  - \--template-data for saving the template data of the key
-  - \--outside-info or -q for specifying unique data to include in creation data.
-  - \--pcr-list or -l  Add option to specify pcr list to add to creation data.
-
-* tpm2\_createprimary: Add tool options for specifying output data for use
-  in certification
-  - \--creation-data to save the creation data
-  - \--creation-ticket or -t to save the creation ticket
-  - \--creation-hash or -d to save the creation hash
-  - \--template-data for saving the template data of the key
-  - \--outside-info or -q for specifying unique data to include in creation data.
-  - \--pcr-list or -l  Add option to specify pcr list to add to creation data.
-
-* tpm2\_evictcontrol:
-    - Fix bug in automatic persistent handle selection when
-      hierarchy is platform.
-    - Fix bug in YAML key action where action was wrong when using ESYS\_TR.
-
-* tpm2\_getcap: clean up remanenats of -c option in manpages and tool output.
-
-* tpm2\_gettime: Add a new tool for retrieving a signed timestamp from a TPM.
-
-* tpm2\_nvcertify: Add a new tool for certifying the contents of an NV index.
-
-* tpm2\_nvdefine:
-  - Support default set of attributes so -a is not mandatory.
-  - Support searching for free index if an index isn't specified.
-
-* tpm2\_nvextend: Add a new tool for extending an NV index similair to a PCR.
-
-* tpm2\_nvreadpublic:
-  - Support specifying nv index to read public data from as argument.
-
-* tpm2\_nvsetbits: Add a new tool for setting the values of PCR with type
-    "bits".
-
-* tpm2\_nvundefine: Add support for deleting NV indices with attribute
-    `TPMA_NV_POLICY_DELETE` set using NV Undefine Special command.
-
-* tpm2\_nvwritelock: Add a new tool for setting a write lock on an NV index
-    or globally locking nv indices with TPMA\_NV\_GLOBALLOCK.
-
-* tpm2\_policyauthorizenv: New tool enabling signed, revocable policies.
-
-* tpm2\_policyauthvalue: New tool enabling authorization to be bound to the
-    authorization of another object.
-
-* tpm2\_policycountertimer: Add a new tool for enabling policy bound to TPM
-  clock or timer values.
-
-* tpm2\_policynamehash: Add a new tool for specifying policy based on object
-  name.
-
-* tpm2\_policynv: Add a new tool for specifying policy based on NV contents.
-
-* tpm2\_nvwritten: Add a new tool for specifying policy based on whether or not
-    an NV index was written to.
-
-* tpm2\_policysecret: Add tool options for specifying
-  - \--expiration or -t
-  - \--ticket
-  - \--timeout
-  - \--nonce-tpm or -x
-  - \--qualification or -q
-
-* tpm2\_policysigned: New tool enabling policy command TPM2\_PolicySigned.
-
-* tpm2\_policytemplate: New tool enabling policy command TPM2\_PolicyTemplate.
-
-* tpm2\_policyticket: New tool enabling policy command TPM2\_PolicyTicket.
-
-* tpm2\_readclock: Add a new tool for reading the TPM clock.
-
-* tpm2\_setclock: Add a new tool for setting the TPM clock.
-
-* tpm2\_setprimarypolicy: New tool setting policy on hierarchies.
-
-* tpm2\_shutdown: Add a new tool for issuing a TPM shutdown command.
-
-* misc:
-  - Support "tpmt" as a public key output format that only saves the TPMT
-  structure.
-  - Qualifying data or extra data in many tools can be hex array string or
-  binary file.
-  - Add support for specifying NV index type when specifying NV attributes.
-  - Support added for tools to run on FreeBSD.
-  - Skip and notify of action that man pages will not install if the package
-  pandoc is missing.
-  - Fix precedence issue with bitwise operator order int tpm2_getcap
-  - travis: bump abrmd version 2.3.0
-  - tpm2_util.c: Fix an issue int variable size was checked against uint
-  - pcr.c: Fix buffer length issue to support all defined hash algorithm
-
-### 4.0.1 - 2019-10-28
-
-tpm2_checkquote:
-  Fix YAML output bug.
-
-### 3.2.1 - 2019-10-10
-
-* Fix invalid memcpy when extracting ECDSA plain signatures.
-* Fix resource leak on FILE * in hashing routine.
-* Correct PCR logic to prevent memory corruption bug.
-* Errata handler fix.
-
-### 4.0 - 2019-09-09
-
-* tpm2_activatecredential:
-  - \--context is now \--credentialedkey-context.
-  - \--key-context is now \--credentialkey-context.
-  - \--Password is now \--credentialedkey-auth.
-  - \--endorse-passwd is now \--credentialkey-auth.
-  - \--in-file is now \--credential-secret.
-  - \--out-file is now \--certinfo-data.
-  - -f becomes -i.
-  - -k becomes -C.
-  - -e becomes -E.
-
-* tpm2_certify:
-  - \--halg is now \--hash-algorithm.
-  - \--obj-context is now \--certifiedkey-context.
-  - \--key-context is now \--signingkey-context.
-  - \--pwdo is now \--certifiedkey-auth.
-  - \--pwdk is now \--signingkey-auth.
-  - -a becomes -o.
-  - -k becomes -p.
-  - -c becomes -C.
-  - -k becomes -K.
-
-* tpm2_changeauth:
-  - New tool for changing the authorization values of:
-    - Hierarchies
-    - NV
-    - Objects
-  - Replaces tpm2_takeownership with more generic functionality.
-
-* tpm2_checkquote:
-  - \--halg is now \--hash-algorithm.
-  - \--pcr-input-file is now \--pcr.
-  - \--pubfile is now \--public.
-  - \--qualify-data is now \--qualification.
-  - -f becomes -F.
-  - -F becomes -f.
-  - -G becomes -g.
-
-* tpm2_clear:
-  - \--lockout-passwd is now \--auth-lockout.
-
-* tpm2_clearcontrol:
-  - New tool for enabling or disabling tpm2_clear commands.
-
-* tpm2_create
-  - \--object-attributes is now \--attributes.
-  - \--pwdp is now \--parent-auth.
-  - \--pwdo is now \--key-auth.
-  - \--in-file is now \--sealing-input.
-  - \--policy-file is now \--policy.
-  - \--pubfile is now \--public.
-  - \--privfile is now \--private.
-  - \--out-context is now \--key-context.
-  - \--halg is now \--hash-algorithm.
-  - \--kalg is now \--key-algorithm.
-  - -o becomes -c.
-  - -K becomes -p.
-  - -A becomes -b.
-  - -I becomes -i.
-  - -g becomes an optional option.
-  - -G becomes an optional option.
-  - Supports TPM command CreateLoaded via -c.
-
-* tpm2_createak:
-  - Renamed from tpm2_getpubak
-
-* tpm2_createek:
-  - renamed from tpm2_getpubek
-
-* tpm2_createpolicy:
-  - \--out-policy-file is now \--policy.
-  - \--policy-digest-alg is now \--policy-algorithm.
-  - \--auth-policy-session is now \--policy-session.
-  - -L becomes -l.
-  - -F becomes -f.
-  - -f becomes -o.
-  - Removed option \--set-list with short option -L.
-  - Removed option \--pcr-input-file with short option -F.
-  - Pcr policy options replaced with pcr password mini language.
-  - Removed short option a for specifying auth session. Use long option \--policy-session.
-  - Removed short option -P for specifying pcr policy. Use long option \--policy-pcr.
-
-* tpm2_createprimary:
-  - \--object-attributes is now \--attributes.
-  - -o is now -c
-  - \--pwdp is now \--hierarchy-auth.
-  - \--pwdk is now \--key-auth.
-  - \--halg is now \--hash-algorithm.
-  - \--kalg is now \--key-algorithm.
-  - \--context-object is now \--key-context.
-  - \--policy-file is now \--policy.
-  - support for unique field when creating objects via -u
-  - saves a context file for the generated primary's handle to disk via -c.
-  - -A becomes -a.
-  - -K becomes -p.
-  - -H becomes -C.
-  - -g becomes optional.
-  - -G becomes optional.
-
-* tpm2_dictionarylockout:
-  - \--lockout-passwd is now \--auth.
-  - -P becomes -p.
-
-* tpm2_duplicate:
-  - New tool for duplicating TPM objects.
-
-* tpm2_encryptdecrypt:
-  - \--pwdk is now \--auth.
-  - \--out-file is now \--output.
-  - -D becomes -d.
-  - -I becomes an argument.
-  - -P becomes -p.
-  - Support IVs via -t or \--iv.
-  - Support modes via -G.
-  - Support padding via -e or \--pad.
-  - Supports input and output to stdin and stdout respectively.
-
-* tpm2_evictcontrol:
-  - \--auth is now \--hierarchy.
-  - \--context is now \--object-context.
-  - \--pwda is now \--auth.
-  - \--persistent with short option -S is now an argument.
-  - -A becomes -C.
-  - Added option \--output -o to serialize handle to disk.
-  - Removed option \--handle with short option -H.
-  - Raw object-handles and object-contexts are commonly handled with object
-    handling logic.
-  - Removed option \--input-session-handle with short option -i.
-  - Authorization session is now part of password mini language.
-
-* tpm2_getcap:
-  - -c becomes an argument.
-  - Most instances of value replaced with raw in YAML output.
-  - TPM2_PT_MANUFACTURER displays string value and raw value.
-  - Supports \--pcr option for listing hash algorithms and bank numbers.
-
-* tpm2_getekcertificate:
-  - Renamed from tpm2_getmanufec
-
-* tpm2_getmanufec:
-  - Renamed the tool to tpm2_getekcertificate.
-  - Removed ek key creation and management logic.
-  - Added option for getting ek cert for offline platform via -x.
-  - Support for ECC keys.
-  - \--ec-cert is now \--ek-certificate,
-  - \--untrusted is now \--allow-unverified,
-  - \--output is now \--ek-public,
-  - -U is now -X.
-  - -O is now -x.
-  - -f becomes -o.
-  - Removed option -P or \--endorse-passwd.
-  - Removed option -p or \--ek-passwd.
-  - Removed option -w or \--owner-passwd.
-  - Removed option -H or \--persistent-handle.
-  - Removed option -G or \--key-algorithm.
-  - Removed option -N or \--non-persistent.
-  - Removed option -O or \--offline.
-
-* tpm2_getpubak:
-  - renamed to tpm2_createak.
-  - -f becomes -p and -f is used for format of public key output.
-  - \--auth-endorse is now \--eh-auth.
-  - \--auth-ak is now \--ak-auth.
-  - \--halg is now \--hash-algorithm.
-  - \--kalg is now \--key-algorithm.
-  - -e becomes -P.
-  - -P becomes -p.
-  - -D becomes -g.
-  - -p becomes -u.
-  - \--context becomes \--ak-context.
-  - \--algorithm becomes \--kalg.
-  - \--digest-alg becomes \--halg.
-  - \--privfile becomes \--private.
-  - remove -k persistant option. Use tpm2_evictcontrol.
-  - Fix -o option to -w.
-  - now saves a context file for the generated primary's handle to disk.
-  - -E becomes -e.
-  - -g changes to -G.
-  - support for non-persistent AK generation.
-
-* tpm2_getpubek:
-  - renamed to tpm2_createek
-  - \--endorse-passwd is now \--eh-auth.
-  - \--owner-passwd is now \--owner-auth.
-  - \--ek-passwd is now \--ek-auth.
-  - \--file is now \--public.
-  - \--context is now \--ek-context.
-  - \--algorithm is now \--key-algorithm.
-  - -e is now -P.
-  - -P is now -p.
-  - -p is now -u.
-  - -o is now -w.
-  - -g is now -G.
-  - Support for saving a context file for the generated primary keys handle
-    to disk.
-  - support for non-persistent EK generation.
-  - -f is now -p.
-  - -f support for format of public key output.
-
-* tpm2_getrandom:
-  - change default output to binary.
-  - add \--hex option for output to hex format.
-  - \--out-file is now \--output.
-  - bound input request on max hash size per spec, allow -f to override this.
-
-* tpm_gettestresult:
-  - new tool for getting test results.
-
-* tpm2_hash:
-  - add \--hex for specifying hex output.
-  - default output of hash to stdout.
-  - default output of hash as binary.
-  - remove output of ticket to stdout.
-  - \--halg is now \--hash-algorithm.
-  - \--out-file is now \--output.
-  - -a is now -C.
-  - -H is now -a.
-
-* tpm2_hmac:
-  - add -t option for specifying ticket result.
-  - \--out-file is now \--output.
-  - \--auth-key is now \--auth.
-  -\--algorithm is now \--hash-algorithm.
-  - \--pwdk is now \--auth-key.
-  - -C is now -c.
-  - -P is now -p.
-
-* tpm2_hierarchycontrol:
-  - new tool added for enabling or disabling the use
-    of a hierarchy and its associated NV storage.
-
-* tpm2_import:
-  - \--object-attributes is now \--attributes.
-  - \--auth-parent is now \--parent-auth.
-  - \--auth-key is now \--key-auth.
-  - \--algorithm is now \--key-algorithm.
-  - \--in-file is now \--input.
-  - \--parent-key is now \--parent-context.
-  - \--privfile is now \--private.
-  - \--pubfile is now \--public.
-  - \--halg is now \--hash-algorithm.
-  - \--policy-file is now \--policy.
-  - \--sym-alg-file is now \--encryption-key.
-  - -A is now -b.
-  - -k is now -i.
-  - support OSSL style -passin argument as \--passin for PEM file passwords.
-  - support additional import key types:
-    - RSA1024/2048.
-    - AES128/192/256.
-  - -q changes to -u to align with tpm2_loads public/private output arguments.
-  - Supports setting object name algorithm via -g.
-  - support specifying parent key with a context file.
-  - \--parent-key-handle/-H becomes \--parent-key/-C
-  - Parent public data option is optional and changes from `-K` to `-U`.
-  - Supports importing external RSA 2048 keys via pem files.
-  - Supports ECC Parent keys.
-
-* tpm2_incrementalselftest:
-  - Add tool to test support of specific algorithms.
-
-* tpm2_listpersistent:
-  - deleted as tpm2_getcap and tpm2_readpublic can be used instead.
-
-* tpm2_load:
-  - -o is now -c.
-  - \--context-parent is now \--parent-context.
-  - \--auth-parent is now \--auth.
-  - \--pubfile is now \--public.
-  - \--privfile is now \--private.
-  - \--out-context is now \--key-context.
-  - now saves a context file for the generated primary's handle to disk.
-  - Option `--pwdp` changes to `--auth-parent`.
-
-* tpm2_loadexternal:
-  - \--object-attributes is now --attributes.
-  - -o is now -c
-  - \--key-alg is now \--key-algorithm.
-  - \--pubfile is now \--public.
-  - \--privfile is now \--private.
-  - \--auth-key is now \--auth.
-  - \--policy-file is now \--policy.
-  - \--halg is now \--hash-algorithm.
-  - \--out-context is now \--key-context.
-  - Remove unused -P option.
-  - -H is now -a.
-  - Fix -A option to -b for attributes.
-  - now saves a context file for the generated primary's handle to disk.
-  - support OSSL style -passin argument as \--passin for PEM file passwords.
-  - name output to file and stdout. Changes YAML stdout output.
-  - ECC Public and Private PEM support.
-  - AES Public and Private "raw file" support.
-  - RSA Public and Private PEM support.
-  - Object Attribute support.
-  - Object authorization support.
-  - Default hierarchy changes to the *null* hierarchy.
-
-* tpm2_makecredential:
-  - \--out-file is now \--credential-blob
-  - \--enckey is now \--encryption-key.
-  - Option `--sec` changes to `--secret`.
-
-* tpm2_nvdefine:
-  - \--handle-passwd is now \--hierarchy-auth.
-  - \--index-passwd is now \--index-auth.
-  - \--policy-file is now \--policy.
-  - \--auth-handle is now \--hierarchy.
-  - -a becomes -C.
-  - -t becomes -a.
-  - -I becomes -p.
-  - Removed option \--index with short option -x. It is now an argument.
-  - Removed option \--input-session-handle with short option -S.
-  - Authorization session is now part of password mini language.
-
-* tpm2_nvincrement:
-  - New tool to increment value of a Non-Volatile (NV) index setup as a
-  counter.
-
-* tpm2_nvlist:
-  - tpm2_nvlist is now tpm2_nvreadpublic.
-
-* tpm2_nvread:
-  - \--handle-passwd is now \--auth.
-  - \--auth-handle is now \--hierarchy.
-  - -a becomes -C.
-  - Removed option \--index with short option -x. It is now an argument.
-  - Removed short option -o for specifying offset. Use long option \--offset.
-  - Removed option \--input-session-handle with short option -S.
-  - Authorization session is now part of password mini language.
-  - Removed option \--set-list with short option -L.
-  - Removed option \--pcr-input-file with short option -F.
-  - Pcr policy options replaced with pcr password mini language.
-  - fix a buffer overflow.
-
-* tpm2_nvreadlock:
-  - \--handle-passwd is now \--auth.
-  - \--auth-handle is now \--hierarchy.
-  - -a becomes -C.
-  - Removed option \--index with short option -x. It is now an argument.
-  - Removed option \--input-session-handle with short option -S.
-  - Authorization session is now part of password mini language.
-
-* tpm2_nvwrite:
-  - \--handle-passwd is now \--auth.
-  - \--auth-handle is now \--hierarchy.
-  - -a becomes -C.
-  - Removed option \--index with short option -x. It is now an argument.
-  - Removed short option -o for specifying offset. Use long option \--offset.
-  - Removed option \--input-session-handle with short option -S.
-  - Authorization session is now part of password mini language.
-  - Removed option \--set-list with short option -L.
-  - Removed option \--pcr-input-file with short option -F.
-  - Pcr policy options replaced with pcr password mini language.
-
-* tpm2_nvrelease:
-  - \--handle-passwd is now \--auth.
-  - \--auth-handle is now \--hierarchy.
-  - -a becomes -C.
-  - Removed option \--index with short option -x. It is now an argument.
-  - Removed option \--input-session-handle with short option -S.
-  - Authorization session is now part of password mini language.
-
-* tpm2_nvundefine:
-  - Renamed from tpm2_nvrelease.
-
-* tpm2_pcrallocate:
-  - New tool for changing the allocated PCRs of a TPM.
-
-* tpm2_pcrevent:
-  - \--password is now \--auth.
-  - Removed option \--pcr-index with short option -i.
-  - PCR index is now specified as an argument.
-  - Removed option \--input-session-handle with short option -S.
-  - Authorization session is now part of password mini language.
-
-* tpm2_pcrlist:
-  - -gls options go away with -g and -l becoming a single argument.
-
-* tpm2_pcrread:
-  - Renamed from tpm2_pcrlist.
-
-* tpm2_print:
-  - New tool that decodes a TPM data structure and prints enclosed elements
-  to stdout as YAML.
-
-* tpm2_policyauthorize:
-  - New tool that allows for policies to change by associating the policy to
-  a signing authority essentially allowing the auth policy to change.
-
-* tpm2_policycommandcode:
-  - New tool to restricts TPM object authorization to specific TPM commands.
-
-* tpm2_policyduplicationselect:
-  - New tool for creating a policy to restrict duplication to a new parent
-  and or duplicable object.
-
-* tpm2_policylocality:
-  - New tool for creating a policy restricted to a locality.
-
-* tpm2_policypcr:
-  - New tool to generate a pcr policy event that bounds auth to specific PCR
-  values in user defined pcr banks and indices.
-
-* tpm2_policyor:
-  - New tool to compound multiple policies in a logical OR fashion to allow
-  multiple auth methods using a policy session.
-
-* tpm2_policypassword:
-  - New tool to mandate specifying of the object password in clear using a
-    policy session.
-
-* tpm2_policysecret:
-  - New tool to associate auth of a reference object as the auth of the new
-    object using a policy session.
-
-* tpm2_quote:
-  - \--ak-context is now \--key-context.
-  - \--ak-password is now \--auth.
-  - \--sel-list is now \--pcr-list.
-  - \--qualify-data is now \--qualification-data.
-  - \--pcrs is now \--pcr.
-  - \--sig-hash-algorithm is now \--hash-algorithm.
-  - -P becomes -p
-  - -L becomes -l.
-  - -p becomes -o.
-  - -G becomes -g.
-  - -g becomes optional.
-  - Removed option \--id-list with short option -l.
-  - Removed option \--ak-handle with short option -k.
-  - Raw object-handles and object-contexts are commonly handled with object
-    handling logic.
-
-* tpm2_readpublic:
-  - \--opu is now \--output.
-  - \--context-object is now \--object-context.
-  - Removed option \--object with short option -H.
-  - Raw object-handles and object-contexts are commonly handled with object
-    handling logic.
-  - Added \--serialized-handle for saving serialized ESYS_TR handle to disk.
-  - Added \--name with short option -n for  saving the binary name.
-  - Supports ECC pem and der file generation.
-
-* tpm2_rsadecrypt:
-  - \--pwdk is now \--auth.
-  - \--out-file is now \--output.
-  - -P becomes -p.
-  - Added \--label with short option -l for specifying label.
-  - Added \--scheme with short option -s for specifying encryption scheme.
-  - Removed option -I or in-file input option and make argument.
-  - Removed option \--key-handle with short option -k.
-  - Raw object-handles and object-contexts are commonly handled with object
-    handling logic.
-  - Removed option \--input-session-handle with short option -S.
-  - Authorization session is now part of password mini language.
-
-* tpm2_rsaencrypt:
-  - \--out-file is now \--output.
-  - Added \--scheme with short option -s for specifying encryption scheme.
-  - Added \--label with -l for specifying label.
-  - Removed option \--key-handle with short option -k.
-  - Raw object-handles and object-contexts are commonly handled with object
-    handling logic.
-  - make output binary either stdout or file based on -o.
-
-* tpm2_selftest:
-  - New tool for invoking tpm selftest.
-
-* tpm2_send:
-  - \--out-file is now \--output.
-
-* tpm2_sign:
-  - \--pwdk is now \--auth.
-  - \--halg is now \--hash-algorithm.
-  - \--sig is now \--signature.
-  - -P becomes -p.
-  - -s becomes -o.
-  - Added \--digest with short option -d.
-  - Added \--scheme with short option -s.
-  - Supports rsapss.
-  - Removed option \--key-handle with short option -k.
-  - Raw object-handles and object-contexts are commonly handled with object
-    handling logic.
-  - Removed option \--msg with short option -m.
-  - Make -d toggle if input is a digest.
-  - Removed option \--input-session-handle with short option -S.
-  - Authorization session is now part of password mini language.
-  - Supports signing a pre-computed hash via -d.
-
-* tpm2_startauthsession:
-  - New tool to start/save a trial-policy-session (default) or policy-
-    authorization-session with command line option --policy-session.
-
-* tpm2_stirrandom:
-  - new command for injecting entropy into the TPM.
-
-* tpm2_takeownership:
-  - split into tpm2_clear and tpm2_changeauth
-
-* tpm2_testparms:
-  - new tool for querying tpm for supported algorithms.
-
-* tpm2_unseal:
-  - \--pwdk is now \--auth.
-  - \--outfile is now \--output.
-  - \--item-context is now \--object-context.
-  - -P becomes -p
-  - Removed option \--item with short option -H.
-  - Raw object-handles and object-contexts are commonly handled with object
-    handling logic.
-  - Removed option \--input-session-handle with short option -S.
-  - Authorization session is now part of password mini language.
-  - Removed option \--set-list with short option -L.
-  - Removed option \--pcr-input-file with short option -F.
-  - Pcr policy options replaced with pcr password mini language.
-
-
-* tpm2_verifysignature:
-  - \--halg is now \--hash-algorithm.
-  - \--msg is now \--message.
-  - \--sig is now \--signature.
-  - -D becomes -d.
-  - -t becomes optional.
-  - Issue warning when ticket is specified for a NULL hierarchy.
-  - Added option \--format with short option -f.
-  - Removed option \--raw with short option -r.
-  - Removed option \--key-handle with short option -k.
-  - Raw object-handles and object-contexts are commonly handled with object
-    handling logic.
-  - Support routines for OpenSSL compatible format of public keys (PEM, DER) and
-    plain signature data without TSS specific headers.
-
-* misc:
-  - cmac algorithm support.
-  - Add support for reading authorisation passwords from a file.
-  - Ported all tools from SAPI to ESAPI.
-  - Load TCTI's by SONAME, not raw .so file.
-  - system tests are now run with make check when --enable-unit is used in configure.
-  - Libre SSL builds fixed.
-  - Dynamic TCTIS. Support for pluggable TCTI modules via the -T or --tcti
-    options.
-  - test: system testing scripts moved into subordinate test directory.
-  - configure: enable code coverage option.
-  - env: add TPM2TOOLS_ENABLE_ERRATA to control the -Z or errata option.
-    affects all tools.
-  - Fix parsing bug in PCR mini-language.
-  - Fix misspelling of TPM2_PT_HR constants which effects tpm2_getcap output.
-  - configure option --with-bashcompdir for specifying bash completion
-    directory.
-
-### 3.2.0 - 2019-06-19
-  * fix configure bug for linking against libmu.
-  * tpm2_changeauth: Support changing platform hierarchy auth.
-  * tpm2_flushcontext: Introduce new tool for flushing handles from the TPM.
-  * tpm2_checkquote: Introduce new tool for checking validity of quotes.
-  * tpm2_quote: Add ability to output PCR values for quotes.
-  * tpm2_makecredential: add support for executing tool off-TPM.
-  * tpm2_pcrreset: introduce new tool for resetting PCRs.
-  * tpm2_quote: Fix AK auth password not being used.
-
-### 3.1.4 - 2019-03-14
-  * Fix various man pages
-  * tpm2_getmanufec: fix OSSL build warnings
-  * Fix broken -T option
-  * Various build compatibility fixes
-  * Fix some unit tests
-  * Update build for recent autoconf-archive versions
-  * Install m4 files
-
-### 3.1.3 - 2018-10-15
-  * Restore support for the TPM2TOOLS_* env vars for TCTI configuration, in
-  addition to supporting the new unified TPM2TOOLS_ENV_TCTI
-  * Fix tpm2_getcap to print properties with the TPM_PT prefix, rather than
-  TPM2_PT
-  * Make test_tpm2_activecredential Python 3 compatible
-  * Fix tpm2_takeownership to only attempt to change the specified hierarchies
-
-### 3.1.2 - 2018-08-14
-  * Revert the change to use user supplied object attributes exclusively. This is an inappropriate behavioural change for a MINOR version number increment.
-  * Fix inclusion of object attribute specifiers section in tpm2_create and tpm2_createprimary man pages.
-  * Use better object attribute defaults for authentication, preventing an empty password being used for authentication when a policy is set.
-
-### 3.1.1 - 2018-07-09
-  * Allow man page installation without pandoc being available
-
-### 3.1.0 - 2018-06-21
-  * Update to use TSS version 2.0
-  * When user supplies nv attributes use those exclusively, not in addition to the defaults
-  * When user supplies object attributes use those exclusively, not in addition to the defaults
-  * Load TCTI's by SONAME, not raw .so file
-
-### 3.0.4 - 2018-05-30
-  * Fix save and load for TPM2B_PRIVATE object.
-  * Use a default buffer size for tpm2_nv{read,write} if the TPM reports a 0 size.
-  * Fix --verbose and --version options crossover.
-  * Generate man pages from markdown and include them in the distribution tarball.
-  * Print usage summary if tools are executed with no options or man page can't be displayed.
-
-### 3.0.3 - 2017-15-18
-  * Tools that don't need a TPM to work no longer request
-    a TPM connection. Namely, tpm2_rc_decode
-  * Fix undefined references in libmarshal port.
-
-### 3.0.2 - 2017-12-18
-  * configure: enable code coverage option.
-  * build: enable silent rules options.
-  * Add system tests to dist tarball.
-  * tpm2_nv(read|write): fix buffer overflows.
-
-### 3.0.1 - 2017-12-11
-  * Makefile: add missing LICENSE and markdown files.
-### 3.0 - 2017-12-08
-  * tpm2_getmanufec: -O as a flag for -f has changed. -O is for existing EK public structure
-      and -f is only for generated EK public output.
-  * tpm2_nvlist: output in yaml format.
-  * tpm2_makecredential format changes to the -o output file.
-  * tpm2-quote: -o option removed.
-  * tpm2_rsaencrypt: -I is now an argument and input defaults to stdin. -o is optional and
-    defaults to stdout.
-  * tpm2_listpersistent: output friendly object attributes.
-  * tpm2_createprimary: support friendly object attributes via -A. -H becomes auth
-    hierarchy.
-  * tpm2_create: support friendly object attributes via -A.
-  * tpm2_nvwrite and tpm2_nvread have support for satisfying PCR policies.
-  * tpm2_encryptdecrypt: has support for EncryptDecrypt2 command.
-  * tpm2_nvwrite: -f option removed, support for stdin data supported. Support for starting
-      index to write to.
-  * errata framework added for dealing with spec errata.
-  * tpm2_quote: -G option for signature hash algorithm specification.
-  * tpm2_dump_capability: renamed to tpm2_getcap.
-  * tpm2_send_command: renamed to tpm2_send and the input file is now an
-    argument vs using -i.
-  * tpm2_dump_capability: outputs human readable command codes.
-  * camelCase options are now all lower case. For example, --camelCase becomes --camel-case.
-  * tpm2_quote,readpublic, and sign now have support for pem/der output/inputs. See the
-    respective man pages for more details.
-  * tpm2_nvread: Has an output file option, -f.
-  * manpages: Are now in Markdown and converted to roff using pandoc.
-  * tpm2_create - options 'o' and 'O' changed to 'u' and 'r' respectively.
-  * tpm2_pcrlist: support yaml output for parsing.
-  * tpm2_pcrevent: new tool for hashing and extending pcrs.
-  * Make tpm2_{createprimary,create,load,pcrlist,hmac} tools to support the --quiet option.
-  * Support for a --quiet option to suppress messages printed by tools to standard output.
-  * tpm2_hmac: support for files greater than 1024 bytes, changes in options and arguments.
-  * tpm2_hash: support for files greater than 1024 bytes, changes in options and arguments.
-  * Install is now to bin vs sbin. Ensure that sbin tools get removed!
-  * make dist and distcheck are now working.
-  * installation into customized locations are now working, see issue #402 for details.
-  * tpm2_pcrlist: renamed from tpm2_listpcrs.
-  * tpm2_pcrextend: new tool for extending PCRs.
-  * tpm2_getmanufec: -E option no longer required, defaults to stdout.
-  * tpm2_nvlist: Support for friendly nv attributes in output.
-  * Support for friendly algorithm names for algorithm identifiers.
-  * tpm2_nvread: The option, -s, or size option is no longer required.
-  * tpm2_nvwrite: fixed to write files larger than 1024 in size.
-  * tpm2_nvread: fixed to read files larger than 1024 in size.
-  * tpm2_nvdefine supports "nice-names" for nv space attributes.
-  * Support using PCR Policy directly with tpm2_unseal tool.
-  * Support PCR policy creation in tpm2_createpolicy
-  * Support using a policy session as input to tools that may need to satisfy complex policies
-    other than password.
-  * tpm2_unseal: supports output to stdoud.
-  * tpm2_create: enforce policy based authorization.
-  * tpm2_createprimary: add ability to create objects with policy based authorization.
-  * tpm2_nvdefine: add ability to create nv indexes with policy based authorization.
-  * Support Clang Build.
-  * tpm2_unseal test uses endorsement hierarchy as platform hierarchy is unavailable on a
-    real tpm.
-  * Numerous cleanups and minor bug fixes.
-
-### v2.0 - 2017-03-29
-
-  * Tracked on the milestone: https://github.com/tpm2-software/tpm2-tools/milestone/2
-  * Reworked all the tools to support configurable TCTIs, based on build time
-    configuration, one can specify the tcti via the --tcti (-T) option to all
-    tools.
-  * tpm2_getrandom interface made -s a positional argument.
-  * Numerous bug fixes.
-
-### v1.1 - 2016-11-04
-
-  * travis ci support.
-  * Allow for unit tests to be enabled selectively.
-  * tpm2_rc_decode tool: Decode TPM_RC error codes.
-  * Android Make file
-  * tpm2_listpersistent: list all persistent objects
-  * test scripts for tpm2-tools
-  * tpm2_nvreadlock
-  * tpm2_getmanufec: retrieve EC from tpm manufacturer server.
-  * Copy 'common' and 'sample' code from the TPM2.0-TSS repo.
-
-  **Modified**
-
-  * tpm2_takeownership: update option -c to use lockout password to clear.
-  * tpm2_listpcrs: add options -L and -s, rewrite to increase performance.
-  * tpm2_quote: added -L option to support selection of multiple banks.
-  * tpm2_quote: add -q option to get qualifying data.
-  * configure: Use pkg-config to get info about libcurl and libcrypto.
-  * configure: Use pkg-config to locate SAPI and TCTI headers / libraries.
-  * tpm2_x: Add -X option to enable password input in Hex format.
-  * tpm2_nvdefine: Change -X option to -I.
-  * tpm2-nvwrite: fix for unable to write 1024B+ data.
-  * tpm2_getmanufec: Fix base64 encoding.
-  * tpm2_x: fixed a lot of TPM2B failures caused by wrong initialization.
-  * tpm2_getmanufec: let configure handle libs.
-  * tpm2_getmanufec: Convert from dos to unix format.
-  * build: Check for TSS2 library @ configure time.
-  * build: Detect required TSS2 and TCTI headers.
-  * build: Use libtool to build the common library
-  * build: Install all binaries into sbin.
-  * build: Build common sources into library.
-  * build: Move all source files to 'src'.
-  * Makefile.am: Move all build rules into single Makefile.am.
-  * everything: Use new TCTI headers and fixup API calls.
-  * everything: Update source to cope with sapi header cleanup.
-  * tpm2_activatecredential: Updated to support TCG compatible EK
-  * tpm2_getpubak: Updated to use TCG compatible EK
-  * tpm2_getpubek: fix ek creation to follow TCG EK profile spec.
-
-  **Removed**
-
-  * Windows related code
-  * dependency on the TPM2.0-TSS repo source code
-
-### v1.0 - 2015-10-19
-
-  * 1.0 release
-  * 29 tools included

_service:tar_scm:tpm2-tools-5.0.tar.gz/doc/CONTRIBUTING.md Deleted

@@ -1,27 +0,0 @@
-## Guidelines for submitting bugs:
-
-All non security bugs can be filed on the Issues tracker:
-
-<https://github.com/tpm2-software/tpm2-tools/issues>
-
-Security sensitive bugs should be emailed to a maintainer or to Intel
-via the guidelines here:
-
-<https://security-center.intel.com/VulnerabilityHandlingGuidelines.aspx>
-
-## Guidelines for submitting changes:
-
-All changes should be introduced via github pull requests. This allows anyone to
-comment and provide feedback in lieu of having a mailing list. For pull requests
-opened by non-maintainers, any maintainer may review and merge that pull request.
-For maintainers, they either must have their pull request reviewed by another
-maintainer if possible, or leave the PR open for at least 24 hours, we consider
-this the window for comments.
-
-All tests must pass on Travis CI for the merge to occur.
-All changes must not introduce superfluous whitespace changes or whitespace errors.
-All changes should adhere to the coding standard documented under misc.
-
-### Guideline for merging changes:
-Changes should be merged with the "rebase" option on github to avoid merge commits.
-This provides for a clear linear history.

_service:tar_scm:tpm2-tools-5.0.tar.gz/doc/INSTALL.md Deleted

@@ -1,218 +0,0 @@
-## Building tpm2-tools
-
-Below you will find instructions to build and install the tpm2-tools project.
-
-### Download the Source
-To obtain the tpm2-tools sources you must clone them as below:
-```
-git clone https://github.com/tpm2-software/tpm2-tools
-```
-
-### Dependencies
-
-To build and install the tpm2-tools software the following software is required:
-
-  * GNU Autoconf (version >= 2019.01.06)
-  * GNU Automake
-  * GNU Libtool
-  * pkg-config
-  * C compiler
-  * C Library Development Libraries and Header Files (for pthreads headers)
-  * ESAPI - TPM2.0 TSS ESAPI library (tss2-esys) and header files
-  * OpenSSL libcrypto library and header files
-  * Curl library and header files
-  * Universally Unique ID library (UUID)
-
-#### Optional Dependencies:
-  * To build the man pages you need pandoc(https://github.com/jgm/pandoc)
-  * FAPI - TPM2.0 TSS FAPI library (tss2-fapi) and header files
-  * To enable the new userspace resource manager, one must get tpm2-tabrmd
-    (**recommended**).
-  * When ./configure is invoked with --enable-unit or --enable-unit=abrmd,
-    the tests are run towards a resource manager, tpm2-abrmd, which must be on $PATH.
-  * When ./configure is invoked with --enable-unit=mssim, the tests are run directly
-    towards tpm_server, without resource manager.
-  * For the tests, with or without resource manager, tpm_server must be installed.
-  * Some tests pass only if xxd, expect, bash and python with PyYAML are available
-  * Some tests optionally use (but do not require) curl
-
-### Typical Distro Dependency Installation
-
-Here we are going to satisfy tpm2-tools dependencies with:
-* tpm2-tss: <https://github.com/tpm2-software/tpm2-tss>
-* tpm2-abrmd: <https://github.com/tpm2-software/tpm2-abrmd>
-* TPM simulator: <https://downloads.sourceforge.net/project/ibmswtpm2/ibmtpm1332.tar.gz>
-
-Which are necessary for the build example section at the bottom of this file, we need to satisfy the dependencies for each item named above except for the simulator.
-
-#### Ubuntu 16.04
-
-Satisfying the dependencies for tpm2-tools falls into two general steps, stuff
-you can easily get via the package manager, and stuff you cannot.
-
-**NOTE**: The *tpm2 Userspace Dependencies* may not be the correct version in
-your distros package manager.
-
-**Packages**:
-
-The packages in the below command can be ascertained via the package manager.
-
-```
-sudo apt-get install autoconf automake libtool pkg-config gcc \
-    libssl-dev libcurl4-gnutls-dev uuid-dev python-yaml
-```
-**Notes**:
-
-  * One can substitute gcc for clang if they desire.
-  * On pre-ubuntu 16.04 `libcurl4-gnutls-dev` was provided by `libcurl-dev`
-    * The libcurl dependency can be satisfied in many ways, and likely change
-      with Ubuntu versions:
-      * `libcurl4-openssl-dev 7.47.0-1ubuntu2.2`
-      * `libcurl4-nss-dev 7.47.0-1ubuntu2.2`
-      * `libcurl4-gnutls-dev 7.47.0-1ubuntu2.2`
-  * One needs autoconf archive, which is too old in the packagemanager. You can get
-    working version from here(http://ftpmirror.gnu.org/autoconf-archive/autoconf-archive-2019.01.06.tar.xz)
-
-**tpm2 Userspace Dependencies**:
-
-The following tpm2 userspace dependencies can be satisfied by getting the
-source, building and installing them. They can be located here:
-
-  * ESAPI - The enhanced system API: <https://github.com/tpm2-software/tpm2-tss>
-  * ABRMD (**recommended but optional**) - Which is the userspace resource
-    manager: <https://github.com/tpm2-software/tpm2-abrmd>
-
-
-
-#### Fedora
-
-
-In case you want to build from source the next command block should cover all the dependencies for tpm2-tools, the enhanced system API (tpm2-tss) and the userspace resource manager (tpm2-abrmd).
-
-```
-$ sudo dnf -y update && sudo dnf -y install automake libtool \
-autoconf autoconf-archive libstdc++-devel gcc pkg-config \
-uriparser-devel libgcrypt-devel dbus-devel glib2-devel \
-compat-openssl10-devel libcurl-devel PyYAML
-
-```
-Some distros have the dependencies already packaged, you can simply install the package that contains the needed build requirements.
-
-```
-$ sudo dnf builddep tpm2-tools
-
-```
-
-The package installed above contains all the dependencies for tpm2-tools included the projects mentioned at the beginning of this section (tpm2-tss and tpm2-abrmd)
-
-For more detailed information about the dependencies of tpm2-tss and tmp2-abrmd, please consult the corresponding links for each project. You can find these links in
-the Dependency-Matrix(https://tpm2-software.github.io/versions/)
-
-## Building
-
-To compile tpm2-tools execute the following commands from the root of the
-source directory:
-```
-$ ./bootstrap
-$ ./configure
-$ make
-```
-
-This is sufficient for running as long as you alter `PATH` so that it points to
-the *tools* directory, or just execute them via a full path.
-
-For Example:
-
-```
-./tools/tpm2_getrandom 4
-```
-
-### Building from source example
-
-
-Now we can start building the projects, there are four major steps for building the projects from source:
-#### Bootstrapping the build
-
-With the bootstrap command we run a script which generates the list of source files along with the configure script.
-
-In the project directory:
-
-```
-$  ./bootstrap
-```
-
-#### Configuring the build
-
-Here we run the configure script, this generates the makefiles needed for the compilation.
-
-```
-$ ./configure
-```
-
-Depending of the project, you can add additional information to the configure script, please refer to the links provided below for more information about the custom options.
-
-* Default values for GNU installation directories: <https://www.gnu.org/prep/standards/html_node/Directory-Variables.html>
-* Custom options for tpm2-tss: <https://github.com/tpm2-software/tpm2-tss/blob/master/INSTALL.md>
-* Custom options for tpm2-abrmd: <https://github.com/tpm2-software/tpm2-abrmd/blob/master/INSTALL.md>
-
-#### Compiling the Libraries
-
-We use the make command for compile the code.
-
-```
-$ make -j$(nproc)
-```
-
-
-#### Installing the Libraries
-
-Once we have finish building the projects it's time to install them.
-
-```
-$ sudo make install
-```
-Now putting all together:
-
-* ##### Tpm2-tss
-```
-$ git clone https://github.com/tpm2-software/tpm2-tss.git
-$ cd tpm2-tss
-$ ./bootstrap
-$ ./configure --prefix=/usr
-$ make -j5
-$ sudo make install
-```
-
-* ##### Tpm2-abrmd
-```
-$ git clone https://github.com/tpm2-software/tpm2-abrmd.git
-$ cd tpm2-abrmd
-$ ./bootstrap
-$ ./configure --with-dbuspolicydir=/etc/dbus-1/system.d
---with-udevrulesdir=/usr/lib/udev/rules.d
---with-systemdsystemunitdir=/usr/lib/systemd/system
---libdir=/usr/lib64 --prefix=/usr
-$ make -j5
-$ sudo make install
-```
-
-* ##### Tpm2-tools
-```
-$ git clone https://github.com/tpm2-software/tpm2-tools.git
-$ cd tpm2-tools
-$ ./bootstrap
-$ ./configure --prefix=/usr
-$ make -j5
-$ sudo make install
-```
-* ##### TPM simulator
-```
-$ mkdir ibmtpm && cd ibmtpm
-$ wget https://sourceforge.net/projects/ibmswtpm2/files/latest/download -O ibmtpm.tar.gz
-$ tar -zxvf ibmtpm.tar.gz
-$ cd src
-$ make -j5
-```
-
-
-And it's done, you are ready to run the projects.

_service:tar_scm:tpm2-tools-5.0.tar.gz/doc/RELEASE.md Deleted

@@ -1,232 +0,0 @@
-# Release Lifecycle
-
-All tpm2-tools project releases before 4.0 is considered legacy and is or will
-be reaching end of life. Releases greater than 4.0 will always
-**will be backwards compatible**. Thus, based on the semver.org rules outlined,
-pretty much dictates we will never be off of a 4.X version number. Because of
-this, master will always be the *next* release, and bugfix only releases can be
-branched off of *master* as needed. These patch level branches will be supported
-on an as needed bases, since we don't have dedicated stable maintainers. The
-majority of development will occur on *master* with tagged release numbers
-following semver.org recommendations. This page explicitly does not formalize an
-LTS support timeline, and that is intentional. The release schedules and
-required features are driven by community involvement and needs. However,
-milestones will be created to outline the goals, bugs, issues and timelines of
-the next release.
-
-## End Of Life versions
-- 1.X(https://github.com/tpm2-software/tpm2-tools/tree/1.X)
-- 2.X(https://github.com/tpm2-software/tpm2-tools/tree/2.X)
-- 3.0.X(https://github.com/tpm2-software/tpm2-tools/tree/3.0.X)
-
-## Near End of Life
-- 3.0.X(https://github.com/tpm2-software/tpm2-tools/tree/3.0.X): EOL after
-3.2.1 release.
-
-## OpenSSL
-
-tpm2-tools relies heavily on OpenSSL. OpenSSL will be EOL'ing 1.0.2 at the end
-of 2019, see: https://www.openssl.org/blog/blog/2018/05/18/new-lts/. When this
-occurs, we will remove OSSL 1.0.2 support from the tpm2-tools repository as
-supporting an EOL crypto library is not a good idea.
-
-# Release Information
-
-Releases shall be tagged following semantic version guidelines found at:
-  - http://semver.org/
-
-The general release process will be one of two models:
-
-- Tag releases off of branch master.
-- Tag releases off of a release specific branch.
-  - Release specific branch names can be for long-running major versions, IE 3.1, 3.2, 3.3, etc.
-    and *SHALL* be named `<major-version>.X`.
-  - Release specific branch names can be for long-running minor versions, IE 3.1.1, 3.1.2, etc.
-    and *SHALL* be named `<major-version>.<minor-version>.X`.
-
-Release candidates will be announced on the
-mailing list(https://lists.01.org/mailman/listinfo/tpm2). When a RC has gone 1
-week without new substantive changes, a release will be conducted. Substantive
-changes are generally not editorial in nature and they do not contain changes to
-the CI system. Substantive changes are changes to the man-pages, code or tests.
-
-When a release is cut, the process is the same as a Release Candidate (RC), with the exception that
-it is not marked as "pre-release" on GitHub. The release notes should include everything from the
-last release to the latest release.
-
-## Updating the CHANGELOG for release candidates and final releases
-
-When a first release candidate is cut, a new entry will be added to the CHANGELOG file. This
-entry will have the release candidate version and the date on which the release candidate was
-released. The entry will list all the changes that happened between the latest final release
-and the first release candidate.
-
-The commit that made the change will be tagged with a release version and a -rc0 suffix as an
-indication that is not a final release but a first release candidate. If after a week the -rc
-has no changes, then a final release can be made as explained above. But if changes are made,
-then a new releases candidate will be released and the -rc suffix will be incremented.
-
-For each release candidate, the changes that happened between the previous release candidate
-will be appended to the CHANGELOG entry, and both the release candidate version and the date
-of the release will be updated to reflect the latest release candidate.
-
-The commit that updated the CHANGELOG entry will be tagged as the latest release candidate.
-
-When a final version will be released, there will not be changes to append to the CHANGELOG
-entry since otherwise a new release candidate should be cut. So only the release version and
-date should be updated in the CHANGELOG.
-
-The commit that updated the CHANGELOG entry will be tagged as the final release.
-
-For a final release, change the version to the final release version (i.e: 3.0.5-rc3 -> 3.0.5) and
-update the date. The commit for this change will be tagged as $version.
-
-## Testing
-The tools code **MUST** pass the Travis CI testing and have a clean
-Coverity scan result performed on every release. The CI testing not
-only tests for valid outputs, but also runs tests uses clang's ASAN
-feature to detect memory corruption issues.
-  - BUG: Reconfigure Coverity: https://github.com/tpm2-software/tpm2-tools/issues/1727
-
-## Release Checklist
-
-The steps, in order, required to make a release.
-
-- Ensure current HEAD is pointing to the last commit in the release branch.
-
-- Ensure Travis(https://travis-ci.org/tpm2-software/tpm2-tools) has conducted a passing build of
-  HEAD.
-
-- Update version and date information in CHANGELOG.md(CHANGELOG.md) **and** commit.
-
-- Create a signed tag for the release. Use the version number as the title line in the tag commit
-  message and use the CHANGELOG.md(CHANGELOG.md) contents for that release as the body.
-  ```bash
-  git tag -s <tag-name>
-  ```
-
-- Build a tarball for the release and check the dist tarball. **Note**: The file name of the tarball
-  should include a match for the git tag name.
-  ```bash
-  make distcheck
-  ```
-
-- Generate a detached signature for the tarball.
-  ```bash
-  gpg --armor --detach-sign <tarball>
-  ```
-
-- Push **both** the current git HEAD (should be the CHANGELOG edit) and tag to the release branch.
-  ```bash
-  git push origin HEAD:<release-branch>
-  git push origin <tag-name>
-  ```
-
-- Verify that the Travis CI build passes. **Note**: Travis will have two builds, one for the
-  push to master and one for the tag push. Both should succeed.
-
-- Create a release on Github(https://github.com/tpm2-software/tpm2-tools/releases),
-  using the `<release-tag>` uploaded. If it is a release candidate, ensure you check the "pre-release"
-  box on the GitHub UI. Use the CHANGELOG.md(CHANGELOG.md) contents for
-  that release as the message for the GitHub release. **Add the dist tarball and signature file
-  to the release**.
-
-- Update the dependency-matrix(https://tpm2-software.github.io/versions/)
-  ensuring that the CI is building against a released version of:
-  - tpm2-abrmd(https://github.com/tpm2-software/tpm2-abrmd)
-  - tpm2-tss(https://github.com/tpm2-software/tpm2-tss)
-
-  Configuration can be modified via docker-prelude.sh(.ci/docker-prelude.sh).
-
-- After the release (not a release candidate) add a commit to master updating the News section of
-  the README(README.md) to point to the latest release.
-
-- Send announcement on mailing list(https://lists.01.org/mailman/listinfo/tpm2).
-
-
-## Historical Version Information
-
-Versions after v1.1.0 will no longer have the "v" prefix. Autoconf now sets
-the VERSION #define based on the output of git describe. See commit 2e8a07bc
-for the details.
-
-Version tags after v1.1.0 shall be signed.
-
-## Verifying git signature
-
-Valid known public keys can be reached by
-referencing the annotated tags listed below:
-
-- william-roberts-pub
-- javier-martinez-pub
-- joshua-lock-pub
-- idesai-pub
-
-or via a PGP public keyring server like:
-  - http://keyserver.pgp.com/vkd/GetWelcomeScreen.event
-
-Import the key into your keyring:
-```
-$ git show annotated-tag-name | gpg --import
-```
-
-**Example**:
-```
-$ git show william-roberts-pub | gpg --import
-```
-
-Verify the release tag:
-```
-$ git tag --verify signed-tag-name
-```
-
-# Local Release Configuration
-
-Below you will find information how to configure your machine locally to conduct releases.
-
-## Signing Key Setup
-
-Signing keys should have these four properties going forward:
-  - belong to a project maintainer.
-  - be discoverable using a public GPG key server.
-  - be associated((https://help.github.com/articles/adding-a-new-gpg-key-to-your-github-account/))
-    with the maintainers GitHub account.
-  - be discoverable via an annotated tag within the repository itself.
-
-Ensure you have a key set up:
-```
-$ gpg --list-keys
-```
-
-If you don't generate one:
-```
-$ gpg --gen-key
-```
-
-Add that key to the gitconfig:
-```bash
-git config user.signingkey gpg-key-id
-```
-
-Make sure that key is reachable as an object in the repository:
-```bash
-gpg -a --export gpg-key-id | git hash-object -w --stdin object SHA
-git tag -a your-name-here-pub object SHA
-```
-
-Make sure you push the tag referencing your public key:
-```bash
-git push origin your-name-here-pub
-```
-
-Make sure you publish your key by doing:
-  - http://keyserver.pgp.com/vkd/GetWelcomeScreen.event
-    - Select "Publish your key".
-    - Select "Key block"
-    - Copy and paste the output of `gpg --armor --export <key-id>`
-    - Validate your email account.
-
-After that, you can sign tags:
-```bash
-git tag --sign signed-tag-name
-```

_service:tar_scm:tpm2-tools-5.0.tar.gz/Makefile.am -> _service:tar_scm:tpm2-tools-5.4.tar.gz/Makefile.am Changed

@@ -19,13 +19,13 @@
 AM_CFLAGS := \
     $(INCLUDE_DIRS) $(EXTRA_CFLAGS) $(TSS2_ESYS_CFLAGS) $(TSS2_MU_CFLAGS) \
     $(CRYPTO_CFLAGS) $(CODE_COVERAGE_CFLAGS) $(TSS2_TCTILDR_CFLAGS) \
-    $(TSS2_RC_CFLAGS) $(TSS2_SYS_CFLAGS) $(UUID_CFLAGS)
+    $(TSS2_RC_CFLAGS) $(TSS2_SYS_CFLAGS)
 
 AM_LDFLAGS   := $(EXTRA_LDFLAGS) $(CODE_COVERAGE_LIBS)
 
 LDADD = \
     $(LIB_COMMON) $(TSS2_ESYS_LIBS) $(TSS2_MU_LIBS) $(CRYPTO_LIBS) $(TSS2_TCTILDR_LIBS) \
-    $(TSS2_RC_LIBS) $(TSS2_SYS_LIBS) $(UUID_LIBS)
+    $(TSS2_RC_LIBS) $(TSS2_SYS_LIBS) $(EFIVAR_LIBS)
 
 AM_DISTCHECK_CONFIGURE_FLAGS = --with-bashcompdir='$$(datarootdir)/bash-completion/completions'
 
@@ -45,7 +45,7 @@
 lib_libcommon_a_CFLAGS = -fPIC $(AM_CFLAGS)
 
 tools_fapi_tss2_CFLAGS = $(FAPI_CFLAGS) -DTSS2_TOOLS_MAX="$(words $(tss2_tools))"
-tools_fapi_tss2_LDFLAGS = $(TSS2_FAPI_LIBS)
+tools_fapi_tss2_LDFLAGS = $(EXTRA_LDFLAGS) $(TSS2_FAPI_LIBS)
 tools_fapi_tss2_SOURCES = \
 	tools/fapi/tss2_template.c \
 	tools/fapi/tss2_template.h \
@@ -66,6 +66,7 @@
     tools/fapi/tss2_getplatformcertificates.c \
     tools/fapi/tss2_gettpmblobs.c \
     tools/fapi/tss2_getappdata.c \
+    tools/fapi/tss2_gettpm2object.c \
     tools/fapi/tss2_setappdata.c \
     tools/fapi/tss2_setcertificate.c \
     tools/fapi/tss2_sign.c \
@@ -103,6 +104,7 @@
 tpm2_tools = \
     tools/misc/tpm2_certifyX509certutil.c \
     tools/misc/tpm2_checkquote.c \
+    tools/misc/tpm2_encodeobject.c \
     tools/misc/tpm2_eventlog.c \
     tools/misc/tpm2_print.c \
     tools/misc/tpm2_rc_decode.c \
@@ -198,7 +200,9 @@
     tools/tpm2_commit.c \
     tools/tpm2_ecdhkeygen.c \
     tools/tpm2_ecdhzgen.c \
-    tools/tpm2_zgen2phase.c
+    tools/tpm2_zgen2phase.c \
+    tools/tpm2_sessionconfig.c \
+    tools/tpm2_getpolicydigest.c
 
 # Create the symlinks for each tool to the tpm2 and optional tss2 bundled executables
 install-exec-hook:
@@ -216,6 +220,7 @@
 endif
 
 if UNIT
+check_SCRIPTS =
 TESTS += $(check_PROGRAMS)
 check_PROGRAMS = \
     test/unit/test_string_bytes \
@@ -232,10 +237,16 @@
     test/unit/test_options \
     test/unit/test_cc_util \
     test/unit/test_tpm2_eventlog \
-    test/unit/test_tpm2_eventlog_yaml
+    test/unit/test_tpm2_eventlog_yaml \
+    test/unit/test_object
 
 TESTS += $(ALL_SYSTEM_TESTS)
 
+if HAVE_ESYS_4_0
+check_SCRIPTS += test/unit/vendor_tests.sh
+TESTS += test/unit/vendor_tests.sh
+endif
+
 if HAVE_FAPI
 TESTS += $(ALL_FAPI_TESTS)
 endif
@@ -288,7 +299,9 @@
                                       -Wl,--wrap=Esys_PolicyPCR \
                                       -Wl,--wrap=Esys_PCR_Read \
                                       -Wl,--wrap=Esys_PolicyGetDigest \
-                                      -Wl,--wrap=Esys_FlushContext
+                                      -Wl,--wrap=Esys_FlushContext \
+                                      -Wl,--wrap=files_get_file_size_path \
+                                      -Wl,--wrap=files_load_bytes_from_path
 
 test_unit_test_tpm2_policy_LDADD    = $(CMOCKA_LIBS) $(LDADD)
 
@@ -309,20 +322,25 @@
 test_unit_test_tpm2_eventlog_yaml_CFLAGS = $(AM_CFLAGS) $(CMOCKA_CFLAGS)
 test_unit_test_tpm2_eventlog_yaml_LDADD = $(CMOCKA_LIBS) $(LDADD)
 
+test_unit_test_object_CFLAGS = $(AM_CFLAGS) $(CMOCKA_CFLAGS)
+test_unit_test_object_LDADD = $(CMOCKA_LIBS) $(LDADD)
+
 AM_TESTS_ENVIRONMENT =	\
-	TPM2_ABRMD=tpm2-abrmd; export TPM2_ABRMD; \
-	TPM2_SIM=tpm_server; export TPM2_SIM; \
-	PATH=$(abs_builddir)/tools:$(abs_builddir)/tools/misc:$(abs_top_srcdir)/test/integration:$(PATH); \
-	TPM2_TOOLS_TEST_FIXTURES=$(abs_top_srcdir)/test/integration/fixtures; \
-	SRCDIR=$(abs_srcdir); export SRCDIR; BUILDDIR=$(abs_builddir); export BUILDDIR; \
+	export TPM2_ABRMD=$(TPM2_ABRMD); \
+	export TPM2_SIM=$(TPM2_SIM); \
+	export PATH=$(abs_builddir)/tools:$(abs_builddir)/tools/misc:$(abs_top_srcdir)/test/integration:$(abs_builddir)/tools/fapi:$(PATH); \
+	export TPM2_TOOLS_TEST_FIXTURES=$(abs_top_srcdir)/test/integration/fixtures; \
+	export abs_builddir=$(abs_builddir); \
+	export abs_srcdir=$(abs_srcdir); \
+	export PYTHON=$(PYTHON); \
 	export TPM2_TOOLS_TEST_FIXTURES;
 
 if PERSISTENT
     AM_TESTS_ENVIRONMENT +=	\
-        TPM2TOOLS_TEST_PERSISTENT=true; export TPM2TOOLS_TEST_PERSISTENT;
+        TPM2TOOLS_TEST_PERSISTENT=true;
 else
     AM_TESTS_ENVIRONMENT +=	\
-        TPM2TOOLS_TEST_PERSISTENT=false; export TPM2TOOLS_TEST_PERSISTENT;
+        TPM2TOOLS_TEST_PERSISTENT=false;
 endif
 
 SH_LOG_COMPILER = dbus-run-session bash
@@ -340,17 +358,18 @@
 
 EXTRA_DIST = \
     bootstrap \
-    doc/AUTHORS.md \
-    doc/CHANGELOG.md \
-    doc/CONTRIBUTING.md \
-    doc/INSTALL.md \
-    doc/LICENSE \
-    doc/MAINTAINERS.md \
-    README.md \
-    doc/RELEASE.md \
+    docs/AUTHORS.md \
+    docs/CHANGELOG.md \
+    docs/CONTRIBUTING.md \
+    docs/INSTALL.md \
+    docs/LICENSE \
+    docs/MAINTAINERS.md \
+    docs/README.md \
+    docs/RELEASE.md \
     man \
     scripts \
-    test
+    test \
+    VERSION
 
 if HAVE_MAN_PAGES
     dist_man1_MANS := \
@@ -372,6 +391,7 @@
     man/man1/tpm2_createprimary.1 \
     man/man1/tpm2_dictionarylockout.1 \
     man/man1/tpm2_duplicate.1 \
+    man/man1/tpm2_encodeobject.1 \
     man/man1/tpm2_getcap.1 \
     man/man1/tpm2_encryptdecrypt.1 \
     man/man1/tpm2_eventlog.1 \
@@ -452,6 +472,8 @@
     man/man1/tpm2_ecdhkeygen.1 \
     man/man1/tpm2_ecdhzgen.1 \
     man/man1/tpm2_zgen2phase.1 \
+    man/man1/tpm2_sessionconfig.1 \
+    man/man1/tpm2_getpolicydigest.1 \
     man/man1/tpm2.1
 
 if HAVE_FAPI
@@ -475,6 +497,7 @@
     man/man1/tss2_getplatformcertificates.1 \
     man/man1/tss2_gettpmblobs.1 \
     man/man1/tss2_getappdata.1 \
+    man/man1/tss2_gettpm2object.1 \
     man/man1/tss2_setappdata.1 \
     man/man1/tss2_setcertificate.1 \
     man/man1/tss2_exportkey.1 \
@@ -505,6 +528,7 @@
 	man/common/obj-attrs.md \
 	man/common/object-alg.md \
 	man/common/options.md \
+	man/common/pcrs_format.md \
 	man/common/policy-limitations.md \
 	man/common/pubkey.md \
 	man/common/returns.md \
@@ -539,6 +563,8 @@
 	    -e '/\nv attributes\/d' \
 	    -e '/\pcr bank specifiers\/r $(top_srcdir)/man/common/pcr.md' \
 	    -e '/\pcr bank specifiers\/d' \
+	    -e '/\PCR output file format specifiers\/r $(top_srcdir)/man/common/pcrs_format.md' \
+	    -e '/\PCR output file format specifiers\/d' \
 	    -e '/\pubkey options\/r $(top_srcdir)/man/common/pubkey.md' \
 	    -e '/\pubkey options\/d' \
 	    -e '/\signature format specifiers\/r $(top_srcdir)/man/common/signature.md' \
@@ -578,6 +604,7 @@
     dist/bash-completion/tpm2-tools/tss2_gettpmblobs \
 	dist/bash-completion/tpm2-tools/tss2_setcertificate \
     dist/bash-completion/tpm2-tools/tss2_getappdata \
+    dist/bash-completion/tpm2-tools/tss2_gettpm2object \
     dist/bash-completion/tpm2-tools/tss2_setappdata \
 	dist/bash-completion/tpm2-tools/tss2_sign \
 	dist/bash-completion/tpm2-tools/tss2_verifysignature \

_service:tar_scm:tpm2-tools-5.0.tar.gz/Makefile.in -> _service:tar_scm:tpm2-tools-5.4.tar.gz/Makefile.in Changed

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# Makefile.in generated by automake 1.16.1 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+# Copyright (C) 1994-2018 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -17,7 +17,7 @@
 # SPDX-License-Identifier: BSD-3-Clause
 
 # aminclude_static.am generated automatically by Autoconf
-# from AX_AM_MACROS_STATIC on Mon Nov 16 11:15:23 MST 2020
+# from AX_AM_MACROS_STATIC on Mon Dec  5 10:02:13 CST 2022
 
 
 
@@ -112,15 +112,18 @@
 @UNIT_TRUE@	test/unit/test_options$(EXEEXT) \
 @UNIT_TRUE@	test/unit/test_cc_util$(EXEEXT) \
 @UNIT_TRUE@	test/unit/test_tpm2_eventlog$(EXEEXT) \
-@UNIT_TRUE@	test/unit/test_tpm2_eventlog_yaml$(EXEEXT)
-@HAVE_FAPI_TRUE@@UNIT_TRUE@am__append_3 = $(ALL_FAPI_TESTS)
-@PERSISTENT_TRUE@@UNIT_TRUE@am__append_4 = \
-@PERSISTENT_TRUE@@UNIT_TRUE@        TPM2TOOLS_TEST_PERSISTENT=true; export TPM2TOOLS_TEST_PERSISTENT;
+@UNIT_TRUE@	test/unit/test_tpm2_eventlog_yaml$(EXEEXT) \
+@UNIT_TRUE@	test/unit/test_object$(EXEEXT)
+@HAVE_ESYS_4_0_TRUE@@UNIT_TRUE@am__append_3 = test/unit/vendor_tests.sh
+@HAVE_ESYS_4_0_TRUE@@UNIT_TRUE@am__append_4 = test/unit/vendor_tests.sh
+@HAVE_FAPI_TRUE@@UNIT_TRUE@am__append_5 = $(ALL_FAPI_TESTS)
+@PERSISTENT_TRUE@@UNIT_TRUE@am__append_6 = \
+@PERSISTENT_TRUE@@UNIT_TRUE@        TPM2TOOLS_TEST_PERSISTENT=true;
 
-@PERSISTENT_FALSE@@UNIT_TRUE@am__append_5 = \
-@PERSISTENT_FALSE@@UNIT_TRUE@        TPM2TOOLS_TEST_PERSISTENT=false; export TPM2TOOLS_TEST_PERSISTENT;
+@PERSISTENT_FALSE@@UNIT_TRUE@am__append_7 = \
+@PERSISTENT_FALSE@@UNIT_TRUE@        TPM2TOOLS_TEST_PERSISTENT=false;
 
-@HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@am__append_6 = \
+@HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@am__append_8 = \
 @HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@    man/man1/tss2_list.1 \
 @HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@    man/man1/tss2_changeauth.1 \
 @HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@    man/man1/tss2_delete.1 \
@@ -140,6 +143,7 @@
 @HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@    man/man1/tss2_getplatformcertificates.1 \
 @HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@    man/man1/tss2_gettpmblobs.1 \
 @HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@    man/man1/tss2_getappdata.1 \
+@HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@    man/man1/tss2_gettpm2object.1 \
 @HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@    man/man1/tss2_setappdata.1 \
 @HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@    man/man1/tss2_setcertificate.1 \
 @HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@    man/man1/tss2_exportkey.1 \
@@ -159,7 +163,7 @@
 @HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@    man/man1/tss2_getrandom.1 \
 @HAVE_FAPI_TRUE@@HAVE_MAN_PAGES_TRUE@    man/man1/tss2_writeauthorizenv.1
 
-@HAVE_FAPI_TRUE@am__append_7 = \
+@HAVE_FAPI_TRUE@am__append_9 = \
 @HAVE_FAPI_TRUE@	dist/bash-completion/tpm2-tools/tss2_decrypt \
 @HAVE_FAPI_TRUE@	dist/bash-completion/tpm2-tools/tss2_encrypt \
 @HAVE_FAPI_TRUE@	dist/bash-completion/tpm2-tools/tss2_list \
@@ -175,6 +179,7 @@
 @HAVE_FAPI_TRUE@    dist/bash-completion/tpm2-tools/tss2_gettpmblobs \
 @HAVE_FAPI_TRUE@	dist/bash-completion/tpm2-tools/tss2_setcertificate \
 @HAVE_FAPI_TRUE@    dist/bash-completion/tpm2-tools/tss2_getappdata \
+@HAVE_FAPI_TRUE@    dist/bash-completion/tpm2-tools/tss2_gettpm2object \
 @HAVE_FAPI_TRUE@    dist/bash-completion/tpm2-tools/tss2_setappdata \
 @HAVE_FAPI_TRUE@	dist/bash-completion/tpm2-tools/tss2_sign \
 @HAVE_FAPI_TRUE@	dist/bash-completion/tpm2-tools/tss2_verifysignature \
@@ -207,6 +212,7 @@
 	$(top_srcdir)/m4/ax_am_macros_static.m4 \
 	$(top_srcdir)/m4/ax_check_compile_flag.m4 \
 	$(top_srcdir)/m4/ax_check_enable_debug.m4 \
+	$(top_srcdir)/m4/ax_check_gnu_make.m4 \
 	$(top_srcdir)/m4/ax_check_link_flag.m4 \
 	$(top_srcdir)/m4/ax_code_coverage.m4 \
 	$(top_srcdir)/m4/ax_file_escapes.m4 \
@@ -225,6 +231,10 @@
 CONFIG_HEADER = $(top_builddir)/lib/config.h
 CONFIG_CLEAN_FILES =
 CONFIG_CLEAN_VPATH_FILES =
+@HAVE_FAPI_TRUE@am__EXEEXT_1 = tools/fapi/tss2$(EXEEXT)
+am__installdirs = "$(DESTDIR)$(bindir)" "$(DESTDIR)$(man1dir)" \
+	"$(DESTDIR)$(bashcompdir)"
+PROGRAMS = $(bin_PROGRAMS)
 LIBRARIES = $(noinst_LIBRARIES)
 ARFLAGS = cru
 AM_V_AR = $(am__v_AR_@AM_V@)
@@ -234,44 +244,39 @@
 lib_libcommon_a_AR = $(AR) $(ARFLAGS)
 lib_libcommon_a_LIBADD =
 am__dirstamp = $(am__leading_dot)dirstamp
-am__objects_1 = lib/lib_libcommon_a-files.$(OBJEXT) \
-	lib/lib_libcommon_a-log.$(OBJEXT) \
-	lib/lib_libcommon_a-object.$(OBJEXT) \
-	lib/lib_libcommon_a-pcr.$(OBJEXT) \
-	lib/lib_libcommon_a-tool_rc.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_alg_util.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_attr_util.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_auth_util.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_capability.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_cc_util.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_convert.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_ctx_mgmt.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_errata.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_eventlog.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_eventlog_yaml.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_hash.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_hierarchy.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_identity_util.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_kdfa.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_kdfe.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_openssl.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_options.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_policy.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_session.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_tool_output.$(OBJEXT) \
-	lib/lib_libcommon_a-tpm2_util.$(OBJEXT)
+am__objects_1 = lib/libcommon_a-files.$(OBJEXT) \
+	lib/libcommon_a-log.$(OBJEXT) lib/libcommon_a-object.$(OBJEXT) \
+	lib/libcommon_a-pcr.$(OBJEXT) \
+	lib/libcommon_a-tool_rc.$(OBJEXT) \
+	lib/libcommon_a-tpm2.$(OBJEXT) \
+	lib/libcommon_a-tpm2_alg_util.$(OBJEXT) \
+	lib/libcommon_a-tpm2_attr_util.$(OBJEXT) \
+	lib/libcommon_a-tpm2_auth_util.$(OBJEXT) \
+	lib/libcommon_a-tpm2_capability.$(OBJEXT) \
+	lib/libcommon_a-tpm2_cc_util.$(OBJEXT) \
+	lib/libcommon_a-tpm2_convert.$(OBJEXT) \
+	lib/libcommon_a-tpm2_ctx_mgmt.$(OBJEXT) \
+	lib/libcommon_a-tpm2_errata.$(OBJEXT) \
+	lib/libcommon_a-tpm2_eventlog.$(OBJEXT) \
+	lib/libcommon_a-tpm2_eventlog_yaml.$(OBJEXT) \
+	lib/libcommon_a-tpm2_hash.$(OBJEXT) \
+	lib/libcommon_a-tpm2_hierarchy.$(OBJEXT) \
+	lib/libcommon_a-tpm2_identity_util.$(OBJEXT) \
+	lib/libcommon_a-tpm2_kdfa.$(OBJEXT) \
+	lib/libcommon_a-tpm2_kdfe.$(OBJEXT) \
+	lib/libcommon_a-tpm2_openssl.$(OBJEXT) \
+	lib/libcommon_a-tpm2_options.$(OBJEXT) \
+	lib/libcommon_a-tpm2_policy.$(OBJEXT) \
+	lib/libcommon_a-tpm2_session.$(OBJEXT) \
+	lib/libcommon_a-tpm2_tool_output.$(OBJEXT) \
+	lib/libcommon_a-tpm2_util.$(OBJEXT)
 am__objects_2 =
 am__objects_3 = $(am__objects_1) $(am__objects_2)
 am_lib_libcommon_a_OBJECTS = $(am__objects_3)
 lib_libcommon_a_OBJECTS = $(am_lib_libcommon_a_OBJECTS)
-@HAVE_FAPI_TRUE@am__EXEEXT_1 = tools/fapi/tss2$(EXEEXT)
-am__installdirs = "$(DESTDIR)$(bindir)" "$(DESTDIR)$(man1dir)" \
-	"$(DESTDIR)$(bashcompdir)"
-PROGRAMS = $(bin_PROGRAMS)
 test_unit_test_cc_util_SOURCES = test/unit/test_cc_util.c
 test_unit_test_cc_util_OBJECTS =  \
-	test/unit/test_unit_test_cc_util-test_cc_util.$(OBJEXT)
+	test/unit/test_cc_util-test_cc_util.$(OBJEXT)
 am__DEPENDENCIES_1 =
 am__DEPENDENCIES_2 = $(LIB_COMMON) $(am__DEPENDENCIES_1) \
 	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1) \
@@ -289,16 +294,25 @@
 	$(LDFLAGS) -o $@
 test_unit_test_files_SOURCES = test/unit/test_files.c
 test_unit_test_files_OBJECTS =  \
-	test/unit/test_unit_test_files-test_files.$(OBJEXT)
+	test/unit/test_files-test_files.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_files_DEPENDENCIES = $(am__DEPENDENCIES_1) \
 @UNIT_TRUE@	$(am__DEPENDENCIES_2)
 test_unit_test_files_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
 	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
 	$(test_unit_test_files_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
 	$(LDFLAGS) -o $@
+test_unit_test_object_SOURCES = test/unit/test_object.c
+test_unit_test_object_OBJECTS =  \
+	test/unit/test_object-test_object.$(OBJEXT)
+@UNIT_TRUE@test_unit_test_object_DEPENDENCIES = $(am__DEPENDENCIES_1) \
+@UNIT_TRUE@	$(am__DEPENDENCIES_2)
+test_unit_test_object_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(test_unit_test_object_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
+	$(LDFLAGS) -o $@
 test_unit_test_options_SOURCES = test/unit/test_options.c
 test_unit_test_options_OBJECTS =  \
-	test/unit/test_unit_test_options-test_options.$(OBJEXT)
+	test/unit/test_options-test_options.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_options_DEPENDENCIES =  \
 @UNIT_TRUE@	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_2)
 test_unit_test_options_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
@@ -306,8 +320,7 @@
 	$(test_unit_test_options_CFLAGS) $(CFLAGS) \
 	$(test_unit_test_options_LDFLAGS) $(LDFLAGS) -o $@
 test_unit_test_pcr_SOURCES = test/unit/test_pcr.c
-test_unit_test_pcr_OBJECTS =  \
-	test/unit/test_unit_test_pcr-test_pcr.$(OBJEXT)
+test_unit_test_pcr_OBJECTS = test/unit/test_pcr-test_pcr.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_pcr_DEPENDENCIES = $(am__DEPENDENCIES_1) \
 @UNIT_TRUE@	$(am__DEPENDENCIES_2)
 test_unit_test_pcr_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
@@ -315,7 +328,8 @@
 	$(test_unit_test_pcr_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
 	$(LDFLAGS) -o $@
 test_unit_test_string_bytes_SOURCES = test/unit/test_string_bytes.c
-test_unit_test_string_bytes_OBJECTS = test/unit/test_unit_test_string_bytes-test_string_bytes.$(OBJEXT)
+test_unit_test_string_bytes_OBJECTS =  \
+	test/unit/test_string_bytes-test_string_bytes.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_string_bytes_DEPENDENCIES =  \
 @UNIT_TRUE@	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_2)
 test_unit_test_string_bytes_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
@@ -323,7 +337,8 @@
 	$(test_unit_test_string_bytes_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
 	$(LDFLAGS) -o $@
 test_unit_test_tpm2_alg_util_SOURCES = test/unit/test_tpm2_alg_util.c
-test_unit_test_tpm2_alg_util_OBJECTS = test/unit/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.$(OBJEXT)
+test_unit_test_tpm2_alg_util_OBJECTS =  \
+	test/unit/test_tpm2_alg_util-test_tpm2_alg_util.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_tpm2_alg_util_DEPENDENCIES =  \
 @UNIT_TRUE@	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_2)
 test_unit_test_tpm2_alg_util_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
@@ -332,7 +347,8 @@
 	$(LDFLAGS) -o $@
 test_unit_test_tpm2_attr_util_SOURCES =  \
 	test/unit/test_tpm2_attr_util.c
-test_unit_test_tpm2_attr_util_OBJECTS = test/unit/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.$(OBJEXT)
+test_unit_test_tpm2_attr_util_OBJECTS =  \
+	test/unit/test_tpm2_attr_util-test_tpm2_attr_util.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_tpm2_attr_util_DEPENDENCIES =  \
 @UNIT_TRUE@	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_2)
 test_unit_test_tpm2_attr_util_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
@@ -341,7 +357,8 @@
 	$(AM_LDFLAGS) $(LDFLAGS) -o $@
 test_unit_test_tpm2_auth_util_SOURCES =  \
 	test/unit/test_tpm2_auth_util.c
-test_unit_test_tpm2_auth_util_OBJECTS = test/unit/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.$(OBJEXT)
+test_unit_test_tpm2_auth_util_OBJECTS =  \
+	test/unit/test_tpm2_auth_util-test_tpm2_auth_util.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_tpm2_auth_util_DEPENDENCIES =  \
 @UNIT_TRUE@	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_2)
 test_unit_test_tpm2_auth_util_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
@@ -349,7 +366,8 @@
 	$(test_unit_test_tpm2_auth_util_CFLAGS) $(CFLAGS) \
 	$(test_unit_test_tpm2_auth_util_LDFLAGS) $(LDFLAGS) -o $@
 test_unit_test_tpm2_errata_SOURCES = test/unit/test_tpm2_errata.c
-test_unit_test_tpm2_errata_OBJECTS = test/unit/test_unit_test_tpm2_errata-test_tpm2_errata.$(OBJEXT)
+test_unit_test_tpm2_errata_OBJECTS =  \
+	test/unit/test_tpm2_errata-test_tpm2_errata.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_tpm2_errata_DEPENDENCIES =  \
 @UNIT_TRUE@	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_2)
 test_unit_test_tpm2_errata_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
@@ -357,7 +375,8 @@
 	$(test_unit_test_tpm2_errata_CFLAGS) $(CFLAGS) \
 	$(test_unit_test_tpm2_errata_LDFLAGS) $(LDFLAGS) -o $@
 test_unit_test_tpm2_eventlog_SOURCES = test/unit/test_tpm2_eventlog.c
-test_unit_test_tpm2_eventlog_OBJECTS = test/unit/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.$(OBJEXT)
+test_unit_test_tpm2_eventlog_OBJECTS =  \
+	test/unit/test_tpm2_eventlog-test_tpm2_eventlog.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_tpm2_eventlog_DEPENDENCIES =  \
 @UNIT_TRUE@	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_2)
 test_unit_test_tpm2_eventlog_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
@@ -366,7 +385,7 @@
 	$(LDFLAGS) -o $@
 test_unit_test_tpm2_eventlog_yaml_SOURCES =  \
 	test/unit/test_tpm2_eventlog_yaml.c
-test_unit_test_tpm2_eventlog_yaml_OBJECTS = test/unit/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.$(OBJEXT)
+test_unit_test_tpm2_eventlog_yaml_OBJECTS = test/unit/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_tpm2_eventlog_yaml_DEPENDENCIES =  \
 @UNIT_TRUE@	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_2)
 test_unit_test_tpm2_eventlog_yaml_LINK = $(LIBTOOL) $(AM_V_lt) \
@@ -374,7 +393,8 @@
 	$(CCLD) $(test_unit_test_tpm2_eventlog_yaml_CFLAGS) $(CFLAGS) \
 	$(AM_LDFLAGS) $(LDFLAGS) -o $@
 test_unit_test_tpm2_header_SOURCES = test/unit/test_tpm2_header.c
-test_unit_test_tpm2_header_OBJECTS = test/unit/test_unit_test_tpm2_header-test_tpm2_header.$(OBJEXT)
+test_unit_test_tpm2_header_OBJECTS =  \
+	test/unit/test_tpm2_header-test_tpm2_header.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_tpm2_header_DEPENDENCIES =  \
 @UNIT_TRUE@	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_2)
 test_unit_test_tpm2_header_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
@@ -382,7 +402,8 @@
 	$(test_unit_test_tpm2_header_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
 	$(LDFLAGS) -o $@
 test_unit_test_tpm2_policy_SOURCES = test/unit/test_tpm2_policy.c
-test_unit_test_tpm2_policy_OBJECTS = test/unit/test_unit_test_tpm2_policy-test_tpm2_policy.$(OBJEXT)
+test_unit_test_tpm2_policy_OBJECTS =  \
+	test/unit/test_tpm2_policy-test_tpm2_policy.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_tpm2_policy_DEPENDENCIES =  \
 @UNIT_TRUE@	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_2)
 test_unit_test_tpm2_policy_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
@@ -390,7 +411,8 @@
 	$(test_unit_test_tpm2_policy_CFLAGS) $(CFLAGS) \
 	$(test_unit_test_tpm2_policy_LDFLAGS) $(LDFLAGS) -o $@
 test_unit_test_tpm2_session_SOURCES = test/unit/test_tpm2_session.c
-test_unit_test_tpm2_session_OBJECTS = test/unit/test_unit_test_tpm2_session-test_tpm2_session.$(OBJEXT)
+test_unit_test_tpm2_session_OBJECTS =  \
+	test/unit/test_tpm2_session-test_tpm2_session.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_tpm2_session_DEPENDENCIES =  \
 @UNIT_TRUE@	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_2)
 test_unit_test_tpm2_session_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
@@ -399,52 +421,52 @@
 	$(test_unit_test_tpm2_session_LDFLAGS) $(LDFLAGS) -o $@
 test_unit_test_tpm2_util_SOURCES = test/unit/test_tpm2_util.c
 test_unit_test_tpm2_util_OBJECTS =  \
-	test/unit/test_unit_test_tpm2_util-test_tpm2_util.$(OBJEXT)
+	test/unit/test_tpm2_util-test_tpm2_util.$(OBJEXT)
 @UNIT_TRUE@test_unit_test_tpm2_util_DEPENDENCIES =  \
 @UNIT_TRUE@	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_2)
 test_unit_test_tpm2_util_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
 	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
 	$(test_unit_test_tpm2_util_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
 	$(LDFLAGS) -o $@
-am__objects_4 = tools/fapi/tools_fapi_tss2-tss2_decrypt.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_encrypt.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_list.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_changeauth.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_delete.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_import.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_getinfo.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_createkey.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_createseal.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_exportkey.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_getcertificate.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_getplatformcertificates.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_gettpmblobs.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_getappdata.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_setappdata.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_setcertificate.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_sign.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_verifysignature.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_verifyquote.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_createnv.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_nvextend.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_nvincrement.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_nvread.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_nvsetbits.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_nvwrite.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_getdescription.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_setdescription.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_pcrextend.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_quote.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_pcrread.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_authorizepolicy.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_exportpolicy.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_import.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_provision.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_getrandom.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_unseal.$(OBJEXT) \
-	tools/fapi/tools_fapi_tss2-tss2_writeauthorizenv.$(OBJEXT)
-am_tools_fapi_tss2_OBJECTS =  \
-	tools/fapi/tools_fapi_tss2-tss2_template.$(OBJEXT) \
+am__objects_4 = tools/fapi/tss2-tss2_decrypt.$(OBJEXT) \
+	tools/fapi/tss2-tss2_encrypt.$(OBJEXT) \
+	tools/fapi/tss2-tss2_list.$(OBJEXT) \
+	tools/fapi/tss2-tss2_changeauth.$(OBJEXT) \
+	tools/fapi/tss2-tss2_delete.$(OBJEXT) \
+	tools/fapi/tss2-tss2_import.$(OBJEXT) \
+	tools/fapi/tss2-tss2_getinfo.$(OBJEXT) \
+	tools/fapi/tss2-tss2_createkey.$(OBJEXT) \
+	tools/fapi/tss2-tss2_createseal.$(OBJEXT) \
+	tools/fapi/tss2-tss2_exportkey.$(OBJEXT) \
+	tools/fapi/tss2-tss2_getcertificate.$(OBJEXT) \
+	tools/fapi/tss2-tss2_getplatformcertificates.$(OBJEXT) \
+	tools/fapi/tss2-tss2_gettpmblobs.$(OBJEXT) \
+	tools/fapi/tss2-tss2_getappdata.$(OBJEXT) \
+	tools/fapi/tss2-tss2_gettpm2object.$(OBJEXT) \
+	tools/fapi/tss2-tss2_setappdata.$(OBJEXT) \
+	tools/fapi/tss2-tss2_setcertificate.$(OBJEXT) \
+	tools/fapi/tss2-tss2_sign.$(OBJEXT) \
+	tools/fapi/tss2-tss2_verifysignature.$(OBJEXT) \
+	tools/fapi/tss2-tss2_verifyquote.$(OBJEXT) \
+	tools/fapi/tss2-tss2_createnv.$(OBJEXT) \
+	tools/fapi/tss2-tss2_nvextend.$(OBJEXT) \
+	tools/fapi/tss2-tss2_nvincrement.$(OBJEXT) \
+	tools/fapi/tss2-tss2_nvread.$(OBJEXT) \
+	tools/fapi/tss2-tss2_nvsetbits.$(OBJEXT) \
+	tools/fapi/tss2-tss2_nvwrite.$(OBJEXT) \
+	tools/fapi/tss2-tss2_getdescription.$(OBJEXT) \
+	tools/fapi/tss2-tss2_setdescription.$(OBJEXT) \
+	tools/fapi/tss2-tss2_pcrextend.$(OBJEXT) \
+	tools/fapi/tss2-tss2_quote.$(OBJEXT) \
+	tools/fapi/tss2-tss2_pcrread.$(OBJEXT) \
+	tools/fapi/tss2-tss2_authorizepolicy.$(OBJEXT) \
+	tools/fapi/tss2-tss2_exportpolicy.$(OBJEXT) \
+	tools/fapi/tss2-tss2_import.$(OBJEXT) \
+	tools/fapi/tss2-tss2_provision.$(OBJEXT) \
+	tools/fapi/tss2-tss2_getrandom.$(OBJEXT) \
+	tools/fapi/tss2-tss2_unseal.$(OBJEXT) \
+	tools/fapi/tss2-tss2_writeauthorizenv.$(OBJEXT)
+am_tools_fapi_tss2_OBJECTS = tools/fapi/tss2-tss2_template.$(OBJEXT) \
 	$(am__objects_4)
 tools_fapi_tss2_OBJECTS = $(am_tools_fapi_tss2_OBJECTS)
 tools_fapi_tss2_LDADD = $(LDADD)
@@ -456,106 +478,108 @@
 	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
 	$(tools_fapi_tss2_CFLAGS) $(CFLAGS) $(tools_fapi_tss2_LDFLAGS) \
 	$(LDFLAGS) -o $@
-am__objects_5 =  \
-	tools/misc/tools_tpm2-tpm2_certifyX509certutil.$(OBJEXT) \
-	tools/misc/tools_tpm2-tpm2_checkquote.$(OBJEXT) \
-	tools/misc/tools_tpm2-tpm2_eventlog.$(OBJEXT) \
-	tools/misc/tools_tpm2-tpm2_print.$(OBJEXT) \
-	tools/misc/tools_tpm2-tpm2_rc_decode.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_activatecredential.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_certify.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_changeauth.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_changeeps.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_changepps.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_clear.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_clearcontrol.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_clockrateadjust.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_create.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_createak.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_createek.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_createpolicy.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_setprimarypolicy.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_createprimary.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_dictionarylockout.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_duplicate.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_getcap.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_gettestresult.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_encryptdecrypt.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_evictcontrol.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_flushcontext.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_getekcertificate.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_getrandom.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_gettime.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_hash.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_hierarchycontrol.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_hmac.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_import.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_incrementalselftest.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_load.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_loadexternal.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_makecredential.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_nvdefine.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_nvextend.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_nvincrement.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_nvreadpublic.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_nvread.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_nvreadlock.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_nvundefine.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_nvwrite.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_nvwritelock.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_nvsetbits.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_pcrallocate.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_pcrevent.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_pcrextend.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_pcrread.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_pcrreset.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policypcr.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policyauthorize.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policyauthorizenv.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policynv.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policycountertimer.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policyor.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policynamehash.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policytemplate.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policycphash.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policypassword.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policysigned.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policyticket.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policyauthvalue.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policysecret.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policyrestart.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policycommandcode.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policynvwritten.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policyduplicationselect.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_policylocality.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_quote.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_readclock.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_readpublic.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_rsadecrypt.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_rsaencrypt.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_send.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_selftest.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_setclock.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_shutdown.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_sign.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_certifycreation.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_nvcertify.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_startauthsession.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_startup.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_stirrandom.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_testparms.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_unseal.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_verifysignature.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_setcommandauditstatus.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_getcommandauditdigest.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_getsessionauditdigest.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_geteccparameters.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_ecephemeral.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_commit.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_ecdhkeygen.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_ecdhzgen.$(OBJEXT) \
-	tools/tools_tpm2-tpm2_zgen2phase.$(OBJEXT)
-am_tools_tpm2_OBJECTS = tools/tools_tpm2-tpm2_tool.$(OBJEXT) \
+am__objects_5 = tools/misc/tpm2-tpm2_certifyX509certutil.$(OBJEXT) \
+	tools/misc/tpm2-tpm2_checkquote.$(OBJEXT) \
+	tools/misc/tpm2-tpm2_encodeobject.$(OBJEXT) \
+	tools/misc/tpm2-tpm2_eventlog.$(OBJEXT) \
+	tools/misc/tpm2-tpm2_print.$(OBJEXT) \
+	tools/misc/tpm2-tpm2_rc_decode.$(OBJEXT) \
+	tools/tpm2-tpm2_activatecredential.$(OBJEXT) \
+	tools/tpm2-tpm2_certify.$(OBJEXT) \
+	tools/tpm2-tpm2_changeauth.$(OBJEXT) \
+	tools/tpm2-tpm2_changeeps.$(OBJEXT) \
+	tools/tpm2-tpm2_changepps.$(OBJEXT) \
+	tools/tpm2-tpm2_clear.$(OBJEXT) \
+	tools/tpm2-tpm2_clearcontrol.$(OBJEXT) \
+	tools/tpm2-tpm2_clockrateadjust.$(OBJEXT) \
+	tools/tpm2-tpm2_create.$(OBJEXT) \
+	tools/tpm2-tpm2_createak.$(OBJEXT) \
+	tools/tpm2-tpm2_createek.$(OBJEXT) \
+	tools/tpm2-tpm2_createpolicy.$(OBJEXT) \
+	tools/tpm2-tpm2_setprimarypolicy.$(OBJEXT) \
+	tools/tpm2-tpm2_createprimary.$(OBJEXT) \
+	tools/tpm2-tpm2_dictionarylockout.$(OBJEXT) \
+	tools/tpm2-tpm2_duplicate.$(OBJEXT) \
+	tools/tpm2-tpm2_getcap.$(OBJEXT) \
+	tools/tpm2-tpm2_gettestresult.$(OBJEXT) \
+	tools/tpm2-tpm2_encryptdecrypt.$(OBJEXT) \
+	tools/tpm2-tpm2_evictcontrol.$(OBJEXT) \
+	tools/tpm2-tpm2_flushcontext.$(OBJEXT) \
+	tools/tpm2-tpm2_getekcertificate.$(OBJEXT) \
+	tools/tpm2-tpm2_getrandom.$(OBJEXT) \
+	tools/tpm2-tpm2_gettime.$(OBJEXT) \
+	tools/tpm2-tpm2_hash.$(OBJEXT) \
+	tools/tpm2-tpm2_hierarchycontrol.$(OBJEXT) \
+	tools/tpm2-tpm2_hmac.$(OBJEXT) \
+	tools/tpm2-tpm2_import.$(OBJEXT) \
+	tools/tpm2-tpm2_incrementalselftest.$(OBJEXT) \
+	tools/tpm2-tpm2_load.$(OBJEXT) \
+	tools/tpm2-tpm2_loadexternal.$(OBJEXT) \
+	tools/tpm2-tpm2_makecredential.$(OBJEXT) \
+	tools/tpm2-tpm2_nvdefine.$(OBJEXT) \
+	tools/tpm2-tpm2_nvextend.$(OBJEXT) \
+	tools/tpm2-tpm2_nvincrement.$(OBJEXT) \
+	tools/tpm2-tpm2_nvreadpublic.$(OBJEXT) \
+	tools/tpm2-tpm2_nvread.$(OBJEXT) \
+	tools/tpm2-tpm2_nvreadlock.$(OBJEXT) \
+	tools/tpm2-tpm2_nvundefine.$(OBJEXT) \
+	tools/tpm2-tpm2_nvwrite.$(OBJEXT) \
+	tools/tpm2-tpm2_nvwritelock.$(OBJEXT) \
+	tools/tpm2-tpm2_nvsetbits.$(OBJEXT) \
+	tools/tpm2-tpm2_pcrallocate.$(OBJEXT) \
+	tools/tpm2-tpm2_pcrevent.$(OBJEXT) \
+	tools/tpm2-tpm2_pcrextend.$(OBJEXT) \
+	tools/tpm2-tpm2_pcrread.$(OBJEXT) \
+	tools/tpm2-tpm2_pcrreset.$(OBJEXT) \
+	tools/tpm2-tpm2_policypcr.$(OBJEXT) \
+	tools/tpm2-tpm2_policyauthorize.$(OBJEXT) \
+	tools/tpm2-tpm2_policyauthorizenv.$(OBJEXT) \
+	tools/tpm2-tpm2_policynv.$(OBJEXT) \
+	tools/tpm2-tpm2_policycountertimer.$(OBJEXT) \
+	tools/tpm2-tpm2_policyor.$(OBJEXT) \
+	tools/tpm2-tpm2_policynamehash.$(OBJEXT) \
+	tools/tpm2-tpm2_policytemplate.$(OBJEXT) \
+	tools/tpm2-tpm2_policycphash.$(OBJEXT) \
+	tools/tpm2-tpm2_policypassword.$(OBJEXT) \
+	tools/tpm2-tpm2_policysigned.$(OBJEXT) \
+	tools/tpm2-tpm2_policyticket.$(OBJEXT) \
+	tools/tpm2-tpm2_policyauthvalue.$(OBJEXT) \
+	tools/tpm2-tpm2_policysecret.$(OBJEXT) \
+	tools/tpm2-tpm2_policyrestart.$(OBJEXT) \
+	tools/tpm2-tpm2_policycommandcode.$(OBJEXT) \
+	tools/tpm2-tpm2_policynvwritten.$(OBJEXT) \
+	tools/tpm2-tpm2_policyduplicationselect.$(OBJEXT) \
+	tools/tpm2-tpm2_policylocality.$(OBJEXT) \
+	tools/tpm2-tpm2_quote.$(OBJEXT) \
+	tools/tpm2-tpm2_readclock.$(OBJEXT) \
+	tools/tpm2-tpm2_readpublic.$(OBJEXT) \
+	tools/tpm2-tpm2_rsadecrypt.$(OBJEXT) \
+	tools/tpm2-tpm2_rsaencrypt.$(OBJEXT) \
+	tools/tpm2-tpm2_send.$(OBJEXT) \
+	tools/tpm2-tpm2_selftest.$(OBJEXT) \
+	tools/tpm2-tpm2_setclock.$(OBJEXT) \
+	tools/tpm2-tpm2_shutdown.$(OBJEXT) \
+	tools/tpm2-tpm2_sign.$(OBJEXT) \
+	tools/tpm2-tpm2_certifycreation.$(OBJEXT) \
+	tools/tpm2-tpm2_nvcertify.$(OBJEXT) \
+	tools/tpm2-tpm2_startauthsession.$(OBJEXT) \
+	tools/tpm2-tpm2_startup.$(OBJEXT) \
+	tools/tpm2-tpm2_stirrandom.$(OBJEXT) \
+	tools/tpm2-tpm2_testparms.$(OBJEXT) \
+	tools/tpm2-tpm2_unseal.$(OBJEXT) \
+	tools/tpm2-tpm2_verifysignature.$(OBJEXT) \
+	tools/tpm2-tpm2_setcommandauditstatus.$(OBJEXT) \
+	tools/tpm2-tpm2_getcommandauditdigest.$(OBJEXT) \
+	tools/tpm2-tpm2_getsessionauditdigest.$(OBJEXT) \
+	tools/tpm2-tpm2_geteccparameters.$(OBJEXT) \
+	tools/tpm2-tpm2_ecephemeral.$(OBJEXT) \
+	tools/tpm2-tpm2_commit.$(OBJEXT) \
+	tools/tpm2-tpm2_ecdhkeygen.$(OBJEXT) \
+	tools/tpm2-tpm2_ecdhzgen.$(OBJEXT) \
+	tools/tpm2-tpm2_zgen2phase.$(OBJEXT) \
+	tools/tpm2-tpm2_sessionconfig.$(OBJEXT) \
+	tools/tpm2-tpm2_getpolicydigest.$(OBJEXT)
+am_tools_tpm2_OBJECTS = tools/tpm2-tpm2_tool.$(OBJEXT) \
 	$(am__objects_5)
 tools_tpm2_OBJECTS = $(am_tools_tpm2_OBJECTS)
 tools_tpm2_DEPENDENCIES = $(am__DEPENDENCIES_2) $(am__DEPENDENCIES_1)
@@ -576,7 +600,190 @@
 am__v_at_1 = 
 DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)/lib
 depcomp = $(SHELL) $(top_srcdir)/depcomp
-am__depfiles_maybe = depfiles
+am__maybe_remake_depfiles = depfiles
+am__depfiles_remade = lib/$(DEPDIR)/libcommon_a-files.Po \
+	lib/$(DEPDIR)/libcommon_a-log.Po \
+	lib/$(DEPDIR)/libcommon_a-object.Po \
+	lib/$(DEPDIR)/libcommon_a-pcr.Po \
+	lib/$(DEPDIR)/libcommon_a-tool_rc.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_alg_util.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_attr_util.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_auth_util.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_capability.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_cc_util.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_convert.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_ctx_mgmt.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_errata.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_eventlog.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_eventlog_yaml.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_hash.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_hierarchy.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_identity_util.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_kdfa.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_kdfe.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_openssl.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_options.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_policy.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_session.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_tool_output.Po \
+	lib/$(DEPDIR)/libcommon_a-tpm2_util.Po \
+	test/unit/$(DEPDIR)/test_cc_util-test_cc_util.Po \
+	test/unit/$(DEPDIR)/test_files-test_files.Po \
+	test/unit/$(DEPDIR)/test_object-test_object.Po \
+	test/unit/$(DEPDIR)/test_options-test_options.Po \
+	test/unit/$(DEPDIR)/test_pcr-test_pcr.Po \
+	test/unit/$(DEPDIR)/test_string_bytes-test_string_bytes.Po \
+	test/unit/$(DEPDIR)/test_tpm2_alg_util-test_tpm2_alg_util.Po \
+	test/unit/$(DEPDIR)/test_tpm2_attr_util-test_tpm2_attr_util.Po \
+	test/unit/$(DEPDIR)/test_tpm2_auth_util-test_tpm2_auth_util.Po \
+	test/unit/$(DEPDIR)/test_tpm2_errata-test_tpm2_errata.Po \
+	test/unit/$(DEPDIR)/test_tpm2_eventlog-test_tpm2_eventlog.Po \
+	test/unit/$(DEPDIR)/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Po \
+	test/unit/$(DEPDIR)/test_tpm2_header-test_tpm2_header.Po \
+	test/unit/$(DEPDIR)/test_tpm2_policy-test_tpm2_policy.Po \
+	test/unit/$(DEPDIR)/test_tpm2_session-test_tpm2_session.Po \
+	test/unit/$(DEPDIR)/test_tpm2_util-test_tpm2_util.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_activatecredential.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_certify.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_certifycreation.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_changeauth.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_changeeps.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_changepps.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_clear.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_clearcontrol.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_clockrateadjust.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_commit.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_create.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_createak.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_createek.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_createpolicy.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_createprimary.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_dictionarylockout.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_duplicate.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_ecdhkeygen.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_ecdhzgen.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_ecephemeral.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_encryptdecrypt.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_evictcontrol.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_flushcontext.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_getcap.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_getcommandauditdigest.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_geteccparameters.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_getekcertificate.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_getpolicydigest.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_getrandom.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_getsessionauditdigest.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_gettestresult.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_gettime.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_hash.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_hierarchycontrol.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_hmac.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_import.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_incrementalselftest.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_load.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_loadexternal.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_makecredential.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_nvcertify.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_nvdefine.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_nvextend.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_nvincrement.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_nvread.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_nvreadlock.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_nvreadpublic.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_nvsetbits.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_nvundefine.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_nvwrite.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_nvwritelock.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_pcrallocate.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_pcrevent.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_pcrextend.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_pcrread.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_pcrreset.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policyauthorize.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policyauthorizenv.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policyauthvalue.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policycommandcode.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policycountertimer.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policycphash.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policyduplicationselect.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policylocality.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policynamehash.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policynv.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policynvwritten.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policyor.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policypassword.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policypcr.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policyrestart.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policysecret.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policysigned.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policytemplate.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_policyticket.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_quote.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_readclock.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_readpublic.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_rsadecrypt.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_rsaencrypt.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_selftest.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_send.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_sessionconfig.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_setclock.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_setcommandauditstatus.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_setprimarypolicy.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_shutdown.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_sign.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_startauthsession.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_startup.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_stirrandom.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_testparms.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_tool.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_unseal.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_verifysignature.Po \
+	tools/$(DEPDIR)/tpm2-tpm2_zgen2phase.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_authorizepolicy.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_changeauth.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_createkey.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_createnv.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_createseal.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_decrypt.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_delete.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_encrypt.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_exportkey.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_exportpolicy.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_getappdata.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_getcertificate.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_getdescription.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_getinfo.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_getplatformcertificates.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_getrandom.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_gettpm2object.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_gettpmblobs.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_import.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_list.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_nvextend.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_nvincrement.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_nvread.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_nvsetbits.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_nvwrite.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_pcrextend.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_pcrread.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_provision.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_quote.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_setappdata.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_setcertificate.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_setdescription.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_sign.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_template.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_unseal.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_verifyquote.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_verifysignature.Po \
+	tools/fapi/$(DEPDIR)/tss2-tss2_writeauthorizenv.Po \
+	tools/misc/$(DEPDIR)/tpm2-tpm2_certifyX509certutil.Po \
+	tools/misc/$(DEPDIR)/tpm2-tpm2_checkquote.Po \
+	tools/misc/$(DEPDIR)/tpm2-tpm2_encodeobject.Po \
+	tools/misc/$(DEPDIR)/tpm2-tpm2_eventlog.Po \
+	tools/misc/$(DEPDIR)/tpm2-tpm2_print.Po \
+	tools/misc/$(DEPDIR)/tpm2-tpm2_rc_decode.Po
 am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
@@ -597,9 +804,10 @@
 am__v_CCLD_0 = @echo "  CCLD    " $@;
 am__v_CCLD_1 = 
 SOURCES = $(lib_libcommon_a_SOURCES) test/unit/test_cc_util.c \
-	test/unit/test_files.c test/unit/test_options.c \
-	test/unit/test_pcr.c test/unit/test_string_bytes.c \
-	test/unit/test_tpm2_alg_util.c test/unit/test_tpm2_attr_util.c \
+	test/unit/test_files.c test/unit/test_object.c \
+	test/unit/test_options.c test/unit/test_pcr.c \
+	test/unit/test_string_bytes.c test/unit/test_tpm2_alg_util.c \
+	test/unit/test_tpm2_attr_util.c \
 	test/unit/test_tpm2_auth_util.c test/unit/test_tpm2_errata.c \
 	test/unit/test_tpm2_eventlog.c \
 	test/unit/test_tpm2_eventlog_yaml.c \
@@ -607,9 +815,10 @@
 	test/unit/test_tpm2_session.c test/unit/test_tpm2_util.c \
 	$(tools_fapi_tss2_SOURCES) $(tools_tpm2_SOURCES)
 DIST_SOURCES = $(lib_libcommon_a_SOURCES) test/unit/test_cc_util.c \
-	test/unit/test_files.c test/unit/test_options.c \
-	test/unit/test_pcr.c test/unit/test_string_bytes.c \
-	test/unit/test_tpm2_alg_util.c test/unit/test_tpm2_attr_util.c \
+	test/unit/test_files.c test/unit/test_object.c \
+	test/unit/test_options.c test/unit/test_pcr.c \
+	test/unit/test_string_bytes.c test/unit/test_tpm2_alg_util.c \
+	test/unit/test_tpm2_attr_util.c \
 	test/unit/test_tpm2_auth_util.c test/unit/test_tpm2_errata.c \
 	test/unit/test_tpm2_eventlog.c \
 	test/unit/test_tpm2_eventlog_yaml.c \
@@ -668,6 +877,7 @@
 	dist/bash-completion/tpm2-tools/tss2_gettpmblobs \
 	dist/bash-completion/tpm2-tools/tss2_setcertificate \
 	dist/bash-completion/tpm2-tools/tss2_getappdata \
+	dist/bash-completion/tpm2-tools/tss2_gettpm2object \
 	dist/bash-completion/tpm2-tools/tss2_setappdata \
 	dist/bash-completion/tpm2-tools/tss2_sign \
 	dist/bash-completion/tpm2-tools/tss2_verifysignature \
@@ -925,7 +1135,6 @@
 CODE_COVERAGE_CPPFLAGS = @CODE_COVERAGE_CPPFLAGS@
 CODE_COVERAGE_CXXFLAGS = @CODE_COVERAGE_CXXFLAGS@
 CODE_COVERAGE_ENABLED = @CODE_COVERAGE_ENABLED@
-CODE_COVERAGE_LDFLAGS = @CODE_COVERAGE_LDFLAGS@
 CODE_COVERAGE_LIBS = @CODE_COVERAGE_LIBS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
@@ -942,6 +1151,8 @@
 ECHO_C = @ECHO_C@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
+EFIVAR_CFLAGS = @EFIVAR_CFLAGS@
+EFIVAR_LIBS = @EFIVAR_LIBS@
 EGREP = @EGREP@
 EXEEXT = @EXEEXT@
 EXPECT = @EXPECT@
@@ -951,6 +1162,7 @@
 GCOV = @GCOV@
 GENHTML = @GENHTML@
 GREP = @GREP@
+HAS_TPM2_SIM = @HAS_TPM2_SIM@
 INSTALL = @INSTALL@
 INSTALL_DATA = @INSTALL_DATA@
 INSTALL_PROGRAM = @INSTALL_PROGRAM@
@@ -992,6 +1204,10 @@
 PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
 PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
 PYTHON = @PYTHON@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
 RANLIB = @RANLIB@
 SED = @SED@
 SET_MAKE = @SET_MAKE@
@@ -999,10 +1215,14 @@
 SHELL = @SHELL@
 SS = @SS@
 STRIP = @STRIP@
+TPM2_ABRMD = @TPM2_ABRMD@
+TPM2_SIM = @TPM2_SIM@
 TSS2_ESYS_2_3_CFLAGS = @TSS2_ESYS_2_3_CFLAGS@
 TSS2_ESYS_2_3_LIBS = @TSS2_ESYS_2_3_LIBS@
 TSS2_ESYS_3_0_CFLAGS = @TSS2_ESYS_3_0_CFLAGS@
 TSS2_ESYS_3_0_LIBS = @TSS2_ESYS_3_0_LIBS@
+TSS2_ESYS_4_0_CFLAGS = @TSS2_ESYS_4_0_CFLAGS@
+TSS2_ESYS_4_0_LIBS = @TSS2_ESYS_4_0_LIBS@
 TSS2_ESYS_CFLAGS = @TSS2_ESYS_CFLAGS@
 TSS2_ESYS_LIBS = @TSS2_ESYS_LIBS@
 TSS2_FAPI_3_0_CFLAGS = @TSS2_FAPI_3_0_CFLAGS@
@@ -1017,9 +1237,8 @@
 TSS2_SYS_LIBS = @TSS2_SYS_LIBS@
 TSS2_TCTILDR_CFLAGS = @TSS2_TCTILDR_CFLAGS@
 TSS2_TCTILDR_LIBS = @TSS2_TCTILDR_LIBS@
-UUID_CFLAGS = @UUID_CFLAGS@
-UUID_LIBS = @UUID_LIBS@
 VERSION = @VERSION@
+WC = @WC@
 XXD = @XXD@
 abs_builddir = @abs_builddir@
 abs_srcdir = @abs_srcdir@
@@ -1052,6 +1271,8 @@
 host_os = @host_os@
 host_vendor = @host_vendor@
 htmldir = @htmldir@
+ifGNUmake = @ifGNUmake@
+ifnGNUmake = @ifnGNUmake@
 includedir = @includedir@
 infodir = @infodir@
 install_sh = @install_sh@
@@ -1063,13 +1284,18 @@
 mkdir_p = @mkdir_p@
 oldincludedir = @oldincludedir@
 pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
 prefix = @prefix@
 program_transform_name = @program_transform_name@
 psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
 runstatedir = @runstatedir@
 sbindir = @sbindir@
 sharedstatedir = @sharedstatedir@
 srcdir = @srcdir@
+swtpm = @swtpm@
 sysconfdir = @sysconfdir@
 target_alias = @target_alias@
 top_build_prefix = @top_build_prefix@
@@ -1077,7 +1303,26 @@
 top_srcdir = @top_srcdir@
 tpm2_abrmd = @tpm2_abrmd@
 tpm_server = @tpm_server@
+tpmsim = @tpmsim@
 with_bashcompdir = @with_bashcompdir@
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@GITIGNOREFILES = $(GITIGNOREFILES) $(CODE_COVERAGE_OUTPUT_FILE) $(CODE_COVERAGE_OUTPUT_DIRECTORY)
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_v_lcov_cap = $(code_coverage_v_lcov_cap_$(V))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_v_lcov_cap_ = $(code_coverage_v_lcov_cap_$(AM_DEFAULT_VERBOSITY))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_v_lcov_cap_0 = @echo "  LCOV   --capture" $(CODE_COVERAGE_OUTPUT_FILE);
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_v_lcov_ign = $(code_coverage_v_lcov_ign_$(V))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_v_lcov_ign_ = $(code_coverage_v_lcov_ign_$(AM_DEFAULT_VERBOSITY))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_v_lcov_ign_0 = @echo "  LCOV   --remove /tmp/*" $(CODE_COVERAGE_IGNORE_PATTERN);
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_v_genhtml = $(code_coverage_v_genhtml_$(V))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_v_genhtml_ = $(code_coverage_v_genhtml_$(AM_DEFAULT_VERBOSITY))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_v_genhtml_0 = @echo "  GEN   " "$(CODE_COVERAGE_OUTPUT_DIRECTORY)";
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_quiet = $(code_coverage_quiet_$(V))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_quiet_ = $(code_coverage_quiet_$(AM_DEFAULT_VERBOSITY))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_quiet_0 = --quiet
+
+# sanitizes the test-name: replaces with underscores: dashes and dots
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code_coverage_sanitize = $(subst -,_,$(subst .,_,$(1)))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@AM_DISTCHECK_CONFIGURE_FLAGS = $(AM_DISTCHECK_CONFIGURE_FLAGS) --disable-code-coverage
+AM_DISTCHECK_CONFIGURE_FLAGS = --with-bashcompdir='$$(datarootdir)/bash-completion/completions'
 LIB_C = lib/files.c lib/log.c lib/object.c lib/pcr.c lib/tool_rc.c lib/tpm2.c lib/tpm2_alg_util.c lib/tpm2_attr_util.c lib/tpm2_auth_util.c lib/tpm2_capability.c lib/tpm2_cc_util.c lib/tpm2_convert.c lib/tpm2_ctx_mgmt.c lib/tpm2_errata.c lib/tpm2_eventlog.c lib/tpm2_eventlog_yaml.c lib/tpm2_hash.c lib/tpm2_hierarchy.c lib/tpm2_identity_util.c lib/tpm2_kdfa.c lib/tpm2_kdfe.c lib/tpm2_openssl.c lib/tpm2_options.c lib/tpm2_policy.c lib/tpm2_session.c lib/tpm2_tool_output.c lib/tpm2_util.c 
 LIB_H = lib/efi_event.h lib/files.h lib/log.h lib/object.h lib/pcr.h lib/tool_rc.h lib/tpm2.h lib/tpm2_alg_util.h lib/tpm2_attr_util.h lib/tpm2_auth_util.h lib/tpm2_capability.h lib/tpm2_cc_util.h lib/tpm2_convert.h lib/tpm2_ctx_mgmt.h lib/tpm2_errata.h lib/tpm2_eventlog.h lib/tpm2_eventlog_yaml.h lib/tpm2_hash.h lib/tpm2_header.h lib/tpm2_hierarchy.h lib/tpm2_identity_util.h lib/tpm2_kdfa.h lib/tpm2_kdfe.h lib/tpm2_nv_util.h lib/tpm2_openssl.h lib/tpm2_options.h lib/tpm2_policy.h lib/tpm2_session.h lib/tpm2_systemdeps.h lib/tpm2_tool_output.h lib/tpm2_util.h 
 LIB_SRC = $(LIB_C) $(LIB_H)
@@ -1121,12 +1366,14 @@
 	test/integration/tests/dictionarylockout.sh \
 	test/integration/tests/duplicate.sh \
 	test/integration/tests/ecc.sh \
+	test/integration/tests/encodeobject.sh \
 	test/integration/tests/encryptdecrypt.sh \
 	test/integration/tests/eventlog.sh \
 	test/integration/tests/evictcontrol.sh \
 	test/integration/tests/flushcontext.sh \
 	test/integration/tests/getcap.sh \
 	test/integration/tests/getekcertificate.sh \
+	test/integration/tests/getpolicydigest.sh \
 	test/integration/tests/getrandom.sh \
 	test/integration/tests/gettestresult.sh \
 	test/integration/tests/gettime.sh \
@@ -1148,6 +1395,7 @@
 	test/integration/tests/pcrextend.sh \
 	test/integration/tests/pcrlist.sh \
 	test/integration/tests/pcrreset.sh \
+	test/integration/tests/pcrs_format.sh \
 	test/integration/tests/print.sh \
 	test/integration/tests/quote.sh \
 	test/integration/tests/rc_decode.sh \
@@ -1159,6 +1407,7 @@
 	test/integration/tests/send-tcti-cmd.sh \
 	test/integration/tests/send.sh \
 	test/integration/tests/sessionaudit.sh \
+	test/integration/tests/sessionconfig.sh \
 	test/integration/tests/setclock.sh \
 	test/integration/tests/setprimarypolicy.sh \
 	test/integration/tests/sign.sh \
@@ -1188,6 +1437,8 @@
 	test/integration/fapi/fapi-get-random_ecc.sh \
 	test/integration/fapi/fapi-get-tpm-blobs.sh \
 	test/integration/fapi/fapi-get-tpm-blobs_ecc.sh \
+	test/integration/fapi/fapi-gettpm2object.sh \
+	test/integration/fapi/fapi-gettpm2object_ecc.sh \
 	test/integration/fapi/fapi-key-change-auth.sh \
 	test/integration/fapi/fapi-key-change-auth_ecc.sh \
 	test/integration/fapi/fapi-list.sh \
@@ -1208,6 +1459,10 @@
 	test/integration/fapi/fapi-nv-write-read_ecc.sh \
 	test/integration/fapi/fapi-pcr-extend-read.sh \
 	test/integration/fapi/fapi-pcr-extend-read_ecc.sh \
+	test/integration/fapi/fapi-policy_signed.sh \
+	test/integration/fapi/fapi-policy_signed_delegation.sh \
+	test/integration/fapi/fapi-policy_signed_delegation_ecc.sh \
+	test/integration/fapi/fapi-policy_signed_ecc.sh \
 	test/integration/fapi/fapi-provision.sh \
 	test/integration/fapi/fapi-provision_ecc.sh \
 	test/integration/fapi/fapi-quote-verify.sh \
@@ -1231,21 +1486,20 @@
 AM_CFLAGS := \
     $(INCLUDE_DIRS) $(EXTRA_CFLAGS) $(TSS2_ESYS_CFLAGS) $(TSS2_MU_CFLAGS) \
     $(CRYPTO_CFLAGS) $(CODE_COVERAGE_CFLAGS) $(TSS2_TCTILDR_CFLAGS) \
-    $(TSS2_RC_CFLAGS) $(TSS2_SYS_CFLAGS) $(UUID_CFLAGS)
+    $(TSS2_RC_CFLAGS) $(TSS2_SYS_CFLAGS)
 
 AM_LDFLAGS := $(EXTRA_LDFLAGS) $(CODE_COVERAGE_LIBS)
 LDADD = \
     $(LIB_COMMON) $(TSS2_ESYS_LIBS) $(TSS2_MU_LIBS) $(CRYPTO_LIBS) $(TSS2_TCTILDR_LIBS) \
-    $(TSS2_RC_LIBS) $(TSS2_SYS_LIBS) $(UUID_LIBS)
+    $(TSS2_RC_LIBS) $(TSS2_SYS_LIBS) $(EFIVAR_LIBS)
 
-AM_DISTCHECK_CONFIGURE_FLAGS = --with-bashcompdir='$$(datarootdir)/bash-completion/completions'
 FAPI_CFLAGS = $(EXTRA_CFLAGS) $(TSS2_FAPI_CFLAGS) $(CODE_COVERAGE_CFLAGS)
-TESTS = $(am__append_2) $(am__append_3)
+TESTS = $(am__append_2) $(am__append_4) $(am__append_5)
 noinst_LIBRARIES = $(LIB_COMMON)
 lib_libcommon_a_SOURCES = $(LIB_SRC)
 lib_libcommon_a_CFLAGS = -fPIC $(AM_CFLAGS)
 tools_fapi_tss2_CFLAGS = $(FAPI_CFLAGS) -DTSS2_TOOLS_MAX="$(words $(tss2_tools))"
-tools_fapi_tss2_LDFLAGS = $(TSS2_FAPI_LIBS)
+tools_fapi_tss2_LDFLAGS = $(EXTRA_LDFLAGS) $(TSS2_FAPI_LIBS)
 tools_fapi_tss2_SOURCES = \
 	tools/fapi/tss2_template.c \
 	tools/fapi/tss2_template.h \
@@ -1266,6 +1520,7 @@
     tools/fapi/tss2_getplatformcertificates.c \
     tools/fapi/tss2_gettpmblobs.c \
     tools/fapi/tss2_getappdata.c \
+    tools/fapi/tss2_gettpm2object.c \
     tools/fapi/tss2_setappdata.c \
     tools/fapi/tss2_setcertificate.c \
     tools/fapi/tss2_sign.c \
@@ -1300,6 +1555,7 @@
 tpm2_tools = \
     tools/misc/tpm2_certifyX509certutil.c \
     tools/misc/tpm2_checkquote.c \
+    tools/misc/tpm2_encodeobject.c \
     tools/misc/tpm2_eventlog.c \
     tools/misc/tpm2_print.c \
     tools/misc/tpm2_rc_decode.c \
@@ -1395,8 +1651,11 @@
     tools/tpm2_commit.c \
     tools/tpm2_ecdhkeygen.c \
     tools/tpm2_ecdhzgen.c \
-    tools/tpm2_zgen2phase.c
+    tools/tpm2_zgen2phase.c \
+    tools/tpm2_sessionconfig.c \
+    tools/tpm2_getpolicydigest.c
 
+@UNIT_TRUE@check_SCRIPTS = $(am__append_3)
 @UNIT_TRUE@test_unit_test_string_bytes_CFLAGS = $(AM_CFLAGS) $(CMOCKA_CFLAGS)
 @UNIT_TRUE@test_unit_test_string_bytes_LDADD = $(CMOCKA_LIBS) $(LDADD)
 @UNIT_TRUE@test_unit_test_files_CFLAGS = $(AM_CFLAGS) $(CMOCKA_CFLAGS)
@@ -1437,7 +1696,9 @@
 @UNIT_TRUE@                                      -Wl,--wrap=Esys_PolicyPCR \
 @UNIT_TRUE@                                      -Wl,--wrap=Esys_PCR_Read \
 @UNIT_TRUE@                                      -Wl,--wrap=Esys_PolicyGetDigest \
-@UNIT_TRUE@                                      -Wl,--wrap=Esys_FlushContext
+@UNIT_TRUE@                                      -Wl,--wrap=Esys_FlushContext \
+@UNIT_TRUE@                                      -Wl,--wrap=files_get_file_size_path \
+@UNIT_TRUE@                                      -Wl,--wrap=files_load_bytes_from_path
 
 @UNIT_TRUE@test_unit_test_tpm2_policy_LDADD = $(CMOCKA_LIBS) $(LDADD)
 @UNIT_TRUE@test_unit_test_tpm2_util_CFLAGS = $(AM_CFLAGS) $(CMOCKA_CFLAGS)
@@ -1453,14 +1714,17 @@
 @UNIT_TRUE@test_unit_test_tpm2_eventlog_LDADD = $(CMOCKA_LIBS) $(LDADD)
 @UNIT_TRUE@test_unit_test_tpm2_eventlog_yaml_CFLAGS = $(AM_CFLAGS) $(CMOCKA_CFLAGS)
 @UNIT_TRUE@test_unit_test_tpm2_eventlog_yaml_LDADD = $(CMOCKA_LIBS) $(LDADD)
-@UNIT_TRUE@AM_TESTS_ENVIRONMENT = TPM2_ABRMD=tpm2-abrmd; export \
-@UNIT_TRUE@	TPM2_ABRMD; TPM2_SIM=tpm_server; export TPM2_SIM; \
-@UNIT_TRUE@	PATH=$(abs_builddir)/tools:$(abs_builddir)/tools/misc:$(abs_top_srcdir)/test/integration:$(PATH); \
+@UNIT_TRUE@test_unit_test_object_CFLAGS = $(AM_CFLAGS) $(CMOCKA_CFLAGS)
+@UNIT_TRUE@test_unit_test_object_LDADD = $(CMOCKA_LIBS) $(LDADD)
+@UNIT_TRUE@AM_TESTS_ENVIRONMENT = export TPM2_ABRMD=$(TPM2_ABRMD); \
+@UNIT_TRUE@	export TPM2_SIM=$(TPM2_SIM); export \
+@UNIT_TRUE@	PATH=$(abs_builddir)/tools:$(abs_builddir)/tools/misc:$(abs_top_srcdir)/test/integration:$(abs_builddir)/tools/fapi:$(PATH); \
+@UNIT_TRUE@	export \
 @UNIT_TRUE@	TPM2_TOOLS_TEST_FIXTURES=$(abs_top_srcdir)/test/integration/fixtures; \
-@UNIT_TRUE@	SRCDIR=$(abs_srcdir); export SRCDIR; \
-@UNIT_TRUE@	BUILDDIR=$(abs_builddir); export BUILDDIR; export \
-@UNIT_TRUE@	TPM2_TOOLS_TEST_FIXTURES; $(am__append_4) \
-@UNIT_TRUE@	$(am__append_5)
+@UNIT_TRUE@	export abs_builddir=$(abs_builddir); export \
+@UNIT_TRUE@	abs_srcdir=$(abs_srcdir); export PYTHON=$(PYTHON); \
+@UNIT_TRUE@	export TPM2_TOOLS_TEST_FIXTURES; $(am__append_6) \
+@UNIT_TRUE@	$(am__append_7)
 @UNIT_TRUE@SH_LOG_COMPILER = dbus-run-session bash
 @UNIT_TRUE@AM_SH_LOG_FLAGS = --
 TEST_EXTENSIONS = .sh
@@ -1470,17 +1734,18 @@
 
 EXTRA_DIST = \
     bootstrap \
-    doc/AUTHORS.md \
-    doc/CHANGELOG.md \
-    doc/CONTRIBUTING.md \
-    doc/INSTALL.md \
-    doc/LICENSE \
-    doc/MAINTAINERS.md \
-    README.md \
-    doc/RELEASE.md \
+    docs/AUTHORS.md \
+    docs/CHANGELOG.md \
+    docs/CONTRIBUTING.md \
+    docs/INSTALL.md \
+    docs/LICENSE \
+    docs/MAINTAINERS.md \
+    docs/README.md \
+    docs/RELEASE.md \
     man \
     scripts \
-    test
+    test \
+    VERSION
 
 @HAVE_MAN_PAGES_TRUE@dist_man1_MANS :=  \
 @HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_activatecredential.1 \
@@ -1501,6 +1766,7 @@
 @HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_createprimary.1 \
 @HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_dictionarylockout.1 \
 @HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_duplicate.1 \
+@HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_encodeobject.1 \
 @HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_getcap.1 \
 @HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_encryptdecrypt.1 \
 @HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_eventlog.1 \
@@ -1580,7 +1846,9 @@
 @HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_ecdhkeygen.1 \
 @HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_ecdhzgen.1 \
 @HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_zgen2phase.1 \
-@HAVE_MAN_PAGES_TRUE@	man/man1/tpm2.1 $(am__append_6)
+@HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_sessionconfig.1 \
+@HAVE_MAN_PAGES_TRUE@	man/man1/tpm2_getpolicydigest.1 \
+@HAVE_MAN_PAGES_TRUE@	man/man1/tpm2.1 $(am__append_8)
 MARKDOWN_COMMON_DEPS = \
 	man/common/alg.md \
 	man/common/authorizations.md \
@@ -1590,6 +1858,7 @@
 	man/common/obj-attrs.md \
 	man/common/object-alg.md \
 	man/common/options.md \
+	man/common/pcrs_format.md \
 	man/common/policy-limitations.md \
 	man/common/pubkey.md \
 	man/common/returns.md \
@@ -1600,7 +1869,7 @@
 CLEANFILES = $(dist_man1_MANS)
 dist_bashcomp_DATA =  \
 	dist/bash-completion/tpm2-tools/tpm2_completion.bash \
-	$(am__append_7)
+	$(am__append_9)
 all: all-am
 
 .SUFFIXES:
@@ -1626,8 +1895,8 @@
 	    echo ' $(SHELL) ./config.status'; \
 	    $(SHELL) ./config.status;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe);; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__maybe_remake_depfiles);; \
 	esac;
 $(top_srcdir)/aminclude_static.am $(srcdir)/src_vars.mk $(am__empty):
 
@@ -1654,74 +1923,6 @@
 
 distclean-hdr:
 	-rm -f lib/config.h lib/stamp-h1
-
-clean-noinstLIBRARIES:
-	-test -z "$(noinst_LIBRARIES)" || rm -f $(noinst_LIBRARIES)
-lib/$(am__dirstamp):
-	@$(MKDIR_P) lib
-	@: > lib/$(am__dirstamp)
-lib/$(DEPDIR)/$(am__dirstamp):
-	@$(MKDIR_P) lib/$(DEPDIR)
-	@: > lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-files.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-log.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-object.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-pcr.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tool_rc.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_alg_util.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_attr_util.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_auth_util.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_capability.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_cc_util.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_convert.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_ctx_mgmt.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_errata.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_eventlog.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_eventlog_yaml.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_hash.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_hierarchy.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_identity_util.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_kdfa.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_kdfe.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_openssl.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_options.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_policy.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_session.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_tool_output.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-lib/lib_libcommon_a-tpm2_util.$(OBJEXT): lib/$(am__dirstamp) \
-	lib/$(DEPDIR)/$(am__dirstamp)
-
-lib/libcommon.a: $(lib_libcommon_a_OBJECTS) $(lib_libcommon_a_DEPENDENCIES) $(EXTRA_lib_libcommon_a_DEPENDENCIES) lib/$(am__dirstamp)
-	$(AM_V_at)-rm -f lib/libcommon.a
-	$(AM_V_AR)$(lib_libcommon_a_AR) lib/libcommon.a $(lib_libcommon_a_OBJECTS) $(lib_libcommon_a_LIBADD)
-	$(AM_V_at)$(RANLIB) lib/libcommon.a
 install-binPROGRAMS: $(bin_PROGRAMS)
 	@$(NORMAL_INSTALL)
 	@list='$(bin_PROGRAMS)'; test -n "$(bindir)" || list=; \
@@ -1780,97 +1981,171 @@
 	list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \
 	echo " rm -f" $$list; \
 	rm -f $$list
+
+clean-noinstLIBRARIES:
+	-test -z "$(noinst_LIBRARIES)" || rm -f $(noinst_LIBRARIES)
+lib/$(am__dirstamp):
+	@$(MKDIR_P) lib
+	@: > lib/$(am__dirstamp)
+lib/$(DEPDIR)/$(am__dirstamp):
+	@$(MKDIR_P) lib/$(DEPDIR)
+	@: > lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-files.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-log.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-object.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-pcr.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tool_rc.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_alg_util.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_attr_util.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_auth_util.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_capability.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_cc_util.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_convert.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_ctx_mgmt.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_errata.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_eventlog.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_eventlog_yaml.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_hash.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_hierarchy.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_identity_util.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_kdfa.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_kdfe.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_openssl.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_options.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_policy.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_session.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_tool_output.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+lib/libcommon_a-tpm2_util.$(OBJEXT): lib/$(am__dirstamp) \
+	lib/$(DEPDIR)/$(am__dirstamp)
+
+lib/libcommon.a: $(lib_libcommon_a_OBJECTS) $(lib_libcommon_a_DEPENDENCIES) $(EXTRA_lib_libcommon_a_DEPENDENCIES) lib/$(am__dirstamp)
+	$(AM_V_at)-rm -f lib/libcommon.a
+	$(AM_V_AR)$(lib_libcommon_a_AR) lib/libcommon.a $(lib_libcommon_a_OBJECTS) $(lib_libcommon_a_LIBADD)
+	$(AM_V_at)$(RANLIB) lib/libcommon.a
 test/unit/$(am__dirstamp):
 	@$(MKDIR_P) test/unit
 	@: > test/unit/$(am__dirstamp)
 test/unit/$(DEPDIR)/$(am__dirstamp):
 	@$(MKDIR_P) test/unit/$(DEPDIR)
 	@: > test/unit/$(DEPDIR)/$(am__dirstamp)
-test/unit/test_unit_test_cc_util-test_cc_util.$(OBJEXT):  \
+test/unit/test_cc_util-test_cc_util.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_cc_util$(EXEEXT): $(test_unit_test_cc_util_OBJECTS) $(test_unit_test_cc_util_DEPENDENCIES) $(EXTRA_test_unit_test_cc_util_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_cc_util$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_cc_util_LINK) $(test_unit_test_cc_util_OBJECTS) $(test_unit_test_cc_util_LDADD) $(LIBS)
-test/unit/test_unit_test_files-test_files.$(OBJEXT):  \
-	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
+test/unit/test_files-test_files.$(OBJEXT): test/unit/$(am__dirstamp) \
+	test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_files$(EXEEXT): $(test_unit_test_files_OBJECTS) $(test_unit_test_files_DEPENDENCIES) $(EXTRA_test_unit_test_files_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_files$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_files_LINK) $(test_unit_test_files_OBJECTS) $(test_unit_test_files_LDADD) $(LIBS)
-test/unit/test_unit_test_options-test_options.$(OBJEXT):  \
+test/unit/test_object-test_object.$(OBJEXT):  \
+	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
+
+test/unit/test_object$(EXEEXT): $(test_unit_test_object_OBJECTS) $(test_unit_test_object_DEPENDENCIES) $(EXTRA_test_unit_test_object_DEPENDENCIES) test/unit/$(am__dirstamp)
+	@rm -f test/unit/test_object$(EXEEXT)
+	$(AM_V_CCLD)$(test_unit_test_object_LINK) $(test_unit_test_object_OBJECTS) $(test_unit_test_object_LDADD) $(LIBS)
+test/unit/test_options-test_options.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_options$(EXEEXT): $(test_unit_test_options_OBJECTS) $(test_unit_test_options_DEPENDENCIES) $(EXTRA_test_unit_test_options_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_options$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_options_LINK) $(test_unit_test_options_OBJECTS) $(test_unit_test_options_LDADD) $(LIBS)
-test/unit/test_unit_test_pcr-test_pcr.$(OBJEXT):  \
-	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
+test/unit/test_pcr-test_pcr.$(OBJEXT): test/unit/$(am__dirstamp) \
+	test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_pcr$(EXEEXT): $(test_unit_test_pcr_OBJECTS) $(test_unit_test_pcr_DEPENDENCIES) $(EXTRA_test_unit_test_pcr_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_pcr$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_pcr_LINK) $(test_unit_test_pcr_OBJECTS) $(test_unit_test_pcr_LDADD) $(LIBS)
-test/unit/test_unit_test_string_bytes-test_string_bytes.$(OBJEXT):  \
+test/unit/test_string_bytes-test_string_bytes.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_string_bytes$(EXEEXT): $(test_unit_test_string_bytes_OBJECTS) $(test_unit_test_string_bytes_DEPENDENCIES) $(EXTRA_test_unit_test_string_bytes_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_string_bytes$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_string_bytes_LINK) $(test_unit_test_string_bytes_OBJECTS) $(test_unit_test_string_bytes_LDADD) $(LIBS)
-test/unit/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.$(OBJEXT):  \
+test/unit/test_tpm2_alg_util-test_tpm2_alg_util.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_tpm2_alg_util$(EXEEXT): $(test_unit_test_tpm2_alg_util_OBJECTS) $(test_unit_test_tpm2_alg_util_DEPENDENCIES) $(EXTRA_test_unit_test_tpm2_alg_util_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_tpm2_alg_util$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_tpm2_alg_util_LINK) $(test_unit_test_tpm2_alg_util_OBJECTS) $(test_unit_test_tpm2_alg_util_LDADD) $(LIBS)
-test/unit/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.$(OBJEXT):  \
+test/unit/test_tpm2_attr_util-test_tpm2_attr_util.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_tpm2_attr_util$(EXEEXT): $(test_unit_test_tpm2_attr_util_OBJECTS) $(test_unit_test_tpm2_attr_util_DEPENDENCIES) $(EXTRA_test_unit_test_tpm2_attr_util_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_tpm2_attr_util$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_tpm2_attr_util_LINK) $(test_unit_test_tpm2_attr_util_OBJECTS) $(test_unit_test_tpm2_attr_util_LDADD) $(LIBS)
-test/unit/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.$(OBJEXT):  \
+test/unit/test_tpm2_auth_util-test_tpm2_auth_util.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_tpm2_auth_util$(EXEEXT): $(test_unit_test_tpm2_auth_util_OBJECTS) $(test_unit_test_tpm2_auth_util_DEPENDENCIES) $(EXTRA_test_unit_test_tpm2_auth_util_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_tpm2_auth_util$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_tpm2_auth_util_LINK) $(test_unit_test_tpm2_auth_util_OBJECTS) $(test_unit_test_tpm2_auth_util_LDADD) $(LIBS)
-test/unit/test_unit_test_tpm2_errata-test_tpm2_errata.$(OBJEXT):  \
+test/unit/test_tpm2_errata-test_tpm2_errata.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_tpm2_errata$(EXEEXT): $(test_unit_test_tpm2_errata_OBJECTS) $(test_unit_test_tpm2_errata_DEPENDENCIES) $(EXTRA_test_unit_test_tpm2_errata_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_tpm2_errata$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_tpm2_errata_LINK) $(test_unit_test_tpm2_errata_OBJECTS) $(test_unit_test_tpm2_errata_LDADD) $(LIBS)
-test/unit/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.$(OBJEXT):  \
+test/unit/test_tpm2_eventlog-test_tpm2_eventlog.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_tpm2_eventlog$(EXEEXT): $(test_unit_test_tpm2_eventlog_OBJECTS) $(test_unit_test_tpm2_eventlog_DEPENDENCIES) $(EXTRA_test_unit_test_tpm2_eventlog_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_tpm2_eventlog$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_tpm2_eventlog_LINK) $(test_unit_test_tpm2_eventlog_OBJECTS) $(test_unit_test_tpm2_eventlog_LDADD) $(LIBS)
-test/unit/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.$(OBJEXT):  \
+test/unit/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_tpm2_eventlog_yaml$(EXEEXT): $(test_unit_test_tpm2_eventlog_yaml_OBJECTS) $(test_unit_test_tpm2_eventlog_yaml_DEPENDENCIES) $(EXTRA_test_unit_test_tpm2_eventlog_yaml_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_tpm2_eventlog_yaml$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_tpm2_eventlog_yaml_LINK) $(test_unit_test_tpm2_eventlog_yaml_OBJECTS) $(test_unit_test_tpm2_eventlog_yaml_LDADD) $(LIBS)
-test/unit/test_unit_test_tpm2_header-test_tpm2_header.$(OBJEXT):  \
+test/unit/test_tpm2_header-test_tpm2_header.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_tpm2_header$(EXEEXT): $(test_unit_test_tpm2_header_OBJECTS) $(test_unit_test_tpm2_header_DEPENDENCIES) $(EXTRA_test_unit_test_tpm2_header_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_tpm2_header$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_tpm2_header_LINK) $(test_unit_test_tpm2_header_OBJECTS) $(test_unit_test_tpm2_header_LDADD) $(LIBS)
-test/unit/test_unit_test_tpm2_policy-test_tpm2_policy.$(OBJEXT):  \
+test/unit/test_tpm2_policy-test_tpm2_policy.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_tpm2_policy$(EXEEXT): $(test_unit_test_tpm2_policy_OBJECTS) $(test_unit_test_tpm2_policy_DEPENDENCIES) $(EXTRA_test_unit_test_tpm2_policy_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_tpm2_policy$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_tpm2_policy_LINK) $(test_unit_test_tpm2_policy_OBJECTS) $(test_unit_test_tpm2_policy_LDADD) $(LIBS)
-test/unit/test_unit_test_tpm2_session-test_tpm2_session.$(OBJEXT):  \
+test/unit/test_tpm2_session-test_tpm2_session.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_tpm2_session$(EXEEXT): $(test_unit_test_tpm2_session_OBJECTS) $(test_unit_test_tpm2_session_DEPENDENCIES) $(EXTRA_test_unit_test_tpm2_session_DEPENDENCIES) test/unit/$(am__dirstamp)
 	@rm -f test/unit/test_tpm2_session$(EXEEXT)
 	$(AM_V_CCLD)$(test_unit_test_tpm2_session_LINK) $(test_unit_test_tpm2_session_OBJECTS) $(test_unit_test_tpm2_session_LDADD) $(LIBS)
-test/unit/test_unit_test_tpm2_util-test_tpm2_util.$(OBJEXT):  \
+test/unit/test_tpm2_util-test_tpm2_util.$(OBJEXT):  \
 	test/unit/$(am__dirstamp) test/unit/$(DEPDIR)/$(am__dirstamp)
 
 test/unit/test_tpm2_util$(EXEEXT): $(test_unit_test_tpm2_util_OBJECTS) $(test_unit_test_tpm2_util_DEPENDENCIES) $(EXTRA_test_unit_test_tpm2_util_DEPENDENCIES) test/unit/$(am__dirstamp)
@@ -1882,115 +2157,93 @@
 tools/fapi/$(DEPDIR)/$(am__dirstamp):
 	@$(MKDIR_P) tools/fapi/$(DEPDIR)
 	@: > tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_template.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_template.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_decrypt.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_decrypt.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_encrypt.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_encrypt.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_list.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_list.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_changeauth.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_changeauth.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_delete.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_delete.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_import.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_import.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_getinfo.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_getinfo.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_createkey.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_createkey.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_createseal.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_createseal.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_exportkey.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_exportkey.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_getcertificate.$(OBJEXT):  \
+tools/fapi/tss2-tss2_getcertificate.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_getplatformcertificates.$(OBJEXT):  \
+tools/fapi/tss2-tss2_getplatformcertificates.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_gettpmblobs.$(OBJEXT):  \
+tools/fapi/tss2-tss2_gettpmblobs.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_getappdata.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_getappdata.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_setappdata.$(OBJEXT):  \
+tools/fapi/tss2-tss2_gettpm2object.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_setcertificate.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_setappdata.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_sign.$(OBJEXT):  \
+tools/fapi/tss2-tss2_setcertificate.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_verifysignature.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_sign.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_verifyquote.$(OBJEXT):  \
+tools/fapi/tss2-tss2_verifysignature.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_createnv.$(OBJEXT):  \
+tools/fapi/tss2-tss2_verifyquote.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_nvextend.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_createnv.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_nvincrement.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_nvextend.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_nvread.$(OBJEXT):  \
+tools/fapi/tss2-tss2_nvincrement.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_nvsetbits.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_nvread.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_nvwrite.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_nvsetbits.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_getdescription.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_nvwrite.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_setdescription.$(OBJEXT):  \
+tools/fapi/tss2-tss2_getdescription.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_pcrextend.$(OBJEXT):  \
+tools/fapi/tss2-tss2_setdescription.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_quote.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_pcrextend.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_pcrread.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_quote.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_authorizepolicy.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_pcrread.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_exportpolicy.$(OBJEXT):  \
+tools/fapi/tss2-tss2_authorizepolicy.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_provision.$(OBJEXT):  \
+tools/fapi/tss2-tss2_exportpolicy.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_getrandom.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_provision.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_unseal.$(OBJEXT):  \
-	tools/fapi/$(am__dirstamp) \
+tools/fapi/tss2-tss2_getrandom.$(OBJEXT): tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
-tools/fapi/tools_fapi_tss2-tss2_writeauthorizenv.$(OBJEXT):  \
+tools/fapi/tss2-tss2_unseal.$(OBJEXT): tools/fapi/$(am__dirstamp) \
+	tools/fapi/$(DEPDIR)/$(am__dirstamp)
+tools/fapi/tss2-tss2_writeauthorizenv.$(OBJEXT):  \
 	tools/fapi/$(am__dirstamp) \
 	tools/fapi/$(DEPDIR)/$(am__dirstamp)
 
@@ -2003,7 +2256,7 @@
 tools/$(DEPDIR)/$(am__dirstamp):
 	@$(MKDIR_P) tools/$(DEPDIR)
 	@: > tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_tool.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_tool.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
 tools/misc/$(am__dirstamp):
 	@$(MKDIR_P) tools/misc
@@ -2011,206 +2264,209 @@
 tools/misc/$(DEPDIR)/$(am__dirstamp):
 	@$(MKDIR_P) tools/misc/$(DEPDIR)
 	@: > tools/misc/$(DEPDIR)/$(am__dirstamp)
-tools/misc/tools_tpm2-tpm2_certifyX509certutil.$(OBJEXT):  \
+tools/misc/tpm2-tpm2_certifyX509certutil.$(OBJEXT):  \
 	tools/misc/$(am__dirstamp) \
 	tools/misc/$(DEPDIR)/$(am__dirstamp)
-tools/misc/tools_tpm2-tpm2_checkquote.$(OBJEXT):  \
-	tools/misc/$(am__dirstamp) \
+tools/misc/tpm2-tpm2_checkquote.$(OBJEXT): tools/misc/$(am__dirstamp) \
 	tools/misc/$(DEPDIR)/$(am__dirstamp)
-tools/misc/tools_tpm2-tpm2_eventlog.$(OBJEXT):  \
+tools/misc/tpm2-tpm2_encodeobject.$(OBJEXT):  \
 	tools/misc/$(am__dirstamp) \
 	tools/misc/$(DEPDIR)/$(am__dirstamp)
-tools/misc/tools_tpm2-tpm2_print.$(OBJEXT):  \
-	tools/misc/$(am__dirstamp) \
+tools/misc/tpm2-tpm2_eventlog.$(OBJEXT): tools/misc/$(am__dirstamp) \
 	tools/misc/$(DEPDIR)/$(am__dirstamp)
-tools/misc/tools_tpm2-tpm2_rc_decode.$(OBJEXT):  \
-	tools/misc/$(am__dirstamp) \
+tools/misc/tpm2-tpm2_print.$(OBJEXT): tools/misc/$(am__dirstamp) \
 	tools/misc/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_activatecredential.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_certify.$(OBJEXT): tools/$(am__dirstamp) \
+tools/misc/tpm2-tpm2_rc_decode.$(OBJEXT): tools/misc/$(am__dirstamp) \
+	tools/misc/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_activatecredential.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_changeauth.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_certify.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_changeeps.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_changeauth.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_changepps.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_changeeps.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_clear.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_changepps.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_clearcontrol.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_clear.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_clockrateadjust.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_create.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_clearcontrol.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_createak.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_clockrateadjust.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_createek.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_create.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_createpolicy.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_createak.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_setprimarypolicy.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_createprimary.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_createek.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_dictionarylockout.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_duplicate.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_createpolicy.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_getcap.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_setprimarypolicy.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_gettestresult.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_createprimary.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_encryptdecrypt.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_dictionarylockout.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_evictcontrol.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_duplicate.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_flushcontext.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_getcap.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_getekcertificate.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_getrandom.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_gettestresult.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_gettime.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_encryptdecrypt.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_hash.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_evictcontrol.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_hierarchycontrol.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_hmac.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_flushcontext.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_import.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_getekcertificate.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_incrementalselftest.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_load.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_getrandom.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_loadexternal.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_gettime.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_makecredential.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_hash.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_nvdefine.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_hierarchycontrol.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_nvextend.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_hmac.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_nvincrement.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_import.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_nvreadpublic.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_incrementalselftest.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_nvread.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_load.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_nvreadlock.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_loadexternal.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_nvundefine.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_makecredential.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_nvwrite.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_nvdefine.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_nvwritelock.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_nvextend.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_nvsetbits.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_nvincrement.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_pcrallocate.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_nvreadpublic.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_pcrevent.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_nvread.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_pcrextend.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_nvreadlock.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_pcrread.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_nvundefine.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_pcrreset.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_nvwrite.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policypcr.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_nvwritelock.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policyauthorize.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policyauthorizenv.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policynv.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_nvsetbits.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policycountertimer.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policyor.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_pcrallocate.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policynamehash.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_pcrevent.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policytemplate.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_pcrextend.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policycphash.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_pcrread.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policypassword.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_pcrreset.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policysigned.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policypcr.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policyticket.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policyauthorize.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policyauthvalue.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policysecret.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policyauthorizenv.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policyrestart.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policynv.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policycommandcode.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policynvwritten.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policyduplicationselect.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_policylocality.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policycountertimer.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_quote.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policyor.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_readclock.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policynamehash.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_readpublic.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policytemplate.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_rsadecrypt.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policycphash.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_rsaencrypt.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policypassword.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_send.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policysigned.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_selftest.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policyticket.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_setclock.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policyauthvalue.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_shutdown.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policysecret.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_sign.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policyrestart.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_certifycreation.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_nvcertify.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policycommandcode.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_policynvwritten.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_startauthsession.$(OBJEXT):  \
+tools/tpm2-tpm2_policyduplicationselect.$(OBJEXT):  \
 	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_startup.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_policylocality.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_stirrandom.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_quote.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_testparms.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_readclock.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_unseal.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_readpublic.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_verifysignature.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_setcommandauditstatus.$(OBJEXT):  \
-	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_getcommandauditdigest.$(OBJEXT):  \
+tools/tpm2-tpm2_rsadecrypt.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_rsaencrypt.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_send.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_selftest.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_setclock.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_shutdown.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_sign.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_certifycreation.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_nvcertify.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_startauthsession.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_startup.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_stirrandom.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_testparms.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_unseal.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_verifysignature.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_setcommandauditstatus.$(OBJEXT):  \
 	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_getsessionauditdigest.$(OBJEXT):  \
+tools/tpm2-tpm2_getcommandauditdigest.$(OBJEXT):  \
 	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_geteccparameters.$(OBJEXT):  \
+tools/tpm2-tpm2_getsessionauditdigest.$(OBJEXT):  \
 	tools/$(am__dirstamp) tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_ecephemeral.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_geteccparameters.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_ecephemeral.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_commit.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_commit.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_ecdhkeygen.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_ecdhkeygen.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_ecdhzgen.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_ecdhzgen.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
-tools/tools_tpm2-tpm2_zgen2phase.$(OBJEXT): tools/$(am__dirstamp) \
+tools/tpm2-tpm2_zgen2phase.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_sessionconfig.$(OBJEXT): tools/$(am__dirstamp) \
+	tools/$(DEPDIR)/$(am__dirstamp)
+tools/tpm2-tpm2_getpolicydigest.$(OBJEXT): tools/$(am__dirstamp) \
 	tools/$(DEPDIR)/$(am__dirstamp)
 
 tools/tpm2$(EXEEXT): $(tools_tpm2_OBJECTS) $(tools_tpm2_DEPENDENCIES) $(EXTRA_tools_tpm2_DEPENDENCIES) tools/$(am__dirstamp)
@@ -2228,184 +2484,195 @@
 distclean-compile:
 	-rm -f *.tab.c
 
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-files.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-log.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-object.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-pcr.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tool_rc.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_alg_util.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_attr_util.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_auth_util.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_capability.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_cc_util.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_convert.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_ctx_mgmt.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_errata.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog_yaml.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_hash.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_hierarchy.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_identity_util.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfa.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfe.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_openssl.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_options.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_policy.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_session.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_tool_output.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/lib_libcommon_a-tpm2_util.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_cc_util-test_cc_util.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_files-test_files.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_options-test_options.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_pcr-test_pcr.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_string_bytes-test_string_bytes.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_tpm2_errata-test_tpm2_errata.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_tpm2_header-test_tpm2_header.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_tpm2_policy-test_tpm2_policy.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_tpm2_session-test_tpm2_session.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_unit_test_tpm2_util-test_tpm2_util.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_activatecredential.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_certify.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_certifycreation.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_changeauth.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_changeeps.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_changepps.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_clear.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_clearcontrol.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_clockrateadjust.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_commit.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_create.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_createak.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_createek.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_createpolicy.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_createprimary.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_dictionarylockout.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_duplicate.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhkeygen.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhzgen.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_ecephemeral.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_encryptdecrypt.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_evictcontrol.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_flushcontext.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_getcap.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_getcommandauditdigest.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_geteccparameters.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_getekcertificate.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_getrandom.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_getsessionauditdigest.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_gettestresult.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_gettime.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_hash.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_hierarchycontrol.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_hmac.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_import.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_incrementalselftest.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_load.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_loadexternal.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_makecredential.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_nvcertify.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_nvdefine.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_nvextend.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_nvincrement.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_nvread.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadlock.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadpublic.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_nvsetbits.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_nvundefine.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_nvwrite.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_nvwritelock.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_pcrallocate.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_pcrevent.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_pcrextend.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_pcrread.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_pcrreset.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorize.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorizenv.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthvalue.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policycommandcode.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policycountertimer.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policycphash.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policyduplicationselect.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policylocality.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policynamehash.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policynv.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policynvwritten.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policyor.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policypassword.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policypcr.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policyrestart.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policysecret.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policysigned.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policytemplate.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_policyticket.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_quote.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_readclock.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_readpublic.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_rsadecrypt.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_rsaencrypt.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_selftest.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_send.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_setclock.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_setcommandauditstatus.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_setprimarypolicy.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_shutdown.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_sign.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_startauthsession.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_startup.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_stirrandom.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_testparms.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_tool.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_unseal.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_verifysignature.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tools_tpm2-tpm2_zgen2phase.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_authorizepolicy.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_changeauth.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createkey.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createnv.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createseal.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_decrypt.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_delete.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_encrypt.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportkey.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportpolicy.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getappdata.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getcertificate.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getdescription.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getinfo.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getplatformcertificates.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getrandom.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_gettpmblobs.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_import.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_list.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvextend.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvincrement.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvread.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvsetbits.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvwrite.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrextend.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrread.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_provision.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_quote.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setappdata.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setcertificate.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setdescription.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_sign.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_template.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_unseal.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifyquote.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifysignature.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_writeauthorizenv.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/misc/$(DEPDIR)/tools_tpm2-tpm2_certifyX509certutil.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/misc/$(DEPDIR)/tools_tpm2-tpm2_checkquote.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/misc/$(DEPDIR)/tools_tpm2-tpm2_eventlog.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/misc/$(DEPDIR)/tools_tpm2-tpm2_print.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@tools/misc/$(DEPDIR)/tools_tpm2-tpm2_rc_decode.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-files.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-log.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-object.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-pcr.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tool_rc.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_alg_util.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_attr_util.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_auth_util.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_capability.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_cc_util.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_convert.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_ctx_mgmt.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_errata.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_eventlog.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_eventlog_yaml.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_hash.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_hierarchy.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_identity_util.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_kdfa.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_kdfe.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_openssl.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_options.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_policy.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_session.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_tool_output.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@lib/$(DEPDIR)/libcommon_a-tpm2_util.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_cc_util-test_cc_util.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_files-test_files.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_object-test_object.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_options-test_options.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_pcr-test_pcr.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_string_bytes-test_string_bytes.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_tpm2_alg_util-test_tpm2_alg_util.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_tpm2_attr_util-test_tpm2_attr_util.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_tpm2_auth_util-test_tpm2_auth_util.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_tpm2_errata-test_tpm2_errata.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_tpm2_eventlog-test_tpm2_eventlog.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_tpm2_header-test_tpm2_header.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_tpm2_policy-test_tpm2_policy.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_tpm2_session-test_tpm2_session.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@test/unit/$(DEPDIR)/test_tpm2_util-test_tpm2_util.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_activatecredential.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_certify.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_certifycreation.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_changeauth.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_changeeps.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_changepps.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_clear.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_clearcontrol.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_clockrateadjust.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_commit.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_create.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_createak.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_createek.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_createpolicy.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_createprimary.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_dictionarylockout.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_duplicate.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_ecdhkeygen.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_ecdhzgen.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_ecephemeral.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_encryptdecrypt.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_evictcontrol.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_flushcontext.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_getcap.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_getcommandauditdigest.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_geteccparameters.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_getekcertificate.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_getpolicydigest.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_getrandom.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_getsessionauditdigest.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_gettestresult.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_gettime.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_hash.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_hierarchycontrol.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_hmac.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_import.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_incrementalselftest.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_load.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_loadexternal.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_makecredential.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_nvcertify.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_nvdefine.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_nvextend.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_nvincrement.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_nvread.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_nvreadlock.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_nvreadpublic.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_nvsetbits.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_nvundefine.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_nvwrite.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_nvwritelock.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_pcrallocate.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_pcrevent.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_pcrextend.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_pcrread.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_pcrreset.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policyauthorize.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policyauthorizenv.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policyauthvalue.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policycommandcode.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policycountertimer.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policycphash.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policyduplicationselect.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policylocality.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policynamehash.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policynv.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policynvwritten.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policyor.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policypassword.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policypcr.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policyrestart.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policysecret.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policysigned.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policytemplate.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_policyticket.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_quote.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_readclock.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_readpublic.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_rsadecrypt.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_rsaencrypt.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_selftest.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_send.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_sessionconfig.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_setclock.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_setcommandauditstatus.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_setprimarypolicy.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_shutdown.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_sign.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_startauthsession.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_startup.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_stirrandom.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_testparms.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_tool.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_unseal.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_verifysignature.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/$(DEPDIR)/tpm2-tpm2_zgen2phase.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_authorizepolicy.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_changeauth.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_createkey.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_createnv.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_createseal.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_decrypt.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_delete.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_encrypt.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_exportkey.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_exportpolicy.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_getappdata.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_getcertificate.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_getdescription.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_getinfo.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_getplatformcertificates.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_getrandom.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_gettpm2object.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_gettpmblobs.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_import.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_list.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_nvextend.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_nvincrement.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_nvread.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_nvsetbits.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_nvwrite.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_pcrextend.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_pcrread.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_provision.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_quote.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_setappdata.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_setcertificate.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_setdescription.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_sign.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_template.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_unseal.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_verifyquote.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_verifysignature.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/fapi/$(DEPDIR)/tss2-tss2_writeauthorizenv.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/misc/$(DEPDIR)/tpm2-tpm2_certifyX509certutil.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/misc/$(DEPDIR)/tpm2-tpm2_checkquote.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/misc/$(DEPDIR)/tpm2-tpm2_encodeobject.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/misc/$(DEPDIR)/tpm2-tpm2_eventlog.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/misc/$(DEPDIR)/tpm2-tpm2_print.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@tools/misc/$(DEPDIR)/tpm2-tpm2_rc_decode.Po@am__quote@ # am--include-marker
+
+$(am__depfiles_remade):
+	@$(MKDIR_P) $(@D)
+	@echo '# dummy' >$@-t && $(am__mv) $@-t $@
+
+am--depfiles: $(am__depfiles_remade)
 
 .c.o:
 @am__fastdepCC_TRUE@	$(AM_V_CC)depbase=`echo $@ | sed 's|^/*$$|$(DEPDIR)/&|;s|\.o$$||'`;\
@@ -2431,2497 +2698,2567 @@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
 
-lib/lib_libcommon_a-files.o: lib/files.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-files.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-files.Tpo -c -o lib/lib_libcommon_a-files.o `test -f 'lib/files.c' || echo '$(srcdir)/'`lib/files.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-files.Tpo lib/$(DEPDIR)/lib_libcommon_a-files.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/files.c' object='lib/lib_libcommon_a-files.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-files.o: lib/files.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-files.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-files.Tpo -c -o lib/libcommon_a-files.o `test -f 'lib/files.c' || echo '$(srcdir)/'`lib/files.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-files.Tpo lib/$(DEPDIR)/libcommon_a-files.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/files.c' object='lib/libcommon_a-files.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-files.o `test -f 'lib/files.c' || echo '$(srcdir)/'`lib/files.c
+
+lib/libcommon_a-files.obj: lib/files.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-files.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-files.Tpo -c -o lib/libcommon_a-files.obj `if test -f 'lib/files.c'; then $(CYGPATH_W) 'lib/files.c'; else $(CYGPATH_W) '$(srcdir)/lib/files.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-files.Tpo lib/$(DEPDIR)/libcommon_a-files.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/files.c' object='lib/libcommon_a-files.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-files.obj `if test -f 'lib/files.c'; then $(CYGPATH_W) 'lib/files.c'; else $(CYGPATH_W) '$(srcdir)/lib/files.c'; fi`
+
+lib/libcommon_a-log.o: lib/log.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-log.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-log.Tpo -c -o lib/libcommon_a-log.o `test -f 'lib/log.c' || echo '$(srcdir)/'`lib/log.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-log.Tpo lib/$(DEPDIR)/libcommon_a-log.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/log.c' object='lib/libcommon_a-log.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-log.o `test -f 'lib/log.c' || echo '$(srcdir)/'`lib/log.c
+
+lib/libcommon_a-log.obj: lib/log.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-log.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-log.Tpo -c -o lib/libcommon_a-log.obj `if test -f 'lib/log.c'; then $(CYGPATH_W) 'lib/log.c'; else $(CYGPATH_W) '$(srcdir)/lib/log.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-log.Tpo lib/$(DEPDIR)/libcommon_a-log.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/log.c' object='lib/libcommon_a-log.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-files.o `test -f 'lib/files.c' || echo '$(srcdir)/'`lib/files.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-log.obj `if test -f 'lib/log.c'; then $(CYGPATH_W) 'lib/log.c'; else $(CYGPATH_W) '$(srcdir)/lib/log.c'; fi`
 
-lib/lib_libcommon_a-files.obj: lib/files.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-files.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-files.Tpo -c -o lib/lib_libcommon_a-files.obj `if test -f 'lib/files.c'; then $(CYGPATH_W) 'lib/files.c'; else $(CYGPATH_W) '$(srcdir)/lib/files.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-files.Tpo lib/$(DEPDIR)/lib_libcommon_a-files.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/files.c' object='lib/lib_libcommon_a-files.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-object.o: lib/object.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-object.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-object.Tpo -c -o lib/libcommon_a-object.o `test -f 'lib/object.c' || echo '$(srcdir)/'`lib/object.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-object.Tpo lib/$(DEPDIR)/libcommon_a-object.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/object.c' object='lib/libcommon_a-object.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-files.obj `if test -f 'lib/files.c'; then $(CYGPATH_W) 'lib/files.c'; else $(CYGPATH_W) '$(srcdir)/lib/files.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-object.o `test -f 'lib/object.c' || echo '$(srcdir)/'`lib/object.c
 
-lib/lib_libcommon_a-log.o: lib/log.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-log.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-log.Tpo -c -o lib/lib_libcommon_a-log.o `test -f 'lib/log.c' || echo '$(srcdir)/'`lib/log.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-log.Tpo lib/$(DEPDIR)/lib_libcommon_a-log.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/log.c' object='lib/lib_libcommon_a-log.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-object.obj: lib/object.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-object.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-object.Tpo -c -o lib/libcommon_a-object.obj `if test -f 'lib/object.c'; then $(CYGPATH_W) 'lib/object.c'; else $(CYGPATH_W) '$(srcdir)/lib/object.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-object.Tpo lib/$(DEPDIR)/libcommon_a-object.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/object.c' object='lib/libcommon_a-object.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-log.o `test -f 'lib/log.c' || echo '$(srcdir)/'`lib/log.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-object.obj `if test -f 'lib/object.c'; then $(CYGPATH_W) 'lib/object.c'; else $(CYGPATH_W) '$(srcdir)/lib/object.c'; fi`
 
-lib/lib_libcommon_a-log.obj: lib/log.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-log.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-log.Tpo -c -o lib/lib_libcommon_a-log.obj `if test -f 'lib/log.c'; then $(CYGPATH_W) 'lib/log.c'; else $(CYGPATH_W) '$(srcdir)/lib/log.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-log.Tpo lib/$(DEPDIR)/lib_libcommon_a-log.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/log.c' object='lib/lib_libcommon_a-log.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-pcr.o: lib/pcr.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-pcr.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-pcr.Tpo -c -o lib/libcommon_a-pcr.o `test -f 'lib/pcr.c' || echo '$(srcdir)/'`lib/pcr.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-pcr.Tpo lib/$(DEPDIR)/libcommon_a-pcr.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/pcr.c' object='lib/libcommon_a-pcr.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-log.obj `if test -f 'lib/log.c'; then $(CYGPATH_W) 'lib/log.c'; else $(CYGPATH_W) '$(srcdir)/lib/log.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-pcr.o `test -f 'lib/pcr.c' || echo '$(srcdir)/'`lib/pcr.c
 
-lib/lib_libcommon_a-object.o: lib/object.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-object.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-object.Tpo -c -o lib/lib_libcommon_a-object.o `test -f 'lib/object.c' || echo '$(srcdir)/'`lib/object.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-object.Tpo lib/$(DEPDIR)/lib_libcommon_a-object.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/object.c' object='lib/lib_libcommon_a-object.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-pcr.obj: lib/pcr.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-pcr.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-pcr.Tpo -c -o lib/libcommon_a-pcr.obj `if test -f 'lib/pcr.c'; then $(CYGPATH_W) 'lib/pcr.c'; else $(CYGPATH_W) '$(srcdir)/lib/pcr.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-pcr.Tpo lib/$(DEPDIR)/libcommon_a-pcr.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/pcr.c' object='lib/libcommon_a-pcr.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-object.o `test -f 'lib/object.c' || echo '$(srcdir)/'`lib/object.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-pcr.obj `if test -f 'lib/pcr.c'; then $(CYGPATH_W) 'lib/pcr.c'; else $(CYGPATH_W) '$(srcdir)/lib/pcr.c'; fi`
 
-lib/lib_libcommon_a-object.obj: lib/object.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-object.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-object.Tpo -c -o lib/lib_libcommon_a-object.obj `if test -f 'lib/object.c'; then $(CYGPATH_W) 'lib/object.c'; else $(CYGPATH_W) '$(srcdir)/lib/object.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-object.Tpo lib/$(DEPDIR)/lib_libcommon_a-object.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/object.c' object='lib/lib_libcommon_a-object.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tool_rc.o: lib/tool_rc.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tool_rc.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tool_rc.Tpo -c -o lib/libcommon_a-tool_rc.o `test -f 'lib/tool_rc.c' || echo '$(srcdir)/'`lib/tool_rc.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tool_rc.Tpo lib/$(DEPDIR)/libcommon_a-tool_rc.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tool_rc.c' object='lib/libcommon_a-tool_rc.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-object.obj `if test -f 'lib/object.c'; then $(CYGPATH_W) 'lib/object.c'; else $(CYGPATH_W) '$(srcdir)/lib/object.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tool_rc.o `test -f 'lib/tool_rc.c' || echo '$(srcdir)/'`lib/tool_rc.c
 
-lib/lib_libcommon_a-pcr.o: lib/pcr.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-pcr.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-pcr.Tpo -c -o lib/lib_libcommon_a-pcr.o `test -f 'lib/pcr.c' || echo '$(srcdir)/'`lib/pcr.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-pcr.Tpo lib/$(DEPDIR)/lib_libcommon_a-pcr.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/pcr.c' object='lib/lib_libcommon_a-pcr.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tool_rc.obj: lib/tool_rc.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tool_rc.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tool_rc.Tpo -c -o lib/libcommon_a-tool_rc.obj `if test -f 'lib/tool_rc.c'; then $(CYGPATH_W) 'lib/tool_rc.c'; else $(CYGPATH_W) '$(srcdir)/lib/tool_rc.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tool_rc.Tpo lib/$(DEPDIR)/libcommon_a-tool_rc.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tool_rc.c' object='lib/libcommon_a-tool_rc.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-pcr.o `test -f 'lib/pcr.c' || echo '$(srcdir)/'`lib/pcr.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tool_rc.obj `if test -f 'lib/tool_rc.c'; then $(CYGPATH_W) 'lib/tool_rc.c'; else $(CYGPATH_W) '$(srcdir)/lib/tool_rc.c'; fi`
 
-lib/lib_libcommon_a-pcr.obj: lib/pcr.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-pcr.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-pcr.Tpo -c -o lib/lib_libcommon_a-pcr.obj `if test -f 'lib/pcr.c'; then $(CYGPATH_W) 'lib/pcr.c'; else $(CYGPATH_W) '$(srcdir)/lib/pcr.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-pcr.Tpo lib/$(DEPDIR)/lib_libcommon_a-pcr.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/pcr.c' object='lib/lib_libcommon_a-pcr.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2.o: lib/tpm2.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2.Tpo -c -o lib/libcommon_a-tpm2.o `test -f 'lib/tpm2.c' || echo '$(srcdir)/'`lib/tpm2.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2.Tpo lib/$(DEPDIR)/libcommon_a-tpm2.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2.c' object='lib/libcommon_a-tpm2.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-pcr.obj `if test -f 'lib/pcr.c'; then $(CYGPATH_W) 'lib/pcr.c'; else $(CYGPATH_W) '$(srcdir)/lib/pcr.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2.o `test -f 'lib/tpm2.c' || echo '$(srcdir)/'`lib/tpm2.c
 
-lib/lib_libcommon_a-tool_rc.o: lib/tool_rc.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tool_rc.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tool_rc.Tpo -c -o lib/lib_libcommon_a-tool_rc.o `test -f 'lib/tool_rc.c' || echo '$(srcdir)/'`lib/tool_rc.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tool_rc.Tpo lib/$(DEPDIR)/lib_libcommon_a-tool_rc.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tool_rc.c' object='lib/lib_libcommon_a-tool_rc.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2.obj: lib/tpm2.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2.Tpo -c -o lib/libcommon_a-tpm2.obj `if test -f 'lib/tpm2.c'; then $(CYGPATH_W) 'lib/tpm2.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2.Tpo lib/$(DEPDIR)/libcommon_a-tpm2.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2.c' object='lib/libcommon_a-tpm2.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tool_rc.o `test -f 'lib/tool_rc.c' || echo '$(srcdir)/'`lib/tool_rc.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2.obj `if test -f 'lib/tpm2.c'; then $(CYGPATH_W) 'lib/tpm2.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2.c'; fi`
 
-lib/lib_libcommon_a-tool_rc.obj: lib/tool_rc.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tool_rc.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tool_rc.Tpo -c -o lib/lib_libcommon_a-tool_rc.obj `if test -f 'lib/tool_rc.c'; then $(CYGPATH_W) 'lib/tool_rc.c'; else $(CYGPATH_W) '$(srcdir)/lib/tool_rc.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tool_rc.Tpo lib/$(DEPDIR)/lib_libcommon_a-tool_rc.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tool_rc.c' object='lib/lib_libcommon_a-tool_rc.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_alg_util.o: lib/tpm2_alg_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_alg_util.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_alg_util.Tpo -c -o lib/libcommon_a-tpm2_alg_util.o `test -f 'lib/tpm2_alg_util.c' || echo '$(srcdir)/'`lib/tpm2_alg_util.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_alg_util.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_alg_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_alg_util.c' object='lib/libcommon_a-tpm2_alg_util.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tool_rc.obj `if test -f 'lib/tool_rc.c'; then $(CYGPATH_W) 'lib/tool_rc.c'; else $(CYGPATH_W) '$(srcdir)/lib/tool_rc.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_alg_util.o `test -f 'lib/tpm2_alg_util.c' || echo '$(srcdir)/'`lib/tpm2_alg_util.c
 
-lib/lib_libcommon_a-tpm2.o: lib/tpm2.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2.Tpo -c -o lib/lib_libcommon_a-tpm2.o `test -f 'lib/tpm2.c' || echo '$(srcdir)/'`lib/tpm2.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2.c' object='lib/lib_libcommon_a-tpm2.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_alg_util.obj: lib/tpm2_alg_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_alg_util.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_alg_util.Tpo -c -o lib/libcommon_a-tpm2_alg_util.obj `if test -f 'lib/tpm2_alg_util.c'; then $(CYGPATH_W) 'lib/tpm2_alg_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_alg_util.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_alg_util.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_alg_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_alg_util.c' object='lib/libcommon_a-tpm2_alg_util.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2.o `test -f 'lib/tpm2.c' || echo '$(srcdir)/'`lib/tpm2.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_alg_util.obj `if test -f 'lib/tpm2_alg_util.c'; then $(CYGPATH_W) 'lib/tpm2_alg_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_alg_util.c'; fi`
 
-lib/lib_libcommon_a-tpm2.obj: lib/tpm2.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2.Tpo -c -o lib/lib_libcommon_a-tpm2.obj `if test -f 'lib/tpm2.c'; then $(CYGPATH_W) 'lib/tpm2.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2.c' object='lib/lib_libcommon_a-tpm2.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_attr_util.o: lib/tpm2_attr_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_attr_util.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_attr_util.Tpo -c -o lib/libcommon_a-tpm2_attr_util.o `test -f 'lib/tpm2_attr_util.c' || echo '$(srcdir)/'`lib/tpm2_attr_util.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_attr_util.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_attr_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_attr_util.c' object='lib/libcommon_a-tpm2_attr_util.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2.obj `if test -f 'lib/tpm2.c'; then $(CYGPATH_W) 'lib/tpm2.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_attr_util.o `test -f 'lib/tpm2_attr_util.c' || echo '$(srcdir)/'`lib/tpm2_attr_util.c
 
-lib/lib_libcommon_a-tpm2_alg_util.o: lib/tpm2_alg_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_alg_util.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_alg_util.Tpo -c -o lib/lib_libcommon_a-tpm2_alg_util.o `test -f 'lib/tpm2_alg_util.c' || echo '$(srcdir)/'`lib/tpm2_alg_util.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_alg_util.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_alg_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_alg_util.c' object='lib/lib_libcommon_a-tpm2_alg_util.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_attr_util.obj: lib/tpm2_attr_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_attr_util.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_attr_util.Tpo -c -o lib/libcommon_a-tpm2_attr_util.obj `if test -f 'lib/tpm2_attr_util.c'; then $(CYGPATH_W) 'lib/tpm2_attr_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_attr_util.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_attr_util.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_attr_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_attr_util.c' object='lib/libcommon_a-tpm2_attr_util.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_alg_util.o `test -f 'lib/tpm2_alg_util.c' || echo '$(srcdir)/'`lib/tpm2_alg_util.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_attr_util.obj `if test -f 'lib/tpm2_attr_util.c'; then $(CYGPATH_W) 'lib/tpm2_attr_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_attr_util.c'; fi`
 
-lib/lib_libcommon_a-tpm2_alg_util.obj: lib/tpm2_alg_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_alg_util.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_alg_util.Tpo -c -o lib/lib_libcommon_a-tpm2_alg_util.obj `if test -f 'lib/tpm2_alg_util.c'; then $(CYGPATH_W) 'lib/tpm2_alg_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_alg_util.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_alg_util.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_alg_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_alg_util.c' object='lib/lib_libcommon_a-tpm2_alg_util.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_auth_util.o: lib/tpm2_auth_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_auth_util.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_auth_util.Tpo -c -o lib/libcommon_a-tpm2_auth_util.o `test -f 'lib/tpm2_auth_util.c' || echo '$(srcdir)/'`lib/tpm2_auth_util.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_auth_util.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_auth_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_auth_util.c' object='lib/libcommon_a-tpm2_auth_util.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_alg_util.obj `if test -f 'lib/tpm2_alg_util.c'; then $(CYGPATH_W) 'lib/tpm2_alg_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_alg_util.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_auth_util.o `test -f 'lib/tpm2_auth_util.c' || echo '$(srcdir)/'`lib/tpm2_auth_util.c
 
-lib/lib_libcommon_a-tpm2_attr_util.o: lib/tpm2_attr_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_attr_util.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_attr_util.Tpo -c -o lib/lib_libcommon_a-tpm2_attr_util.o `test -f 'lib/tpm2_attr_util.c' || echo '$(srcdir)/'`lib/tpm2_attr_util.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_attr_util.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_attr_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_attr_util.c' object='lib/lib_libcommon_a-tpm2_attr_util.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_auth_util.obj: lib/tpm2_auth_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_auth_util.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_auth_util.Tpo -c -o lib/libcommon_a-tpm2_auth_util.obj `if test -f 'lib/tpm2_auth_util.c'; then $(CYGPATH_W) 'lib/tpm2_auth_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_auth_util.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_auth_util.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_auth_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_auth_util.c' object='lib/libcommon_a-tpm2_auth_util.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_attr_util.o `test -f 'lib/tpm2_attr_util.c' || echo '$(srcdir)/'`lib/tpm2_attr_util.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_auth_util.obj `if test -f 'lib/tpm2_auth_util.c'; then $(CYGPATH_W) 'lib/tpm2_auth_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_auth_util.c'; fi`
 
-lib/lib_libcommon_a-tpm2_attr_util.obj: lib/tpm2_attr_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_attr_util.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_attr_util.Tpo -c -o lib/lib_libcommon_a-tpm2_attr_util.obj `if test -f 'lib/tpm2_attr_util.c'; then $(CYGPATH_W) 'lib/tpm2_attr_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_attr_util.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_attr_util.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_attr_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_attr_util.c' object='lib/lib_libcommon_a-tpm2_attr_util.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_capability.o: lib/tpm2_capability.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_capability.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_capability.Tpo -c -o lib/libcommon_a-tpm2_capability.o `test -f 'lib/tpm2_capability.c' || echo '$(srcdir)/'`lib/tpm2_capability.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_capability.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_capability.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_capability.c' object='lib/libcommon_a-tpm2_capability.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_attr_util.obj `if test -f 'lib/tpm2_attr_util.c'; then $(CYGPATH_W) 'lib/tpm2_attr_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_attr_util.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_capability.o `test -f 'lib/tpm2_capability.c' || echo '$(srcdir)/'`lib/tpm2_capability.c
 
-lib/lib_libcommon_a-tpm2_auth_util.o: lib/tpm2_auth_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_auth_util.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_auth_util.Tpo -c -o lib/lib_libcommon_a-tpm2_auth_util.o `test -f 'lib/tpm2_auth_util.c' || echo '$(srcdir)/'`lib/tpm2_auth_util.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_auth_util.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_auth_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_auth_util.c' object='lib/lib_libcommon_a-tpm2_auth_util.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_capability.obj: lib/tpm2_capability.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_capability.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_capability.Tpo -c -o lib/libcommon_a-tpm2_capability.obj `if test -f 'lib/tpm2_capability.c'; then $(CYGPATH_W) 'lib/tpm2_capability.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_capability.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_capability.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_capability.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_capability.c' object='lib/libcommon_a-tpm2_capability.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_auth_util.o `test -f 'lib/tpm2_auth_util.c' || echo '$(srcdir)/'`lib/tpm2_auth_util.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_capability.obj `if test -f 'lib/tpm2_capability.c'; then $(CYGPATH_W) 'lib/tpm2_capability.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_capability.c'; fi`
 
-lib/lib_libcommon_a-tpm2_auth_util.obj: lib/tpm2_auth_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_auth_util.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_auth_util.Tpo -c -o lib/lib_libcommon_a-tpm2_auth_util.obj `if test -f 'lib/tpm2_auth_util.c'; then $(CYGPATH_W) 'lib/tpm2_auth_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_auth_util.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_auth_util.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_auth_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_auth_util.c' object='lib/lib_libcommon_a-tpm2_auth_util.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_cc_util.o: lib/tpm2_cc_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_cc_util.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_cc_util.Tpo -c -o lib/libcommon_a-tpm2_cc_util.o `test -f 'lib/tpm2_cc_util.c' || echo '$(srcdir)/'`lib/tpm2_cc_util.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_cc_util.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_cc_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_cc_util.c' object='lib/libcommon_a-tpm2_cc_util.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_auth_util.obj `if test -f 'lib/tpm2_auth_util.c'; then $(CYGPATH_W) 'lib/tpm2_auth_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_auth_util.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_cc_util.o `test -f 'lib/tpm2_cc_util.c' || echo '$(srcdir)/'`lib/tpm2_cc_util.c
 
-lib/lib_libcommon_a-tpm2_capability.o: lib/tpm2_capability.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_capability.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_capability.Tpo -c -o lib/lib_libcommon_a-tpm2_capability.o `test -f 'lib/tpm2_capability.c' || echo '$(srcdir)/'`lib/tpm2_capability.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_capability.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_capability.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_capability.c' object='lib/lib_libcommon_a-tpm2_capability.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_cc_util.obj: lib/tpm2_cc_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_cc_util.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_cc_util.Tpo -c -o lib/libcommon_a-tpm2_cc_util.obj `if test -f 'lib/tpm2_cc_util.c'; then $(CYGPATH_W) 'lib/tpm2_cc_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_cc_util.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_cc_util.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_cc_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_cc_util.c' object='lib/libcommon_a-tpm2_cc_util.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_capability.o `test -f 'lib/tpm2_capability.c' || echo '$(srcdir)/'`lib/tpm2_capability.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_cc_util.obj `if test -f 'lib/tpm2_cc_util.c'; then $(CYGPATH_W) 'lib/tpm2_cc_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_cc_util.c'; fi`
 
-lib/lib_libcommon_a-tpm2_capability.obj: lib/tpm2_capability.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_capability.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_capability.Tpo -c -o lib/lib_libcommon_a-tpm2_capability.obj `if test -f 'lib/tpm2_capability.c'; then $(CYGPATH_W) 'lib/tpm2_capability.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_capability.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_capability.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_capability.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_capability.c' object='lib/lib_libcommon_a-tpm2_capability.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_convert.o: lib/tpm2_convert.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_convert.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_convert.Tpo -c -o lib/libcommon_a-tpm2_convert.o `test -f 'lib/tpm2_convert.c' || echo '$(srcdir)/'`lib/tpm2_convert.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_convert.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_convert.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_convert.c' object='lib/libcommon_a-tpm2_convert.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_capability.obj `if test -f 'lib/tpm2_capability.c'; then $(CYGPATH_W) 'lib/tpm2_capability.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_capability.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_convert.o `test -f 'lib/tpm2_convert.c' || echo '$(srcdir)/'`lib/tpm2_convert.c
 
-lib/lib_libcommon_a-tpm2_cc_util.o: lib/tpm2_cc_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_cc_util.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_cc_util.Tpo -c -o lib/lib_libcommon_a-tpm2_cc_util.o `test -f 'lib/tpm2_cc_util.c' || echo '$(srcdir)/'`lib/tpm2_cc_util.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_cc_util.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_cc_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_cc_util.c' object='lib/lib_libcommon_a-tpm2_cc_util.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_convert.obj: lib/tpm2_convert.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_convert.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_convert.Tpo -c -o lib/libcommon_a-tpm2_convert.obj `if test -f 'lib/tpm2_convert.c'; then $(CYGPATH_W) 'lib/tpm2_convert.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_convert.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_convert.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_convert.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_convert.c' object='lib/libcommon_a-tpm2_convert.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_cc_util.o `test -f 'lib/tpm2_cc_util.c' || echo '$(srcdir)/'`lib/tpm2_cc_util.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_convert.obj `if test -f 'lib/tpm2_convert.c'; then $(CYGPATH_W) 'lib/tpm2_convert.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_convert.c'; fi`
 
-lib/lib_libcommon_a-tpm2_cc_util.obj: lib/tpm2_cc_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_cc_util.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_cc_util.Tpo -c -o lib/lib_libcommon_a-tpm2_cc_util.obj `if test -f 'lib/tpm2_cc_util.c'; then $(CYGPATH_W) 'lib/tpm2_cc_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_cc_util.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_cc_util.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_cc_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_cc_util.c' object='lib/lib_libcommon_a-tpm2_cc_util.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_ctx_mgmt.o: lib/tpm2_ctx_mgmt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_ctx_mgmt.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_ctx_mgmt.Tpo -c -o lib/libcommon_a-tpm2_ctx_mgmt.o `test -f 'lib/tpm2_ctx_mgmt.c' || echo '$(srcdir)/'`lib/tpm2_ctx_mgmt.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_ctx_mgmt.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_ctx_mgmt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_ctx_mgmt.c' object='lib/libcommon_a-tpm2_ctx_mgmt.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_cc_util.obj `if test -f 'lib/tpm2_cc_util.c'; then $(CYGPATH_W) 'lib/tpm2_cc_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_cc_util.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_ctx_mgmt.o `test -f 'lib/tpm2_ctx_mgmt.c' || echo '$(srcdir)/'`lib/tpm2_ctx_mgmt.c
 
-lib/lib_libcommon_a-tpm2_convert.o: lib/tpm2_convert.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_convert.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_convert.Tpo -c -o lib/lib_libcommon_a-tpm2_convert.o `test -f 'lib/tpm2_convert.c' || echo '$(srcdir)/'`lib/tpm2_convert.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_convert.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_convert.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_convert.c' object='lib/lib_libcommon_a-tpm2_convert.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_ctx_mgmt.obj: lib/tpm2_ctx_mgmt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_ctx_mgmt.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_ctx_mgmt.Tpo -c -o lib/libcommon_a-tpm2_ctx_mgmt.obj `if test -f 'lib/tpm2_ctx_mgmt.c'; then $(CYGPATH_W) 'lib/tpm2_ctx_mgmt.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_ctx_mgmt.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_ctx_mgmt.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_ctx_mgmt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_ctx_mgmt.c' object='lib/libcommon_a-tpm2_ctx_mgmt.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_convert.o `test -f 'lib/tpm2_convert.c' || echo '$(srcdir)/'`lib/tpm2_convert.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_ctx_mgmt.obj `if test -f 'lib/tpm2_ctx_mgmt.c'; then $(CYGPATH_W) 'lib/tpm2_ctx_mgmt.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_ctx_mgmt.c'; fi`
 
-lib/lib_libcommon_a-tpm2_convert.obj: lib/tpm2_convert.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_convert.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_convert.Tpo -c -o lib/lib_libcommon_a-tpm2_convert.obj `if test -f 'lib/tpm2_convert.c'; then $(CYGPATH_W) 'lib/tpm2_convert.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_convert.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_convert.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_convert.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_convert.c' object='lib/lib_libcommon_a-tpm2_convert.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_errata.o: lib/tpm2_errata.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_errata.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_errata.Tpo -c -o lib/libcommon_a-tpm2_errata.o `test -f 'lib/tpm2_errata.c' || echo '$(srcdir)/'`lib/tpm2_errata.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_errata.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_errata.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_errata.c' object='lib/libcommon_a-tpm2_errata.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_convert.obj `if test -f 'lib/tpm2_convert.c'; then $(CYGPATH_W) 'lib/tpm2_convert.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_convert.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_errata.o `test -f 'lib/tpm2_errata.c' || echo '$(srcdir)/'`lib/tpm2_errata.c
 
-lib/lib_libcommon_a-tpm2_ctx_mgmt.o: lib/tpm2_ctx_mgmt.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_ctx_mgmt.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_ctx_mgmt.Tpo -c -o lib/lib_libcommon_a-tpm2_ctx_mgmt.o `test -f 'lib/tpm2_ctx_mgmt.c' || echo '$(srcdir)/'`lib/tpm2_ctx_mgmt.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_ctx_mgmt.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_ctx_mgmt.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_ctx_mgmt.c' object='lib/lib_libcommon_a-tpm2_ctx_mgmt.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_errata.obj: lib/tpm2_errata.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_errata.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_errata.Tpo -c -o lib/libcommon_a-tpm2_errata.obj `if test -f 'lib/tpm2_errata.c'; then $(CYGPATH_W) 'lib/tpm2_errata.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_errata.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_errata.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_errata.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_errata.c' object='lib/libcommon_a-tpm2_errata.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_ctx_mgmt.o `test -f 'lib/tpm2_ctx_mgmt.c' || echo '$(srcdir)/'`lib/tpm2_ctx_mgmt.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_errata.obj `if test -f 'lib/tpm2_errata.c'; then $(CYGPATH_W) 'lib/tpm2_errata.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_errata.c'; fi`
 
-lib/lib_libcommon_a-tpm2_ctx_mgmt.obj: lib/tpm2_ctx_mgmt.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_ctx_mgmt.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_ctx_mgmt.Tpo -c -o lib/lib_libcommon_a-tpm2_ctx_mgmt.obj `if test -f 'lib/tpm2_ctx_mgmt.c'; then $(CYGPATH_W) 'lib/tpm2_ctx_mgmt.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_ctx_mgmt.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_ctx_mgmt.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_ctx_mgmt.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_ctx_mgmt.c' object='lib/lib_libcommon_a-tpm2_ctx_mgmt.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_eventlog.o: lib/tpm2_eventlog.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_eventlog.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_eventlog.Tpo -c -o lib/libcommon_a-tpm2_eventlog.o `test -f 'lib/tpm2_eventlog.c' || echo '$(srcdir)/'`lib/tpm2_eventlog.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_eventlog.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_eventlog.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_eventlog.c' object='lib/libcommon_a-tpm2_eventlog.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_ctx_mgmt.obj `if test -f 'lib/tpm2_ctx_mgmt.c'; then $(CYGPATH_W) 'lib/tpm2_ctx_mgmt.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_ctx_mgmt.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_eventlog.o `test -f 'lib/tpm2_eventlog.c' || echo '$(srcdir)/'`lib/tpm2_eventlog.c
 
-lib/lib_libcommon_a-tpm2_errata.o: lib/tpm2_errata.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_errata.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_errata.Tpo -c -o lib/lib_libcommon_a-tpm2_errata.o `test -f 'lib/tpm2_errata.c' || echo '$(srcdir)/'`lib/tpm2_errata.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_errata.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_errata.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_errata.c' object='lib/lib_libcommon_a-tpm2_errata.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_eventlog.obj: lib/tpm2_eventlog.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_eventlog.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_eventlog.Tpo -c -o lib/libcommon_a-tpm2_eventlog.obj `if test -f 'lib/tpm2_eventlog.c'; then $(CYGPATH_W) 'lib/tpm2_eventlog.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_eventlog.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_eventlog.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_eventlog.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_eventlog.c' object='lib/libcommon_a-tpm2_eventlog.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_errata.o `test -f 'lib/tpm2_errata.c' || echo '$(srcdir)/'`lib/tpm2_errata.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_eventlog.obj `if test -f 'lib/tpm2_eventlog.c'; then $(CYGPATH_W) 'lib/tpm2_eventlog.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_eventlog.c'; fi`
 
-lib/lib_libcommon_a-tpm2_errata.obj: lib/tpm2_errata.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_errata.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_errata.Tpo -c -o lib/lib_libcommon_a-tpm2_errata.obj `if test -f 'lib/tpm2_errata.c'; then $(CYGPATH_W) 'lib/tpm2_errata.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_errata.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_errata.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_errata.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_errata.c' object='lib/lib_libcommon_a-tpm2_errata.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_eventlog_yaml.o: lib/tpm2_eventlog_yaml.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_eventlog_yaml.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_eventlog_yaml.Tpo -c -o lib/libcommon_a-tpm2_eventlog_yaml.o `test -f 'lib/tpm2_eventlog_yaml.c' || echo '$(srcdir)/'`lib/tpm2_eventlog_yaml.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_eventlog_yaml.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_eventlog_yaml.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_eventlog_yaml.c' object='lib/libcommon_a-tpm2_eventlog_yaml.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_errata.obj `if test -f 'lib/tpm2_errata.c'; then $(CYGPATH_W) 'lib/tpm2_errata.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_errata.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_eventlog_yaml.o `test -f 'lib/tpm2_eventlog_yaml.c' || echo '$(srcdir)/'`lib/tpm2_eventlog_yaml.c
 
-lib/lib_libcommon_a-tpm2_eventlog.o: lib/tpm2_eventlog.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_eventlog.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog.Tpo -c -o lib/lib_libcommon_a-tpm2_eventlog.o `test -f 'lib/tpm2_eventlog.c' || echo '$(srcdir)/'`lib/tpm2_eventlog.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_eventlog.c' object='lib/lib_libcommon_a-tpm2_eventlog.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_eventlog_yaml.obj: lib/tpm2_eventlog_yaml.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_eventlog_yaml.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_eventlog_yaml.Tpo -c -o lib/libcommon_a-tpm2_eventlog_yaml.obj `if test -f 'lib/tpm2_eventlog_yaml.c'; then $(CYGPATH_W) 'lib/tpm2_eventlog_yaml.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_eventlog_yaml.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_eventlog_yaml.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_eventlog_yaml.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_eventlog_yaml.c' object='lib/libcommon_a-tpm2_eventlog_yaml.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_eventlog.o `test -f 'lib/tpm2_eventlog.c' || echo '$(srcdir)/'`lib/tpm2_eventlog.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_eventlog_yaml.obj `if test -f 'lib/tpm2_eventlog_yaml.c'; then $(CYGPATH_W) 'lib/tpm2_eventlog_yaml.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_eventlog_yaml.c'; fi`
 
-lib/lib_libcommon_a-tpm2_eventlog.obj: lib/tpm2_eventlog.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_eventlog.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog.Tpo -c -o lib/lib_libcommon_a-tpm2_eventlog.obj `if test -f 'lib/tpm2_eventlog.c'; then $(CYGPATH_W) 'lib/tpm2_eventlog.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_eventlog.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_eventlog.c' object='lib/lib_libcommon_a-tpm2_eventlog.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_hash.o: lib/tpm2_hash.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_hash.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_hash.Tpo -c -o lib/libcommon_a-tpm2_hash.o `test -f 'lib/tpm2_hash.c' || echo '$(srcdir)/'`lib/tpm2_hash.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_hash.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_hash.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_hash.c' object='lib/libcommon_a-tpm2_hash.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_eventlog.obj `if test -f 'lib/tpm2_eventlog.c'; then $(CYGPATH_W) 'lib/tpm2_eventlog.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_eventlog.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_hash.o `test -f 'lib/tpm2_hash.c' || echo '$(srcdir)/'`lib/tpm2_hash.c
 
-lib/lib_libcommon_a-tpm2_eventlog_yaml.o: lib/tpm2_eventlog_yaml.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_eventlog_yaml.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog_yaml.Tpo -c -o lib/lib_libcommon_a-tpm2_eventlog_yaml.o `test -f 'lib/tpm2_eventlog_yaml.c' || echo '$(srcdir)/'`lib/tpm2_eventlog_yaml.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog_yaml.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog_yaml.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_eventlog_yaml.c' object='lib/lib_libcommon_a-tpm2_eventlog_yaml.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_hash.obj: lib/tpm2_hash.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_hash.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_hash.Tpo -c -o lib/libcommon_a-tpm2_hash.obj `if test -f 'lib/tpm2_hash.c'; then $(CYGPATH_W) 'lib/tpm2_hash.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_hash.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_hash.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_hash.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_hash.c' object='lib/libcommon_a-tpm2_hash.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_eventlog_yaml.o `test -f 'lib/tpm2_eventlog_yaml.c' || echo '$(srcdir)/'`lib/tpm2_eventlog_yaml.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_hash.obj `if test -f 'lib/tpm2_hash.c'; then $(CYGPATH_W) 'lib/tpm2_hash.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_hash.c'; fi`
 
-lib/lib_libcommon_a-tpm2_eventlog_yaml.obj: lib/tpm2_eventlog_yaml.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_eventlog_yaml.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog_yaml.Tpo -c -o lib/lib_libcommon_a-tpm2_eventlog_yaml.obj `if test -f 'lib/tpm2_eventlog_yaml.c'; then $(CYGPATH_W) 'lib/tpm2_eventlog_yaml.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_eventlog_yaml.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog_yaml.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_eventlog_yaml.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_eventlog_yaml.c' object='lib/lib_libcommon_a-tpm2_eventlog_yaml.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_hierarchy.o: lib/tpm2_hierarchy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_hierarchy.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_hierarchy.Tpo -c -o lib/libcommon_a-tpm2_hierarchy.o `test -f 'lib/tpm2_hierarchy.c' || echo '$(srcdir)/'`lib/tpm2_hierarchy.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_hierarchy.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_hierarchy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_hierarchy.c' object='lib/libcommon_a-tpm2_hierarchy.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_eventlog_yaml.obj `if test -f 'lib/tpm2_eventlog_yaml.c'; then $(CYGPATH_W) 'lib/tpm2_eventlog_yaml.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_eventlog_yaml.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_hierarchy.o `test -f 'lib/tpm2_hierarchy.c' || echo '$(srcdir)/'`lib/tpm2_hierarchy.c
 
-lib/lib_libcommon_a-tpm2_hash.o: lib/tpm2_hash.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_hash.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_hash.Tpo -c -o lib/lib_libcommon_a-tpm2_hash.o `test -f 'lib/tpm2_hash.c' || echo '$(srcdir)/'`lib/tpm2_hash.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_hash.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_hash.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_hash.c' object='lib/lib_libcommon_a-tpm2_hash.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_hierarchy.obj: lib/tpm2_hierarchy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_hierarchy.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_hierarchy.Tpo -c -o lib/libcommon_a-tpm2_hierarchy.obj `if test -f 'lib/tpm2_hierarchy.c'; then $(CYGPATH_W) 'lib/tpm2_hierarchy.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_hierarchy.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_hierarchy.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_hierarchy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_hierarchy.c' object='lib/libcommon_a-tpm2_hierarchy.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_hash.o `test -f 'lib/tpm2_hash.c' || echo '$(srcdir)/'`lib/tpm2_hash.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_hierarchy.obj `if test -f 'lib/tpm2_hierarchy.c'; then $(CYGPATH_W) 'lib/tpm2_hierarchy.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_hierarchy.c'; fi`
 
-lib/lib_libcommon_a-tpm2_hash.obj: lib/tpm2_hash.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_hash.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_hash.Tpo -c -o lib/lib_libcommon_a-tpm2_hash.obj `if test -f 'lib/tpm2_hash.c'; then $(CYGPATH_W) 'lib/tpm2_hash.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_hash.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_hash.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_hash.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_hash.c' object='lib/lib_libcommon_a-tpm2_hash.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_identity_util.o: lib/tpm2_identity_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_identity_util.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_identity_util.Tpo -c -o lib/libcommon_a-tpm2_identity_util.o `test -f 'lib/tpm2_identity_util.c' || echo '$(srcdir)/'`lib/tpm2_identity_util.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_identity_util.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_identity_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_identity_util.c' object='lib/libcommon_a-tpm2_identity_util.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_hash.obj `if test -f 'lib/tpm2_hash.c'; then $(CYGPATH_W) 'lib/tpm2_hash.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_hash.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_identity_util.o `test -f 'lib/tpm2_identity_util.c' || echo '$(srcdir)/'`lib/tpm2_identity_util.c
 
-lib/lib_libcommon_a-tpm2_hierarchy.o: lib/tpm2_hierarchy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_hierarchy.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_hierarchy.Tpo -c -o lib/lib_libcommon_a-tpm2_hierarchy.o `test -f 'lib/tpm2_hierarchy.c' || echo '$(srcdir)/'`lib/tpm2_hierarchy.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_hierarchy.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_hierarchy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_hierarchy.c' object='lib/lib_libcommon_a-tpm2_hierarchy.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_identity_util.obj: lib/tpm2_identity_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_identity_util.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_identity_util.Tpo -c -o lib/libcommon_a-tpm2_identity_util.obj `if test -f 'lib/tpm2_identity_util.c'; then $(CYGPATH_W) 'lib/tpm2_identity_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_identity_util.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_identity_util.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_identity_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_identity_util.c' object='lib/libcommon_a-tpm2_identity_util.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_hierarchy.o `test -f 'lib/tpm2_hierarchy.c' || echo '$(srcdir)/'`lib/tpm2_hierarchy.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_identity_util.obj `if test -f 'lib/tpm2_identity_util.c'; then $(CYGPATH_W) 'lib/tpm2_identity_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_identity_util.c'; fi`
 
-lib/lib_libcommon_a-tpm2_hierarchy.obj: lib/tpm2_hierarchy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_hierarchy.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_hierarchy.Tpo -c -o lib/lib_libcommon_a-tpm2_hierarchy.obj `if test -f 'lib/tpm2_hierarchy.c'; then $(CYGPATH_W) 'lib/tpm2_hierarchy.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_hierarchy.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_hierarchy.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_hierarchy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_hierarchy.c' object='lib/lib_libcommon_a-tpm2_hierarchy.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_kdfa.o: lib/tpm2_kdfa.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_kdfa.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_kdfa.Tpo -c -o lib/libcommon_a-tpm2_kdfa.o `test -f 'lib/tpm2_kdfa.c' || echo '$(srcdir)/'`lib/tpm2_kdfa.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_kdfa.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_kdfa.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_kdfa.c' object='lib/libcommon_a-tpm2_kdfa.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_hierarchy.obj `if test -f 'lib/tpm2_hierarchy.c'; then $(CYGPATH_W) 'lib/tpm2_hierarchy.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_hierarchy.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_kdfa.o `test -f 'lib/tpm2_kdfa.c' || echo '$(srcdir)/'`lib/tpm2_kdfa.c
 
-lib/lib_libcommon_a-tpm2_identity_util.o: lib/tpm2_identity_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_identity_util.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_identity_util.Tpo -c -o lib/lib_libcommon_a-tpm2_identity_util.o `test -f 'lib/tpm2_identity_util.c' || echo '$(srcdir)/'`lib/tpm2_identity_util.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_identity_util.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_identity_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_identity_util.c' object='lib/lib_libcommon_a-tpm2_identity_util.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_kdfa.obj: lib/tpm2_kdfa.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_kdfa.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_kdfa.Tpo -c -o lib/libcommon_a-tpm2_kdfa.obj `if test -f 'lib/tpm2_kdfa.c'; then $(CYGPATH_W) 'lib/tpm2_kdfa.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_kdfa.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_kdfa.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_kdfa.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_kdfa.c' object='lib/libcommon_a-tpm2_kdfa.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_identity_util.o `test -f 'lib/tpm2_identity_util.c' || echo '$(srcdir)/'`lib/tpm2_identity_util.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_kdfa.obj `if test -f 'lib/tpm2_kdfa.c'; then $(CYGPATH_W) 'lib/tpm2_kdfa.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_kdfa.c'; fi`
 
-lib/lib_libcommon_a-tpm2_identity_util.obj: lib/tpm2_identity_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_identity_util.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_identity_util.Tpo -c -o lib/lib_libcommon_a-tpm2_identity_util.obj `if test -f 'lib/tpm2_identity_util.c'; then $(CYGPATH_W) 'lib/tpm2_identity_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_identity_util.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_identity_util.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_identity_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_identity_util.c' object='lib/lib_libcommon_a-tpm2_identity_util.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_kdfe.o: lib/tpm2_kdfe.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_kdfe.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_kdfe.Tpo -c -o lib/libcommon_a-tpm2_kdfe.o `test -f 'lib/tpm2_kdfe.c' || echo '$(srcdir)/'`lib/tpm2_kdfe.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_kdfe.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_kdfe.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_kdfe.c' object='lib/libcommon_a-tpm2_kdfe.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_identity_util.obj `if test -f 'lib/tpm2_identity_util.c'; then $(CYGPATH_W) 'lib/tpm2_identity_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_identity_util.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_kdfe.o `test -f 'lib/tpm2_kdfe.c' || echo '$(srcdir)/'`lib/tpm2_kdfe.c
 
-lib/lib_libcommon_a-tpm2_kdfa.o: lib/tpm2_kdfa.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_kdfa.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfa.Tpo -c -o lib/lib_libcommon_a-tpm2_kdfa.o `test -f 'lib/tpm2_kdfa.c' || echo '$(srcdir)/'`lib/tpm2_kdfa.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfa.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfa.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_kdfa.c' object='lib/lib_libcommon_a-tpm2_kdfa.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_kdfe.obj: lib/tpm2_kdfe.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_kdfe.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_kdfe.Tpo -c -o lib/libcommon_a-tpm2_kdfe.obj `if test -f 'lib/tpm2_kdfe.c'; then $(CYGPATH_W) 'lib/tpm2_kdfe.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_kdfe.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_kdfe.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_kdfe.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_kdfe.c' object='lib/libcommon_a-tpm2_kdfe.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_kdfa.o `test -f 'lib/tpm2_kdfa.c' || echo '$(srcdir)/'`lib/tpm2_kdfa.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_kdfe.obj `if test -f 'lib/tpm2_kdfe.c'; then $(CYGPATH_W) 'lib/tpm2_kdfe.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_kdfe.c'; fi`
 
-lib/lib_libcommon_a-tpm2_kdfa.obj: lib/tpm2_kdfa.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_kdfa.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfa.Tpo -c -o lib/lib_libcommon_a-tpm2_kdfa.obj `if test -f 'lib/tpm2_kdfa.c'; then $(CYGPATH_W) 'lib/tpm2_kdfa.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_kdfa.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfa.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfa.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_kdfa.c' object='lib/lib_libcommon_a-tpm2_kdfa.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_openssl.o: lib/tpm2_openssl.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_openssl.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_openssl.Tpo -c -o lib/libcommon_a-tpm2_openssl.o `test -f 'lib/tpm2_openssl.c' || echo '$(srcdir)/'`lib/tpm2_openssl.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_openssl.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_openssl.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_openssl.c' object='lib/libcommon_a-tpm2_openssl.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_kdfa.obj `if test -f 'lib/tpm2_kdfa.c'; then $(CYGPATH_W) 'lib/tpm2_kdfa.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_kdfa.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_openssl.o `test -f 'lib/tpm2_openssl.c' || echo '$(srcdir)/'`lib/tpm2_openssl.c
 
-lib/lib_libcommon_a-tpm2_kdfe.o: lib/tpm2_kdfe.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_kdfe.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfe.Tpo -c -o lib/lib_libcommon_a-tpm2_kdfe.o `test -f 'lib/tpm2_kdfe.c' || echo '$(srcdir)/'`lib/tpm2_kdfe.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfe.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfe.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_kdfe.c' object='lib/lib_libcommon_a-tpm2_kdfe.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_openssl.obj: lib/tpm2_openssl.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_openssl.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_openssl.Tpo -c -o lib/libcommon_a-tpm2_openssl.obj `if test -f 'lib/tpm2_openssl.c'; then $(CYGPATH_W) 'lib/tpm2_openssl.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_openssl.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_openssl.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_openssl.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_openssl.c' object='lib/libcommon_a-tpm2_openssl.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_kdfe.o `test -f 'lib/tpm2_kdfe.c' || echo '$(srcdir)/'`lib/tpm2_kdfe.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_openssl.obj `if test -f 'lib/tpm2_openssl.c'; then $(CYGPATH_W) 'lib/tpm2_openssl.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_openssl.c'; fi`
 
-lib/lib_libcommon_a-tpm2_kdfe.obj: lib/tpm2_kdfe.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_kdfe.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfe.Tpo -c -o lib/lib_libcommon_a-tpm2_kdfe.obj `if test -f 'lib/tpm2_kdfe.c'; then $(CYGPATH_W) 'lib/tpm2_kdfe.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_kdfe.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfe.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_kdfe.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_kdfe.c' object='lib/lib_libcommon_a-tpm2_kdfe.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_options.o: lib/tpm2_options.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_options.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_options.Tpo -c -o lib/libcommon_a-tpm2_options.o `test -f 'lib/tpm2_options.c' || echo '$(srcdir)/'`lib/tpm2_options.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_options.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_options.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_options.c' object='lib/libcommon_a-tpm2_options.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_kdfe.obj `if test -f 'lib/tpm2_kdfe.c'; then $(CYGPATH_W) 'lib/tpm2_kdfe.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_kdfe.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_options.o `test -f 'lib/tpm2_options.c' || echo '$(srcdir)/'`lib/tpm2_options.c
 
-lib/lib_libcommon_a-tpm2_openssl.o: lib/tpm2_openssl.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_openssl.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_openssl.Tpo -c -o lib/lib_libcommon_a-tpm2_openssl.o `test -f 'lib/tpm2_openssl.c' || echo '$(srcdir)/'`lib/tpm2_openssl.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_openssl.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_openssl.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_openssl.c' object='lib/lib_libcommon_a-tpm2_openssl.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_options.obj: lib/tpm2_options.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_options.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_options.Tpo -c -o lib/libcommon_a-tpm2_options.obj `if test -f 'lib/tpm2_options.c'; then $(CYGPATH_W) 'lib/tpm2_options.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_options.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_options.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_options.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_options.c' object='lib/libcommon_a-tpm2_options.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_openssl.o `test -f 'lib/tpm2_openssl.c' || echo '$(srcdir)/'`lib/tpm2_openssl.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_options.obj `if test -f 'lib/tpm2_options.c'; then $(CYGPATH_W) 'lib/tpm2_options.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_options.c'; fi`
 
-lib/lib_libcommon_a-tpm2_openssl.obj: lib/tpm2_openssl.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_openssl.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_openssl.Tpo -c -o lib/lib_libcommon_a-tpm2_openssl.obj `if test -f 'lib/tpm2_openssl.c'; then $(CYGPATH_W) 'lib/tpm2_openssl.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_openssl.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_openssl.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_openssl.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_openssl.c' object='lib/lib_libcommon_a-tpm2_openssl.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_policy.o: lib/tpm2_policy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_policy.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_policy.Tpo -c -o lib/libcommon_a-tpm2_policy.o `test -f 'lib/tpm2_policy.c' || echo '$(srcdir)/'`lib/tpm2_policy.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_policy.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_policy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_policy.c' object='lib/libcommon_a-tpm2_policy.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_openssl.obj `if test -f 'lib/tpm2_openssl.c'; then $(CYGPATH_W) 'lib/tpm2_openssl.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_openssl.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_policy.o `test -f 'lib/tpm2_policy.c' || echo '$(srcdir)/'`lib/tpm2_policy.c
 
-lib/lib_libcommon_a-tpm2_options.o: lib/tpm2_options.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_options.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_options.Tpo -c -o lib/lib_libcommon_a-tpm2_options.o `test -f 'lib/tpm2_options.c' || echo '$(srcdir)/'`lib/tpm2_options.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_options.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_options.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_options.c' object='lib/lib_libcommon_a-tpm2_options.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_policy.obj: lib/tpm2_policy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_policy.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_policy.Tpo -c -o lib/libcommon_a-tpm2_policy.obj `if test -f 'lib/tpm2_policy.c'; then $(CYGPATH_W) 'lib/tpm2_policy.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_policy.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_policy.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_policy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_policy.c' object='lib/libcommon_a-tpm2_policy.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_options.o `test -f 'lib/tpm2_options.c' || echo '$(srcdir)/'`lib/tpm2_options.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_policy.obj `if test -f 'lib/tpm2_policy.c'; then $(CYGPATH_W) 'lib/tpm2_policy.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_policy.c'; fi`
 
-lib/lib_libcommon_a-tpm2_options.obj: lib/tpm2_options.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_options.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_options.Tpo -c -o lib/lib_libcommon_a-tpm2_options.obj `if test -f 'lib/tpm2_options.c'; then $(CYGPATH_W) 'lib/tpm2_options.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_options.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_options.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_options.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_options.c' object='lib/lib_libcommon_a-tpm2_options.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_session.o: lib/tpm2_session.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_session.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_session.Tpo -c -o lib/libcommon_a-tpm2_session.o `test -f 'lib/tpm2_session.c' || echo '$(srcdir)/'`lib/tpm2_session.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_session.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_session.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_session.c' object='lib/libcommon_a-tpm2_session.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_options.obj `if test -f 'lib/tpm2_options.c'; then $(CYGPATH_W) 'lib/tpm2_options.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_options.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_session.o `test -f 'lib/tpm2_session.c' || echo '$(srcdir)/'`lib/tpm2_session.c
 
-lib/lib_libcommon_a-tpm2_policy.o: lib/tpm2_policy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_policy.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_policy.Tpo -c -o lib/lib_libcommon_a-tpm2_policy.o `test -f 'lib/tpm2_policy.c' || echo '$(srcdir)/'`lib/tpm2_policy.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_policy.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_policy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_policy.c' object='lib/lib_libcommon_a-tpm2_policy.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_session.obj: lib/tpm2_session.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_session.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_session.Tpo -c -o lib/libcommon_a-tpm2_session.obj `if test -f 'lib/tpm2_session.c'; then $(CYGPATH_W) 'lib/tpm2_session.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_session.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_session.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_session.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_session.c' object='lib/libcommon_a-tpm2_session.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_policy.o `test -f 'lib/tpm2_policy.c' || echo '$(srcdir)/'`lib/tpm2_policy.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_session.obj `if test -f 'lib/tpm2_session.c'; then $(CYGPATH_W) 'lib/tpm2_session.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_session.c'; fi`
 
-lib/lib_libcommon_a-tpm2_policy.obj: lib/tpm2_policy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_policy.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_policy.Tpo -c -o lib/lib_libcommon_a-tpm2_policy.obj `if test -f 'lib/tpm2_policy.c'; then $(CYGPATH_W) 'lib/tpm2_policy.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_policy.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_policy.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_policy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_policy.c' object='lib/lib_libcommon_a-tpm2_policy.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_tool_output.o: lib/tpm2_tool_output.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_tool_output.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_tool_output.Tpo -c -o lib/libcommon_a-tpm2_tool_output.o `test -f 'lib/tpm2_tool_output.c' || echo '$(srcdir)/'`lib/tpm2_tool_output.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_tool_output.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_tool_output.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_tool_output.c' object='lib/libcommon_a-tpm2_tool_output.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_policy.obj `if test -f 'lib/tpm2_policy.c'; then $(CYGPATH_W) 'lib/tpm2_policy.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_policy.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_tool_output.o `test -f 'lib/tpm2_tool_output.c' || echo '$(srcdir)/'`lib/tpm2_tool_output.c
 
-lib/lib_libcommon_a-tpm2_session.o: lib/tpm2_session.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_session.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_session.Tpo -c -o lib/lib_libcommon_a-tpm2_session.o `test -f 'lib/tpm2_session.c' || echo '$(srcdir)/'`lib/tpm2_session.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_session.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_session.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_session.c' object='lib/lib_libcommon_a-tpm2_session.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_tool_output.obj: lib/tpm2_tool_output.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_tool_output.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_tool_output.Tpo -c -o lib/libcommon_a-tpm2_tool_output.obj `if test -f 'lib/tpm2_tool_output.c'; then $(CYGPATH_W) 'lib/tpm2_tool_output.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_tool_output.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_tool_output.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_tool_output.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_tool_output.c' object='lib/libcommon_a-tpm2_tool_output.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_session.o `test -f 'lib/tpm2_session.c' || echo '$(srcdir)/'`lib/tpm2_session.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_tool_output.obj `if test -f 'lib/tpm2_tool_output.c'; then $(CYGPATH_W) 'lib/tpm2_tool_output.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_tool_output.c'; fi`
 
-lib/lib_libcommon_a-tpm2_session.obj: lib/tpm2_session.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_session.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_session.Tpo -c -o lib/lib_libcommon_a-tpm2_session.obj `if test -f 'lib/tpm2_session.c'; then $(CYGPATH_W) 'lib/tpm2_session.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_session.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_session.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_session.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_session.c' object='lib/lib_libcommon_a-tpm2_session.obj' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_util.o: lib/tpm2_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_util.o -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_util.Tpo -c -o lib/libcommon_a-tpm2_util.o `test -f 'lib/tpm2_util.c' || echo '$(srcdir)/'`lib/tpm2_util.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_util.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_util.c' object='lib/libcommon_a-tpm2_util.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_session.obj `if test -f 'lib/tpm2_session.c'; then $(CYGPATH_W) 'lib/tpm2_session.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_session.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_util.o `test -f 'lib/tpm2_util.c' || echo '$(srcdir)/'`lib/tpm2_util.c
 
-lib/lib_libcommon_a-tpm2_tool_output.o: lib/tpm2_tool_output.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_tool_output.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_tool_output.Tpo -c -o lib/lib_libcommon_a-tpm2_tool_output.o `test -f 'lib/tpm2_tool_output.c' || echo '$(srcdir)/'`lib/tpm2_tool_output.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_tool_output.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_tool_output.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_tool_output.c' object='lib/lib_libcommon_a-tpm2_tool_output.o' libtool=no @AMDEPBACKSLASH@
+lib/libcommon_a-tpm2_util.obj: lib/tpm2_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/libcommon_a-tpm2_util.obj -MD -MP -MF lib/$(DEPDIR)/libcommon_a-tpm2_util.Tpo -c -o lib/libcommon_a-tpm2_util.obj `if test -f 'lib/tpm2_util.c'; then $(CYGPATH_W) 'lib/tpm2_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_util.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/libcommon_a-tpm2_util.Tpo lib/$(DEPDIR)/libcommon_a-tpm2_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_util.c' object='lib/libcommon_a-tpm2_util.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_tool_output.o `test -f 'lib/tpm2_tool_output.c' || echo '$(srcdir)/'`lib/tpm2_tool_output.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/libcommon_a-tpm2_util.obj `if test -f 'lib/tpm2_util.c'; then $(CYGPATH_W) 'lib/tpm2_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_util.c'; fi`
 
-lib/lib_libcommon_a-tpm2_tool_output.obj: lib/tpm2_tool_output.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_tool_output.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_tool_output.Tpo -c -o lib/lib_libcommon_a-tpm2_tool_output.obj `if test -f 'lib/tpm2_tool_output.c'; then $(CYGPATH_W) 'lib/tpm2_tool_output.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_tool_output.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_tool_output.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_tool_output.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_tool_output.c' object='lib/lib_libcommon_a-tpm2_tool_output.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_cc_util-test_cc_util.o: test/unit/test_cc_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_cc_util_CFLAGS) $(CFLAGS) -MT test/unit/test_cc_util-test_cc_util.o -MD -MP -MF test/unit/$(DEPDIR)/test_cc_util-test_cc_util.Tpo -c -o test/unit/test_cc_util-test_cc_util.o `test -f 'test/unit/test_cc_util.c' || echo '$(srcdir)/'`test/unit/test_cc_util.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_cc_util-test_cc_util.Tpo test/unit/$(DEPDIR)/test_cc_util-test_cc_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_cc_util.c' object='test/unit/test_cc_util-test_cc_util.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_tool_output.obj `if test -f 'lib/tpm2_tool_output.c'; then $(CYGPATH_W) 'lib/tpm2_tool_output.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_tool_output.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_cc_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_cc_util-test_cc_util.o `test -f 'test/unit/test_cc_util.c' || echo '$(srcdir)/'`test/unit/test_cc_util.c
 
-lib/lib_libcommon_a-tpm2_util.o: lib/tpm2_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_util.o -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_util.Tpo -c -o lib/lib_libcommon_a-tpm2_util.o `test -f 'lib/tpm2_util.c' || echo '$(srcdir)/'`lib/tpm2_util.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_util.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_util.c' object='lib/lib_libcommon_a-tpm2_util.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_cc_util-test_cc_util.obj: test/unit/test_cc_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_cc_util_CFLAGS) $(CFLAGS) -MT test/unit/test_cc_util-test_cc_util.obj -MD -MP -MF test/unit/$(DEPDIR)/test_cc_util-test_cc_util.Tpo -c -o test/unit/test_cc_util-test_cc_util.obj `if test -f 'test/unit/test_cc_util.c'; then $(CYGPATH_W) 'test/unit/test_cc_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_cc_util.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_cc_util-test_cc_util.Tpo test/unit/$(DEPDIR)/test_cc_util-test_cc_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_cc_util.c' object='test/unit/test_cc_util-test_cc_util.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_util.o `test -f 'lib/tpm2_util.c' || echo '$(srcdir)/'`lib/tpm2_util.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_cc_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_cc_util-test_cc_util.obj `if test -f 'test/unit/test_cc_util.c'; then $(CYGPATH_W) 'test/unit/test_cc_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_cc_util.c'; fi`
 
-lib/lib_libcommon_a-tpm2_util.obj: lib/tpm2_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -MT lib/lib_libcommon_a-tpm2_util.obj -MD -MP -MF lib/$(DEPDIR)/lib_libcommon_a-tpm2_util.Tpo -c -o lib/lib_libcommon_a-tpm2_util.obj `if test -f 'lib/tpm2_util.c'; then $(CYGPATH_W) 'lib/tpm2_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_util.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) lib/$(DEPDIR)/lib_libcommon_a-tpm2_util.Tpo lib/$(DEPDIR)/lib_libcommon_a-tpm2_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='lib/tpm2_util.c' object='lib/lib_libcommon_a-tpm2_util.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_files-test_files.o: test/unit/test_files.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_files_CFLAGS) $(CFLAGS) -MT test/unit/test_files-test_files.o -MD -MP -MF test/unit/$(DEPDIR)/test_files-test_files.Tpo -c -o test/unit/test_files-test_files.o `test -f 'test/unit/test_files.c' || echo '$(srcdir)/'`test/unit/test_files.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_files-test_files.Tpo test/unit/$(DEPDIR)/test_files-test_files.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_files.c' object='test/unit/test_files-test_files.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(lib_libcommon_a_CFLAGS) $(CFLAGS) -c -o lib/lib_libcommon_a-tpm2_util.obj `if test -f 'lib/tpm2_util.c'; then $(CYGPATH_W) 'lib/tpm2_util.c'; else $(CYGPATH_W) '$(srcdir)/lib/tpm2_util.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_files_CFLAGS) $(CFLAGS) -c -o test/unit/test_files-test_files.o `test -f 'test/unit/test_files.c' || echo '$(srcdir)/'`test/unit/test_files.c
 
-test/unit/test_unit_test_cc_util-test_cc_util.o: test/unit/test_cc_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_cc_util_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_cc_util-test_cc_util.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_cc_util-test_cc_util.Tpo -c -o test/unit/test_unit_test_cc_util-test_cc_util.o `test -f 'test/unit/test_cc_util.c' || echo '$(srcdir)/'`test/unit/test_cc_util.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_cc_util-test_cc_util.Tpo test/unit/$(DEPDIR)/test_unit_test_cc_util-test_cc_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_cc_util.c' object='test/unit/test_unit_test_cc_util-test_cc_util.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_files-test_files.obj: test/unit/test_files.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_files_CFLAGS) $(CFLAGS) -MT test/unit/test_files-test_files.obj -MD -MP -MF test/unit/$(DEPDIR)/test_files-test_files.Tpo -c -o test/unit/test_files-test_files.obj `if test -f 'test/unit/test_files.c'; then $(CYGPATH_W) 'test/unit/test_files.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_files.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_files-test_files.Tpo test/unit/$(DEPDIR)/test_files-test_files.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_files.c' object='test/unit/test_files-test_files.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_cc_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_cc_util-test_cc_util.o `test -f 'test/unit/test_cc_util.c' || echo '$(srcdir)/'`test/unit/test_cc_util.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_files_CFLAGS) $(CFLAGS) -c -o test/unit/test_files-test_files.obj `if test -f 'test/unit/test_files.c'; then $(CYGPATH_W) 'test/unit/test_files.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_files.c'; fi`
 
-test/unit/test_unit_test_cc_util-test_cc_util.obj: test/unit/test_cc_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_cc_util_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_cc_util-test_cc_util.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_cc_util-test_cc_util.Tpo -c -o test/unit/test_unit_test_cc_util-test_cc_util.obj `if test -f 'test/unit/test_cc_util.c'; then $(CYGPATH_W) 'test/unit/test_cc_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_cc_util.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_cc_util-test_cc_util.Tpo test/unit/$(DEPDIR)/test_unit_test_cc_util-test_cc_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_cc_util.c' object='test/unit/test_unit_test_cc_util-test_cc_util.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_object-test_object.o: test/unit/test_object.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_object_CFLAGS) $(CFLAGS) -MT test/unit/test_object-test_object.o -MD -MP -MF test/unit/$(DEPDIR)/test_object-test_object.Tpo -c -o test/unit/test_object-test_object.o `test -f 'test/unit/test_object.c' || echo '$(srcdir)/'`test/unit/test_object.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_object-test_object.Tpo test/unit/$(DEPDIR)/test_object-test_object.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_object.c' object='test/unit/test_object-test_object.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_cc_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_cc_util-test_cc_util.obj `if test -f 'test/unit/test_cc_util.c'; then $(CYGPATH_W) 'test/unit/test_cc_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_cc_util.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_object_CFLAGS) $(CFLAGS) -c -o test/unit/test_object-test_object.o `test -f 'test/unit/test_object.c' || echo '$(srcdir)/'`test/unit/test_object.c
 
-test/unit/test_unit_test_files-test_files.o: test/unit/test_files.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_files_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_files-test_files.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_files-test_files.Tpo -c -o test/unit/test_unit_test_files-test_files.o `test -f 'test/unit/test_files.c' || echo '$(srcdir)/'`test/unit/test_files.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_files-test_files.Tpo test/unit/$(DEPDIR)/test_unit_test_files-test_files.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_files.c' object='test/unit/test_unit_test_files-test_files.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_object-test_object.obj: test/unit/test_object.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_object_CFLAGS) $(CFLAGS) -MT test/unit/test_object-test_object.obj -MD -MP -MF test/unit/$(DEPDIR)/test_object-test_object.Tpo -c -o test/unit/test_object-test_object.obj `if test -f 'test/unit/test_object.c'; then $(CYGPATH_W) 'test/unit/test_object.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_object.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_object-test_object.Tpo test/unit/$(DEPDIR)/test_object-test_object.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_object.c' object='test/unit/test_object-test_object.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_files_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_files-test_files.o `test -f 'test/unit/test_files.c' || echo '$(srcdir)/'`test/unit/test_files.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_object_CFLAGS) $(CFLAGS) -c -o test/unit/test_object-test_object.obj `if test -f 'test/unit/test_object.c'; then $(CYGPATH_W) 'test/unit/test_object.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_object.c'; fi`
 
-test/unit/test_unit_test_files-test_files.obj: test/unit/test_files.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_files_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_files-test_files.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_files-test_files.Tpo -c -o test/unit/test_unit_test_files-test_files.obj `if test -f 'test/unit/test_files.c'; then $(CYGPATH_W) 'test/unit/test_files.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_files.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_files-test_files.Tpo test/unit/$(DEPDIR)/test_unit_test_files-test_files.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_files.c' object='test/unit/test_unit_test_files-test_files.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_options-test_options.o: test/unit/test_options.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_options_CFLAGS) $(CFLAGS) -MT test/unit/test_options-test_options.o -MD -MP -MF test/unit/$(DEPDIR)/test_options-test_options.Tpo -c -o test/unit/test_options-test_options.o `test -f 'test/unit/test_options.c' || echo '$(srcdir)/'`test/unit/test_options.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_options-test_options.Tpo test/unit/$(DEPDIR)/test_options-test_options.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_options.c' object='test/unit/test_options-test_options.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_files_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_files-test_files.obj `if test -f 'test/unit/test_files.c'; then $(CYGPATH_W) 'test/unit/test_files.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_files.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_options_CFLAGS) $(CFLAGS) -c -o test/unit/test_options-test_options.o `test -f 'test/unit/test_options.c' || echo '$(srcdir)/'`test/unit/test_options.c
 
-test/unit/test_unit_test_options-test_options.o: test/unit/test_options.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_options_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_options-test_options.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_options-test_options.Tpo -c -o test/unit/test_unit_test_options-test_options.o `test -f 'test/unit/test_options.c' || echo '$(srcdir)/'`test/unit/test_options.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_options-test_options.Tpo test/unit/$(DEPDIR)/test_unit_test_options-test_options.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_options.c' object='test/unit/test_unit_test_options-test_options.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_options-test_options.obj: test/unit/test_options.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_options_CFLAGS) $(CFLAGS) -MT test/unit/test_options-test_options.obj -MD -MP -MF test/unit/$(DEPDIR)/test_options-test_options.Tpo -c -o test/unit/test_options-test_options.obj `if test -f 'test/unit/test_options.c'; then $(CYGPATH_W) 'test/unit/test_options.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_options.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_options-test_options.Tpo test/unit/$(DEPDIR)/test_options-test_options.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_options.c' object='test/unit/test_options-test_options.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_options_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_options-test_options.o `test -f 'test/unit/test_options.c' || echo '$(srcdir)/'`test/unit/test_options.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_options_CFLAGS) $(CFLAGS) -c -o test/unit/test_options-test_options.obj `if test -f 'test/unit/test_options.c'; then $(CYGPATH_W) 'test/unit/test_options.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_options.c'; fi`
 
-test/unit/test_unit_test_options-test_options.obj: test/unit/test_options.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_options_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_options-test_options.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_options-test_options.Tpo -c -o test/unit/test_unit_test_options-test_options.obj `if test -f 'test/unit/test_options.c'; then $(CYGPATH_W) 'test/unit/test_options.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_options.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_options-test_options.Tpo test/unit/$(DEPDIR)/test_unit_test_options-test_options.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_options.c' object='test/unit/test_unit_test_options-test_options.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_pcr-test_pcr.o: test/unit/test_pcr.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_pcr_CFLAGS) $(CFLAGS) -MT test/unit/test_pcr-test_pcr.o -MD -MP -MF test/unit/$(DEPDIR)/test_pcr-test_pcr.Tpo -c -o test/unit/test_pcr-test_pcr.o `test -f 'test/unit/test_pcr.c' || echo '$(srcdir)/'`test/unit/test_pcr.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_pcr-test_pcr.Tpo test/unit/$(DEPDIR)/test_pcr-test_pcr.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_pcr.c' object='test/unit/test_pcr-test_pcr.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_options_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_options-test_options.obj `if test -f 'test/unit/test_options.c'; then $(CYGPATH_W) 'test/unit/test_options.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_options.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_pcr_CFLAGS) $(CFLAGS) -c -o test/unit/test_pcr-test_pcr.o `test -f 'test/unit/test_pcr.c' || echo '$(srcdir)/'`test/unit/test_pcr.c
 
-test/unit/test_unit_test_pcr-test_pcr.o: test/unit/test_pcr.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_pcr_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_pcr-test_pcr.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_pcr-test_pcr.Tpo -c -o test/unit/test_unit_test_pcr-test_pcr.o `test -f 'test/unit/test_pcr.c' || echo '$(srcdir)/'`test/unit/test_pcr.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_pcr-test_pcr.Tpo test/unit/$(DEPDIR)/test_unit_test_pcr-test_pcr.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_pcr.c' object='test/unit/test_unit_test_pcr-test_pcr.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_pcr-test_pcr.obj: test/unit/test_pcr.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_pcr_CFLAGS) $(CFLAGS) -MT test/unit/test_pcr-test_pcr.obj -MD -MP -MF test/unit/$(DEPDIR)/test_pcr-test_pcr.Tpo -c -o test/unit/test_pcr-test_pcr.obj `if test -f 'test/unit/test_pcr.c'; then $(CYGPATH_W) 'test/unit/test_pcr.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_pcr.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_pcr-test_pcr.Tpo test/unit/$(DEPDIR)/test_pcr-test_pcr.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_pcr.c' object='test/unit/test_pcr-test_pcr.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_pcr_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_pcr-test_pcr.o `test -f 'test/unit/test_pcr.c' || echo '$(srcdir)/'`test/unit/test_pcr.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_pcr_CFLAGS) $(CFLAGS) -c -o test/unit/test_pcr-test_pcr.obj `if test -f 'test/unit/test_pcr.c'; then $(CYGPATH_W) 'test/unit/test_pcr.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_pcr.c'; fi`
 
-test/unit/test_unit_test_pcr-test_pcr.obj: test/unit/test_pcr.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_pcr_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_pcr-test_pcr.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_pcr-test_pcr.Tpo -c -o test/unit/test_unit_test_pcr-test_pcr.obj `if test -f 'test/unit/test_pcr.c'; then $(CYGPATH_W) 'test/unit/test_pcr.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_pcr.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_pcr-test_pcr.Tpo test/unit/$(DEPDIR)/test_unit_test_pcr-test_pcr.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_pcr.c' object='test/unit/test_unit_test_pcr-test_pcr.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_string_bytes-test_string_bytes.o: test/unit/test_string_bytes.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_string_bytes_CFLAGS) $(CFLAGS) -MT test/unit/test_string_bytes-test_string_bytes.o -MD -MP -MF test/unit/$(DEPDIR)/test_string_bytes-test_string_bytes.Tpo -c -o test/unit/test_string_bytes-test_string_bytes.o `test -f 'test/unit/test_string_bytes.c' || echo '$(srcdir)/'`test/unit/test_string_bytes.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_string_bytes-test_string_bytes.Tpo test/unit/$(DEPDIR)/test_string_bytes-test_string_bytes.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_string_bytes.c' object='test/unit/test_string_bytes-test_string_bytes.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_pcr_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_pcr-test_pcr.obj `if test -f 'test/unit/test_pcr.c'; then $(CYGPATH_W) 'test/unit/test_pcr.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_pcr.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_string_bytes_CFLAGS) $(CFLAGS) -c -o test/unit/test_string_bytes-test_string_bytes.o `test -f 'test/unit/test_string_bytes.c' || echo '$(srcdir)/'`test/unit/test_string_bytes.c
 
-test/unit/test_unit_test_string_bytes-test_string_bytes.o: test/unit/test_string_bytes.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_string_bytes_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_string_bytes-test_string_bytes.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_string_bytes-test_string_bytes.Tpo -c -o test/unit/test_unit_test_string_bytes-test_string_bytes.o `test -f 'test/unit/test_string_bytes.c' || echo '$(srcdir)/'`test/unit/test_string_bytes.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_string_bytes-test_string_bytes.Tpo test/unit/$(DEPDIR)/test_unit_test_string_bytes-test_string_bytes.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_string_bytes.c' object='test/unit/test_unit_test_string_bytes-test_string_bytes.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_string_bytes-test_string_bytes.obj: test/unit/test_string_bytes.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_string_bytes_CFLAGS) $(CFLAGS) -MT test/unit/test_string_bytes-test_string_bytes.obj -MD -MP -MF test/unit/$(DEPDIR)/test_string_bytes-test_string_bytes.Tpo -c -o test/unit/test_string_bytes-test_string_bytes.obj `if test -f 'test/unit/test_string_bytes.c'; then $(CYGPATH_W) 'test/unit/test_string_bytes.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_string_bytes.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_string_bytes-test_string_bytes.Tpo test/unit/$(DEPDIR)/test_string_bytes-test_string_bytes.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_string_bytes.c' object='test/unit/test_string_bytes-test_string_bytes.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_string_bytes_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_string_bytes-test_string_bytes.o `test -f 'test/unit/test_string_bytes.c' || echo '$(srcdir)/'`test/unit/test_string_bytes.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_string_bytes_CFLAGS) $(CFLAGS) -c -o test/unit/test_string_bytes-test_string_bytes.obj `if test -f 'test/unit/test_string_bytes.c'; then $(CYGPATH_W) 'test/unit/test_string_bytes.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_string_bytes.c'; fi`
 
-test/unit/test_unit_test_string_bytes-test_string_bytes.obj: test/unit/test_string_bytes.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_string_bytes_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_string_bytes-test_string_bytes.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_string_bytes-test_string_bytes.Tpo -c -o test/unit/test_unit_test_string_bytes-test_string_bytes.obj `if test -f 'test/unit/test_string_bytes.c'; then $(CYGPATH_W) 'test/unit/test_string_bytes.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_string_bytes.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_string_bytes-test_string_bytes.Tpo test/unit/$(DEPDIR)/test_unit_test_string_bytes-test_string_bytes.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_string_bytes.c' object='test/unit/test_unit_test_string_bytes-test_string_bytes.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_alg_util-test_tpm2_alg_util.o: test/unit/test_tpm2_alg_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_alg_util_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_alg_util-test_tpm2_alg_util.o -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_alg_util-test_tpm2_alg_util.Tpo -c -o test/unit/test_tpm2_alg_util-test_tpm2_alg_util.o `test -f 'test/unit/test_tpm2_alg_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_alg_util.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_alg_util-test_tpm2_alg_util.Tpo test/unit/$(DEPDIR)/test_tpm2_alg_util-test_tpm2_alg_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_alg_util.c' object='test/unit/test_tpm2_alg_util-test_tpm2_alg_util.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_string_bytes_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_string_bytes-test_string_bytes.obj `if test -f 'test/unit/test_string_bytes.c'; then $(CYGPATH_W) 'test/unit/test_string_bytes.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_string_bytes.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_alg_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_alg_util-test_tpm2_alg_util.o `test -f 'test/unit/test_tpm2_alg_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_alg_util.c
 
-test/unit/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.o: test/unit/test_tpm2_alg_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_alg_util_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.Tpo -c -o test/unit/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.o `test -f 'test/unit/test_tpm2_alg_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_alg_util.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_alg_util.c' object='test/unit/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_alg_util-test_tpm2_alg_util.obj: test/unit/test_tpm2_alg_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_alg_util_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_alg_util-test_tpm2_alg_util.obj -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_alg_util-test_tpm2_alg_util.Tpo -c -o test/unit/test_tpm2_alg_util-test_tpm2_alg_util.obj `if test -f 'test/unit/test_tpm2_alg_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_alg_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_alg_util.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_alg_util-test_tpm2_alg_util.Tpo test/unit/$(DEPDIR)/test_tpm2_alg_util-test_tpm2_alg_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_alg_util.c' object='test/unit/test_tpm2_alg_util-test_tpm2_alg_util.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_alg_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.o `test -f 'test/unit/test_tpm2_alg_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_alg_util.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_alg_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_alg_util-test_tpm2_alg_util.obj `if test -f 'test/unit/test_tpm2_alg_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_alg_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_alg_util.c'; fi`
 
-test/unit/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.obj: test/unit/test_tpm2_alg_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_alg_util_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.Tpo -c -o test/unit/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.obj `if test -f 'test/unit/test_tpm2_alg_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_alg_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_alg_util.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_alg_util.c' object='test/unit/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_attr_util-test_tpm2_attr_util.o: test/unit/test_tpm2_attr_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_attr_util_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_attr_util-test_tpm2_attr_util.o -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_attr_util-test_tpm2_attr_util.Tpo -c -o test/unit/test_tpm2_attr_util-test_tpm2_attr_util.o `test -f 'test/unit/test_tpm2_attr_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_attr_util.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_attr_util-test_tpm2_attr_util.Tpo test/unit/$(DEPDIR)/test_tpm2_attr_util-test_tpm2_attr_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_attr_util.c' object='test/unit/test_tpm2_attr_util-test_tpm2_attr_util.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_alg_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_alg_util-test_tpm2_alg_util.obj `if test -f 'test/unit/test_tpm2_alg_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_alg_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_alg_util.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_attr_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_attr_util-test_tpm2_attr_util.o `test -f 'test/unit/test_tpm2_attr_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_attr_util.c
 
-test/unit/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.o: test/unit/test_tpm2_attr_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_attr_util_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.Tpo -c -o test/unit/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.o `test -f 'test/unit/test_tpm2_attr_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_attr_util.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_attr_util.c' object='test/unit/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_attr_util-test_tpm2_attr_util.obj: test/unit/test_tpm2_attr_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_attr_util_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_attr_util-test_tpm2_attr_util.obj -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_attr_util-test_tpm2_attr_util.Tpo -c -o test/unit/test_tpm2_attr_util-test_tpm2_attr_util.obj `if test -f 'test/unit/test_tpm2_attr_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_attr_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_attr_util.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_attr_util-test_tpm2_attr_util.Tpo test/unit/$(DEPDIR)/test_tpm2_attr_util-test_tpm2_attr_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_attr_util.c' object='test/unit/test_tpm2_attr_util-test_tpm2_attr_util.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_attr_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.o `test -f 'test/unit/test_tpm2_attr_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_attr_util.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_attr_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_attr_util-test_tpm2_attr_util.obj `if test -f 'test/unit/test_tpm2_attr_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_attr_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_attr_util.c'; fi`
 
-test/unit/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.obj: test/unit/test_tpm2_attr_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_attr_util_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.Tpo -c -o test/unit/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.obj `if test -f 'test/unit/test_tpm2_attr_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_attr_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_attr_util.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_attr_util.c' object='test/unit/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_auth_util-test_tpm2_auth_util.o: test/unit/test_tpm2_auth_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_auth_util_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_auth_util-test_tpm2_auth_util.o -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_auth_util-test_tpm2_auth_util.Tpo -c -o test/unit/test_tpm2_auth_util-test_tpm2_auth_util.o `test -f 'test/unit/test_tpm2_auth_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_auth_util.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_auth_util-test_tpm2_auth_util.Tpo test/unit/$(DEPDIR)/test_tpm2_auth_util-test_tpm2_auth_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_auth_util.c' object='test/unit/test_tpm2_auth_util-test_tpm2_auth_util.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_attr_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_attr_util-test_tpm2_attr_util.obj `if test -f 'test/unit/test_tpm2_attr_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_attr_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_attr_util.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_auth_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_auth_util-test_tpm2_auth_util.o `test -f 'test/unit/test_tpm2_auth_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_auth_util.c
 
-test/unit/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.o: test/unit/test_tpm2_auth_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_auth_util_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.Tpo -c -o test/unit/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.o `test -f 'test/unit/test_tpm2_auth_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_auth_util.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_auth_util.c' object='test/unit/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_auth_util-test_tpm2_auth_util.obj: test/unit/test_tpm2_auth_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_auth_util_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_auth_util-test_tpm2_auth_util.obj -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_auth_util-test_tpm2_auth_util.Tpo -c -o test/unit/test_tpm2_auth_util-test_tpm2_auth_util.obj `if test -f 'test/unit/test_tpm2_auth_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_auth_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_auth_util.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_auth_util-test_tpm2_auth_util.Tpo test/unit/$(DEPDIR)/test_tpm2_auth_util-test_tpm2_auth_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_auth_util.c' object='test/unit/test_tpm2_auth_util-test_tpm2_auth_util.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_auth_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.o `test -f 'test/unit/test_tpm2_auth_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_auth_util.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_auth_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_auth_util-test_tpm2_auth_util.obj `if test -f 'test/unit/test_tpm2_auth_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_auth_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_auth_util.c'; fi`
 
-test/unit/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.obj: test/unit/test_tpm2_auth_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_auth_util_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.Tpo -c -o test/unit/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.obj `if test -f 'test/unit/test_tpm2_auth_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_auth_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_auth_util.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_auth_util.c' object='test/unit/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_errata-test_tpm2_errata.o: test/unit/test_tpm2_errata.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_errata_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_errata-test_tpm2_errata.o -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_errata-test_tpm2_errata.Tpo -c -o test/unit/test_tpm2_errata-test_tpm2_errata.o `test -f 'test/unit/test_tpm2_errata.c' || echo '$(srcdir)/'`test/unit/test_tpm2_errata.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_errata-test_tpm2_errata.Tpo test/unit/$(DEPDIR)/test_tpm2_errata-test_tpm2_errata.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_errata.c' object='test/unit/test_tpm2_errata-test_tpm2_errata.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_auth_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_auth_util-test_tpm2_auth_util.obj `if test -f 'test/unit/test_tpm2_auth_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_auth_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_auth_util.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_errata_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_errata-test_tpm2_errata.o `test -f 'test/unit/test_tpm2_errata.c' || echo '$(srcdir)/'`test/unit/test_tpm2_errata.c
 
-test/unit/test_unit_test_tpm2_errata-test_tpm2_errata.o: test/unit/test_tpm2_errata.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_errata_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_errata-test_tpm2_errata.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_errata-test_tpm2_errata.Tpo -c -o test/unit/test_unit_test_tpm2_errata-test_tpm2_errata.o `test -f 'test/unit/test_tpm2_errata.c' || echo '$(srcdir)/'`test/unit/test_tpm2_errata.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_errata-test_tpm2_errata.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_errata-test_tpm2_errata.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_errata.c' object='test/unit/test_unit_test_tpm2_errata-test_tpm2_errata.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_errata-test_tpm2_errata.obj: test/unit/test_tpm2_errata.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_errata_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_errata-test_tpm2_errata.obj -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_errata-test_tpm2_errata.Tpo -c -o test/unit/test_tpm2_errata-test_tpm2_errata.obj `if test -f 'test/unit/test_tpm2_errata.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_errata.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_errata.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_errata-test_tpm2_errata.Tpo test/unit/$(DEPDIR)/test_tpm2_errata-test_tpm2_errata.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_errata.c' object='test/unit/test_tpm2_errata-test_tpm2_errata.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_errata_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_errata-test_tpm2_errata.o `test -f 'test/unit/test_tpm2_errata.c' || echo '$(srcdir)/'`test/unit/test_tpm2_errata.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_errata_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_errata-test_tpm2_errata.obj `if test -f 'test/unit/test_tpm2_errata.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_errata.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_errata.c'; fi`
 
-test/unit/test_unit_test_tpm2_errata-test_tpm2_errata.obj: test/unit/test_tpm2_errata.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_errata_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_errata-test_tpm2_errata.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_errata-test_tpm2_errata.Tpo -c -o test/unit/test_unit_test_tpm2_errata-test_tpm2_errata.obj `if test -f 'test/unit/test_tpm2_errata.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_errata.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_errata.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_errata-test_tpm2_errata.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_errata-test_tpm2_errata.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_errata.c' object='test/unit/test_unit_test_tpm2_errata-test_tpm2_errata.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_eventlog-test_tpm2_eventlog.o: test/unit/test_tpm2_eventlog.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_eventlog-test_tpm2_eventlog.o -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_eventlog-test_tpm2_eventlog.Tpo -c -o test/unit/test_tpm2_eventlog-test_tpm2_eventlog.o `test -f 'test/unit/test_tpm2_eventlog.c' || echo '$(srcdir)/'`test/unit/test_tpm2_eventlog.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_eventlog-test_tpm2_eventlog.Tpo test/unit/$(DEPDIR)/test_tpm2_eventlog-test_tpm2_eventlog.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_eventlog.c' object='test/unit/test_tpm2_eventlog-test_tpm2_eventlog.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_errata_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_errata-test_tpm2_errata.obj `if test -f 'test/unit/test_tpm2_errata.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_errata.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_errata.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_eventlog-test_tpm2_eventlog.o `test -f 'test/unit/test_tpm2_eventlog.c' || echo '$(srcdir)/'`test/unit/test_tpm2_eventlog.c
 
-test/unit/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.o: test/unit/test_tpm2_eventlog.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.Tpo -c -o test/unit/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.o `test -f 'test/unit/test_tpm2_eventlog.c' || echo '$(srcdir)/'`test/unit/test_tpm2_eventlog.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_eventlog.c' object='test/unit/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_eventlog-test_tpm2_eventlog.obj: test/unit/test_tpm2_eventlog.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_eventlog-test_tpm2_eventlog.obj -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_eventlog-test_tpm2_eventlog.Tpo -c -o test/unit/test_tpm2_eventlog-test_tpm2_eventlog.obj `if test -f 'test/unit/test_tpm2_eventlog.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_eventlog.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_eventlog.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_eventlog-test_tpm2_eventlog.Tpo test/unit/$(DEPDIR)/test_tpm2_eventlog-test_tpm2_eventlog.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_eventlog.c' object='test/unit/test_tpm2_eventlog-test_tpm2_eventlog.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.o `test -f 'test/unit/test_tpm2_eventlog.c' || echo '$(srcdir)/'`test/unit/test_tpm2_eventlog.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_eventlog-test_tpm2_eventlog.obj `if test -f 'test/unit/test_tpm2_eventlog.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_eventlog.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_eventlog.c'; fi`
 
-test/unit/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.obj: test/unit/test_tpm2_eventlog.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.Tpo -c -o test/unit/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.obj `if test -f 'test/unit/test_tpm2_eventlog.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_eventlog.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_eventlog.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_eventlog.c' object='test/unit/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.o: test/unit/test_tpm2_eventlog_yaml.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_yaml_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.o -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Tpo -c -o test/unit/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.o `test -f 'test/unit/test_tpm2_eventlog_yaml.c' || echo '$(srcdir)/'`test/unit/test_tpm2_eventlog_yaml.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Tpo test/unit/$(DEPDIR)/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_eventlog_yaml.c' object='test/unit/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_eventlog-test_tpm2_eventlog.obj `if test -f 'test/unit/test_tpm2_eventlog.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_eventlog.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_eventlog.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_yaml_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.o `test -f 'test/unit/test_tpm2_eventlog_yaml.c' || echo '$(srcdir)/'`test/unit/test_tpm2_eventlog_yaml.c
 
-test/unit/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.o: test/unit/test_tpm2_eventlog_yaml.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_yaml_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Tpo -c -o test/unit/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.o `test -f 'test/unit/test_tpm2_eventlog_yaml.c' || echo '$(srcdir)/'`test/unit/test_tpm2_eventlog_yaml.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_eventlog_yaml.c' object='test/unit/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.obj: test/unit/test_tpm2_eventlog_yaml.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_yaml_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.obj -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Tpo -c -o test/unit/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.obj `if test -f 'test/unit/test_tpm2_eventlog_yaml.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_eventlog_yaml.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_eventlog_yaml.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Tpo test/unit/$(DEPDIR)/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_eventlog_yaml.c' object='test/unit/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_yaml_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.o `test -f 'test/unit/test_tpm2_eventlog_yaml.c' || echo '$(srcdir)/'`test/unit/test_tpm2_eventlog_yaml.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_yaml_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.obj `if test -f 'test/unit/test_tpm2_eventlog_yaml.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_eventlog_yaml.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_eventlog_yaml.c'; fi`
 
-test/unit/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.obj: test/unit/test_tpm2_eventlog_yaml.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_yaml_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Tpo -c -o test/unit/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.obj `if test -f 'test/unit/test_tpm2_eventlog_yaml.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_eventlog_yaml.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_eventlog_yaml.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_eventlog_yaml.c' object='test/unit/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_header-test_tpm2_header.o: test/unit/test_tpm2_header.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_header_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_header-test_tpm2_header.o -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_header-test_tpm2_header.Tpo -c -o test/unit/test_tpm2_header-test_tpm2_header.o `test -f 'test/unit/test_tpm2_header.c' || echo '$(srcdir)/'`test/unit/test_tpm2_header.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_header-test_tpm2_header.Tpo test/unit/$(DEPDIR)/test_tpm2_header-test_tpm2_header.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_header.c' object='test/unit/test_tpm2_header-test_tpm2_header.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_eventlog_yaml_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.obj `if test -f 'test/unit/test_tpm2_eventlog_yaml.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_eventlog_yaml.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_eventlog_yaml.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_header_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_header-test_tpm2_header.o `test -f 'test/unit/test_tpm2_header.c' || echo '$(srcdir)/'`test/unit/test_tpm2_header.c
 
-test/unit/test_unit_test_tpm2_header-test_tpm2_header.o: test/unit/test_tpm2_header.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_header_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_header-test_tpm2_header.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_header-test_tpm2_header.Tpo -c -o test/unit/test_unit_test_tpm2_header-test_tpm2_header.o `test -f 'test/unit/test_tpm2_header.c' || echo '$(srcdir)/'`test/unit/test_tpm2_header.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_header-test_tpm2_header.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_header-test_tpm2_header.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_header.c' object='test/unit/test_unit_test_tpm2_header-test_tpm2_header.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_header-test_tpm2_header.obj: test/unit/test_tpm2_header.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_header_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_header-test_tpm2_header.obj -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_header-test_tpm2_header.Tpo -c -o test/unit/test_tpm2_header-test_tpm2_header.obj `if test -f 'test/unit/test_tpm2_header.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_header.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_header.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_header-test_tpm2_header.Tpo test/unit/$(DEPDIR)/test_tpm2_header-test_tpm2_header.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_header.c' object='test/unit/test_tpm2_header-test_tpm2_header.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_header_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_header-test_tpm2_header.o `test -f 'test/unit/test_tpm2_header.c' || echo '$(srcdir)/'`test/unit/test_tpm2_header.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_header_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_header-test_tpm2_header.obj `if test -f 'test/unit/test_tpm2_header.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_header.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_header.c'; fi`
 
-test/unit/test_unit_test_tpm2_header-test_tpm2_header.obj: test/unit/test_tpm2_header.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_header_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_header-test_tpm2_header.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_header-test_tpm2_header.Tpo -c -o test/unit/test_unit_test_tpm2_header-test_tpm2_header.obj `if test -f 'test/unit/test_tpm2_header.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_header.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_header.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_header-test_tpm2_header.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_header-test_tpm2_header.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_header.c' object='test/unit/test_unit_test_tpm2_header-test_tpm2_header.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_policy-test_tpm2_policy.o: test/unit/test_tpm2_policy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_policy_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_policy-test_tpm2_policy.o -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_policy-test_tpm2_policy.Tpo -c -o test/unit/test_tpm2_policy-test_tpm2_policy.o `test -f 'test/unit/test_tpm2_policy.c' || echo '$(srcdir)/'`test/unit/test_tpm2_policy.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_policy-test_tpm2_policy.Tpo test/unit/$(DEPDIR)/test_tpm2_policy-test_tpm2_policy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_policy.c' object='test/unit/test_tpm2_policy-test_tpm2_policy.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_header_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_header-test_tpm2_header.obj `if test -f 'test/unit/test_tpm2_header.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_header.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_header.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_policy_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_policy-test_tpm2_policy.o `test -f 'test/unit/test_tpm2_policy.c' || echo '$(srcdir)/'`test/unit/test_tpm2_policy.c
 
-test/unit/test_unit_test_tpm2_policy-test_tpm2_policy.o: test/unit/test_tpm2_policy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_policy_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_policy-test_tpm2_policy.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_policy-test_tpm2_policy.Tpo -c -o test/unit/test_unit_test_tpm2_policy-test_tpm2_policy.o `test -f 'test/unit/test_tpm2_policy.c' || echo '$(srcdir)/'`test/unit/test_tpm2_policy.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_policy-test_tpm2_policy.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_policy-test_tpm2_policy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_policy.c' object='test/unit/test_unit_test_tpm2_policy-test_tpm2_policy.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_policy-test_tpm2_policy.obj: test/unit/test_tpm2_policy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_policy_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_policy-test_tpm2_policy.obj -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_policy-test_tpm2_policy.Tpo -c -o test/unit/test_tpm2_policy-test_tpm2_policy.obj `if test -f 'test/unit/test_tpm2_policy.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_policy.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_policy.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_policy-test_tpm2_policy.Tpo test/unit/$(DEPDIR)/test_tpm2_policy-test_tpm2_policy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_policy.c' object='test/unit/test_tpm2_policy-test_tpm2_policy.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_policy_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_policy-test_tpm2_policy.o `test -f 'test/unit/test_tpm2_policy.c' || echo '$(srcdir)/'`test/unit/test_tpm2_policy.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_policy_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_policy-test_tpm2_policy.obj `if test -f 'test/unit/test_tpm2_policy.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_policy.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_policy.c'; fi`
 
-test/unit/test_unit_test_tpm2_policy-test_tpm2_policy.obj: test/unit/test_tpm2_policy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_policy_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_policy-test_tpm2_policy.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_policy-test_tpm2_policy.Tpo -c -o test/unit/test_unit_test_tpm2_policy-test_tpm2_policy.obj `if test -f 'test/unit/test_tpm2_policy.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_policy.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_policy.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_policy-test_tpm2_policy.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_policy-test_tpm2_policy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_policy.c' object='test/unit/test_unit_test_tpm2_policy-test_tpm2_policy.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_session-test_tpm2_session.o: test/unit/test_tpm2_session.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_session_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_session-test_tpm2_session.o -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_session-test_tpm2_session.Tpo -c -o test/unit/test_tpm2_session-test_tpm2_session.o `test -f 'test/unit/test_tpm2_session.c' || echo '$(srcdir)/'`test/unit/test_tpm2_session.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_session-test_tpm2_session.Tpo test/unit/$(DEPDIR)/test_tpm2_session-test_tpm2_session.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_session.c' object='test/unit/test_tpm2_session-test_tpm2_session.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_policy_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_policy-test_tpm2_policy.obj `if test -f 'test/unit/test_tpm2_policy.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_policy.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_policy.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_session_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_session-test_tpm2_session.o `test -f 'test/unit/test_tpm2_session.c' || echo '$(srcdir)/'`test/unit/test_tpm2_session.c
 
-test/unit/test_unit_test_tpm2_session-test_tpm2_session.o: test/unit/test_tpm2_session.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_session_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_session-test_tpm2_session.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_session-test_tpm2_session.Tpo -c -o test/unit/test_unit_test_tpm2_session-test_tpm2_session.o `test -f 'test/unit/test_tpm2_session.c' || echo '$(srcdir)/'`test/unit/test_tpm2_session.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_session-test_tpm2_session.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_session-test_tpm2_session.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_session.c' object='test/unit/test_unit_test_tpm2_session-test_tpm2_session.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_session-test_tpm2_session.obj: test/unit/test_tpm2_session.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_session_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_session-test_tpm2_session.obj -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_session-test_tpm2_session.Tpo -c -o test/unit/test_tpm2_session-test_tpm2_session.obj `if test -f 'test/unit/test_tpm2_session.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_session.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_session.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_session-test_tpm2_session.Tpo test/unit/$(DEPDIR)/test_tpm2_session-test_tpm2_session.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_session.c' object='test/unit/test_tpm2_session-test_tpm2_session.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_session_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_session-test_tpm2_session.o `test -f 'test/unit/test_tpm2_session.c' || echo '$(srcdir)/'`test/unit/test_tpm2_session.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_session_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_session-test_tpm2_session.obj `if test -f 'test/unit/test_tpm2_session.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_session.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_session.c'; fi`
 
-test/unit/test_unit_test_tpm2_session-test_tpm2_session.obj: test/unit/test_tpm2_session.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_session_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_session-test_tpm2_session.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_session-test_tpm2_session.Tpo -c -o test/unit/test_unit_test_tpm2_session-test_tpm2_session.obj `if test -f 'test/unit/test_tpm2_session.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_session.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_session.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_session-test_tpm2_session.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_session-test_tpm2_session.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_session.c' object='test/unit/test_unit_test_tpm2_session-test_tpm2_session.obj' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_util-test_tpm2_util.o: test/unit/test_tpm2_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_util_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_util-test_tpm2_util.o -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_util-test_tpm2_util.Tpo -c -o test/unit/test_tpm2_util-test_tpm2_util.o `test -f 'test/unit/test_tpm2_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_util.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_util-test_tpm2_util.Tpo test/unit/$(DEPDIR)/test_tpm2_util-test_tpm2_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_util.c' object='test/unit/test_tpm2_util-test_tpm2_util.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_session_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_session-test_tpm2_session.obj `if test -f 'test/unit/test_tpm2_session.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_session.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_session.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_util-test_tpm2_util.o `test -f 'test/unit/test_tpm2_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_util.c
 
-test/unit/test_unit_test_tpm2_util-test_tpm2_util.o: test/unit/test_tpm2_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_util_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_util-test_tpm2_util.o -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_util-test_tpm2_util.Tpo -c -o test/unit/test_unit_test_tpm2_util-test_tpm2_util.o `test -f 'test/unit/test_tpm2_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_util.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_util-test_tpm2_util.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_util-test_tpm2_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_util.c' object='test/unit/test_unit_test_tpm2_util-test_tpm2_util.o' libtool=no @AMDEPBACKSLASH@
+test/unit/test_tpm2_util-test_tpm2_util.obj: test/unit/test_tpm2_util.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_util_CFLAGS) $(CFLAGS) -MT test/unit/test_tpm2_util-test_tpm2_util.obj -MD -MP -MF test/unit/$(DEPDIR)/test_tpm2_util-test_tpm2_util.Tpo -c -o test/unit/test_tpm2_util-test_tpm2_util.obj `if test -f 'test/unit/test_tpm2_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_util.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_tpm2_util-test_tpm2_util.Tpo test/unit/$(DEPDIR)/test_tpm2_util-test_tpm2_util.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_util.c' object='test/unit/test_tpm2_util-test_tpm2_util.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_util-test_tpm2_util.o `test -f 'test/unit/test_tpm2_util.c' || echo '$(srcdir)/'`test/unit/test_tpm2_util.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_tpm2_util-test_tpm2_util.obj `if test -f 'test/unit/test_tpm2_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_util.c'; fi`
 
-test/unit/test_unit_test_tpm2_util-test_tpm2_util.obj: test/unit/test_tpm2_util.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_util_CFLAGS) $(CFLAGS) -MT test/unit/test_unit_test_tpm2_util-test_tpm2_util.obj -MD -MP -MF test/unit/$(DEPDIR)/test_unit_test_tpm2_util-test_tpm2_util.Tpo -c -o test/unit/test_unit_test_tpm2_util-test_tpm2_util.obj `if test -f 'test/unit/test_tpm2_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_util.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) test/unit/$(DEPDIR)/test_unit_test_tpm2_util-test_tpm2_util.Tpo test/unit/$(DEPDIR)/test_unit_test_tpm2_util-test_tpm2_util.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='test/unit/test_tpm2_util.c' object='test/unit/test_unit_test_tpm2_util-test_tpm2_util.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_template.o: tools/fapi/tss2_template.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_template.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_template.Tpo -c -o tools/fapi/tss2-tss2_template.o `test -f 'tools/fapi/tss2_template.c' || echo '$(srcdir)/'`tools/fapi/tss2_template.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_template.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_template.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_template.c' object='tools/fapi/tss2-tss2_template.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_unit_test_tpm2_util_CFLAGS) $(CFLAGS) -c -o test/unit/test_unit_test_tpm2_util-test_tpm2_util.obj `if test -f 'test/unit/test_tpm2_util.c'; then $(CYGPATH_W) 'test/unit/test_tpm2_util.c'; else $(CYGPATH_W) '$(srcdir)/test/unit/test_tpm2_util.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_template.o `test -f 'tools/fapi/tss2_template.c' || echo '$(srcdir)/'`tools/fapi/tss2_template.c
 
-tools/fapi/tools_fapi_tss2-tss2_template.o: tools/fapi/tss2_template.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_template.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_template.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_template.o `test -f 'tools/fapi/tss2_template.c' || echo '$(srcdir)/'`tools/fapi/tss2_template.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_template.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_template.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_template.c' object='tools/fapi/tools_fapi_tss2-tss2_template.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_template.obj: tools/fapi/tss2_template.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_template.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_template.Tpo -c -o tools/fapi/tss2-tss2_template.obj `if test -f 'tools/fapi/tss2_template.c'; then $(CYGPATH_W) 'tools/fapi/tss2_template.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_template.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_template.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_template.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_template.c' object='tools/fapi/tss2-tss2_template.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_template.o `test -f 'tools/fapi/tss2_template.c' || echo '$(srcdir)/'`tools/fapi/tss2_template.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_template.obj `if test -f 'tools/fapi/tss2_template.c'; then $(CYGPATH_W) 'tools/fapi/tss2_template.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_template.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_template.obj: tools/fapi/tss2_template.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_template.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_template.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_template.obj `if test -f 'tools/fapi/tss2_template.c'; then $(CYGPATH_W) 'tools/fapi/tss2_template.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_template.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_template.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_template.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_template.c' object='tools/fapi/tools_fapi_tss2-tss2_template.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_decrypt.o: tools/fapi/tss2_decrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_decrypt.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_decrypt.Tpo -c -o tools/fapi/tss2-tss2_decrypt.o `test -f 'tools/fapi/tss2_decrypt.c' || echo '$(srcdir)/'`tools/fapi/tss2_decrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_decrypt.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_decrypt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_decrypt.c' object='tools/fapi/tss2-tss2_decrypt.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_template.obj `if test -f 'tools/fapi/tss2_template.c'; then $(CYGPATH_W) 'tools/fapi/tss2_template.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_template.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_decrypt.o `test -f 'tools/fapi/tss2_decrypt.c' || echo '$(srcdir)/'`tools/fapi/tss2_decrypt.c
 
-tools/fapi/tools_fapi_tss2-tss2_decrypt.o: tools/fapi/tss2_decrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_decrypt.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_decrypt.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_decrypt.o `test -f 'tools/fapi/tss2_decrypt.c' || echo '$(srcdir)/'`tools/fapi/tss2_decrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_decrypt.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_decrypt.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_decrypt.c' object='tools/fapi/tools_fapi_tss2-tss2_decrypt.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_decrypt.obj: tools/fapi/tss2_decrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_decrypt.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_decrypt.Tpo -c -o tools/fapi/tss2-tss2_decrypt.obj `if test -f 'tools/fapi/tss2_decrypt.c'; then $(CYGPATH_W) 'tools/fapi/tss2_decrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_decrypt.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_decrypt.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_decrypt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_decrypt.c' object='tools/fapi/tss2-tss2_decrypt.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_decrypt.o `test -f 'tools/fapi/tss2_decrypt.c' || echo '$(srcdir)/'`tools/fapi/tss2_decrypt.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_decrypt.obj `if test -f 'tools/fapi/tss2_decrypt.c'; then $(CYGPATH_W) 'tools/fapi/tss2_decrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_decrypt.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_decrypt.obj: tools/fapi/tss2_decrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_decrypt.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_decrypt.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_decrypt.obj `if test -f 'tools/fapi/tss2_decrypt.c'; then $(CYGPATH_W) 'tools/fapi/tss2_decrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_decrypt.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_decrypt.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_decrypt.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_decrypt.c' object='tools/fapi/tools_fapi_tss2-tss2_decrypt.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_encrypt.o: tools/fapi/tss2_encrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_encrypt.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_encrypt.Tpo -c -o tools/fapi/tss2-tss2_encrypt.o `test -f 'tools/fapi/tss2_encrypt.c' || echo '$(srcdir)/'`tools/fapi/tss2_encrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_encrypt.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_encrypt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_encrypt.c' object='tools/fapi/tss2-tss2_encrypt.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_decrypt.obj `if test -f 'tools/fapi/tss2_decrypt.c'; then $(CYGPATH_W) 'tools/fapi/tss2_decrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_decrypt.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_encrypt.o `test -f 'tools/fapi/tss2_encrypt.c' || echo '$(srcdir)/'`tools/fapi/tss2_encrypt.c
 
-tools/fapi/tools_fapi_tss2-tss2_encrypt.o: tools/fapi/tss2_encrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_encrypt.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_encrypt.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_encrypt.o `test -f 'tools/fapi/tss2_encrypt.c' || echo '$(srcdir)/'`tools/fapi/tss2_encrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_encrypt.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_encrypt.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_encrypt.c' object='tools/fapi/tools_fapi_tss2-tss2_encrypt.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_encrypt.obj: tools/fapi/tss2_encrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_encrypt.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_encrypt.Tpo -c -o tools/fapi/tss2-tss2_encrypt.obj `if test -f 'tools/fapi/tss2_encrypt.c'; then $(CYGPATH_W) 'tools/fapi/tss2_encrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_encrypt.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_encrypt.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_encrypt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_encrypt.c' object='tools/fapi/tss2-tss2_encrypt.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_encrypt.o `test -f 'tools/fapi/tss2_encrypt.c' || echo '$(srcdir)/'`tools/fapi/tss2_encrypt.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_encrypt.obj `if test -f 'tools/fapi/tss2_encrypt.c'; then $(CYGPATH_W) 'tools/fapi/tss2_encrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_encrypt.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_encrypt.obj: tools/fapi/tss2_encrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_encrypt.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_encrypt.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_encrypt.obj `if test -f 'tools/fapi/tss2_encrypt.c'; then $(CYGPATH_W) 'tools/fapi/tss2_encrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_encrypt.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_encrypt.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_encrypt.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_encrypt.c' object='tools/fapi/tools_fapi_tss2-tss2_encrypt.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_list.o: tools/fapi/tss2_list.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_list.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_list.Tpo -c -o tools/fapi/tss2-tss2_list.o `test -f 'tools/fapi/tss2_list.c' || echo '$(srcdir)/'`tools/fapi/tss2_list.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_list.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_list.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_list.c' object='tools/fapi/tss2-tss2_list.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_encrypt.obj `if test -f 'tools/fapi/tss2_encrypt.c'; then $(CYGPATH_W) 'tools/fapi/tss2_encrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_encrypt.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_list.o `test -f 'tools/fapi/tss2_list.c' || echo '$(srcdir)/'`tools/fapi/tss2_list.c
 
-tools/fapi/tools_fapi_tss2-tss2_list.o: tools/fapi/tss2_list.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_list.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_list.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_list.o `test -f 'tools/fapi/tss2_list.c' || echo '$(srcdir)/'`tools/fapi/tss2_list.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_list.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_list.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_list.c' object='tools/fapi/tools_fapi_tss2-tss2_list.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_list.obj: tools/fapi/tss2_list.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_list.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_list.Tpo -c -o tools/fapi/tss2-tss2_list.obj `if test -f 'tools/fapi/tss2_list.c'; then $(CYGPATH_W) 'tools/fapi/tss2_list.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_list.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_list.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_list.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_list.c' object='tools/fapi/tss2-tss2_list.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_list.o `test -f 'tools/fapi/tss2_list.c' || echo '$(srcdir)/'`tools/fapi/tss2_list.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_list.obj `if test -f 'tools/fapi/tss2_list.c'; then $(CYGPATH_W) 'tools/fapi/tss2_list.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_list.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_list.obj: tools/fapi/tss2_list.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_list.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_list.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_list.obj `if test -f 'tools/fapi/tss2_list.c'; then $(CYGPATH_W) 'tools/fapi/tss2_list.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_list.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_list.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_list.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_list.c' object='tools/fapi/tools_fapi_tss2-tss2_list.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_changeauth.o: tools/fapi/tss2_changeauth.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_changeauth.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_changeauth.Tpo -c -o tools/fapi/tss2-tss2_changeauth.o `test -f 'tools/fapi/tss2_changeauth.c' || echo '$(srcdir)/'`tools/fapi/tss2_changeauth.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_changeauth.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_changeauth.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_changeauth.c' object='tools/fapi/tss2-tss2_changeauth.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_list.obj `if test -f 'tools/fapi/tss2_list.c'; then $(CYGPATH_W) 'tools/fapi/tss2_list.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_list.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_changeauth.o `test -f 'tools/fapi/tss2_changeauth.c' || echo '$(srcdir)/'`tools/fapi/tss2_changeauth.c
 
-tools/fapi/tools_fapi_tss2-tss2_changeauth.o: tools/fapi/tss2_changeauth.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_changeauth.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_changeauth.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_changeauth.o `test -f 'tools/fapi/tss2_changeauth.c' || echo '$(srcdir)/'`tools/fapi/tss2_changeauth.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_changeauth.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_changeauth.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_changeauth.c' object='tools/fapi/tools_fapi_tss2-tss2_changeauth.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_changeauth.obj: tools/fapi/tss2_changeauth.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_changeauth.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_changeauth.Tpo -c -o tools/fapi/tss2-tss2_changeauth.obj `if test -f 'tools/fapi/tss2_changeauth.c'; then $(CYGPATH_W) 'tools/fapi/tss2_changeauth.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_changeauth.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_changeauth.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_changeauth.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_changeauth.c' object='tools/fapi/tss2-tss2_changeauth.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_changeauth.o `test -f 'tools/fapi/tss2_changeauth.c' || echo '$(srcdir)/'`tools/fapi/tss2_changeauth.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_changeauth.obj `if test -f 'tools/fapi/tss2_changeauth.c'; then $(CYGPATH_W) 'tools/fapi/tss2_changeauth.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_changeauth.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_changeauth.obj: tools/fapi/tss2_changeauth.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_changeauth.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_changeauth.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_changeauth.obj `if test -f 'tools/fapi/tss2_changeauth.c'; then $(CYGPATH_W) 'tools/fapi/tss2_changeauth.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_changeauth.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_changeauth.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_changeauth.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_changeauth.c' object='tools/fapi/tools_fapi_tss2-tss2_changeauth.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_delete.o: tools/fapi/tss2_delete.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_delete.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_delete.Tpo -c -o tools/fapi/tss2-tss2_delete.o `test -f 'tools/fapi/tss2_delete.c' || echo '$(srcdir)/'`tools/fapi/tss2_delete.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_delete.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_delete.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_delete.c' object='tools/fapi/tss2-tss2_delete.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_changeauth.obj `if test -f 'tools/fapi/tss2_changeauth.c'; then $(CYGPATH_W) 'tools/fapi/tss2_changeauth.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_changeauth.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_delete.o `test -f 'tools/fapi/tss2_delete.c' || echo '$(srcdir)/'`tools/fapi/tss2_delete.c
 
-tools/fapi/tools_fapi_tss2-tss2_delete.o: tools/fapi/tss2_delete.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_delete.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_delete.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_delete.o `test -f 'tools/fapi/tss2_delete.c' || echo '$(srcdir)/'`tools/fapi/tss2_delete.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_delete.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_delete.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_delete.c' object='tools/fapi/tools_fapi_tss2-tss2_delete.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_delete.obj: tools/fapi/tss2_delete.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_delete.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_delete.Tpo -c -o tools/fapi/tss2-tss2_delete.obj `if test -f 'tools/fapi/tss2_delete.c'; then $(CYGPATH_W) 'tools/fapi/tss2_delete.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_delete.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_delete.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_delete.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_delete.c' object='tools/fapi/tss2-tss2_delete.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_delete.o `test -f 'tools/fapi/tss2_delete.c' || echo '$(srcdir)/'`tools/fapi/tss2_delete.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_delete.obj `if test -f 'tools/fapi/tss2_delete.c'; then $(CYGPATH_W) 'tools/fapi/tss2_delete.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_delete.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_delete.obj: tools/fapi/tss2_delete.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_delete.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_delete.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_delete.obj `if test -f 'tools/fapi/tss2_delete.c'; then $(CYGPATH_W) 'tools/fapi/tss2_delete.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_delete.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_delete.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_delete.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_delete.c' object='tools/fapi/tools_fapi_tss2-tss2_delete.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_import.o: tools/fapi/tss2_import.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_import.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_import.Tpo -c -o tools/fapi/tss2-tss2_import.o `test -f 'tools/fapi/tss2_import.c' || echo '$(srcdir)/'`tools/fapi/tss2_import.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_import.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_import.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_import.c' object='tools/fapi/tss2-tss2_import.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_delete.obj `if test -f 'tools/fapi/tss2_delete.c'; then $(CYGPATH_W) 'tools/fapi/tss2_delete.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_delete.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_import.o `test -f 'tools/fapi/tss2_import.c' || echo '$(srcdir)/'`tools/fapi/tss2_import.c
 
-tools/fapi/tools_fapi_tss2-tss2_import.o: tools/fapi/tss2_import.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_import.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_import.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_import.o `test -f 'tools/fapi/tss2_import.c' || echo '$(srcdir)/'`tools/fapi/tss2_import.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_import.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_import.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_import.c' object='tools/fapi/tools_fapi_tss2-tss2_import.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_import.obj: tools/fapi/tss2_import.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_import.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_import.Tpo -c -o tools/fapi/tss2-tss2_import.obj `if test -f 'tools/fapi/tss2_import.c'; then $(CYGPATH_W) 'tools/fapi/tss2_import.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_import.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_import.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_import.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_import.c' object='tools/fapi/tss2-tss2_import.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_import.o `test -f 'tools/fapi/tss2_import.c' || echo '$(srcdir)/'`tools/fapi/tss2_import.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_import.obj `if test -f 'tools/fapi/tss2_import.c'; then $(CYGPATH_W) 'tools/fapi/tss2_import.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_import.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_import.obj: tools/fapi/tss2_import.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_import.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_import.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_import.obj `if test -f 'tools/fapi/tss2_import.c'; then $(CYGPATH_W) 'tools/fapi/tss2_import.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_import.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_import.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_import.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_import.c' object='tools/fapi/tools_fapi_tss2-tss2_import.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_getinfo.o: tools/fapi/tss2_getinfo.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_getinfo.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_getinfo.Tpo -c -o tools/fapi/tss2-tss2_getinfo.o `test -f 'tools/fapi/tss2_getinfo.c' || echo '$(srcdir)/'`tools/fapi/tss2_getinfo.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_getinfo.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_getinfo.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getinfo.c' object='tools/fapi/tss2-tss2_getinfo.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_import.obj `if test -f 'tools/fapi/tss2_import.c'; then $(CYGPATH_W) 'tools/fapi/tss2_import.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_import.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_getinfo.o `test -f 'tools/fapi/tss2_getinfo.c' || echo '$(srcdir)/'`tools/fapi/tss2_getinfo.c
 
-tools/fapi/tools_fapi_tss2-tss2_getinfo.o: tools/fapi/tss2_getinfo.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_getinfo.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getinfo.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_getinfo.o `test -f 'tools/fapi/tss2_getinfo.c' || echo '$(srcdir)/'`tools/fapi/tss2_getinfo.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getinfo.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getinfo.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getinfo.c' object='tools/fapi/tools_fapi_tss2-tss2_getinfo.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_getinfo.obj: tools/fapi/tss2_getinfo.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_getinfo.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_getinfo.Tpo -c -o tools/fapi/tss2-tss2_getinfo.obj `if test -f 'tools/fapi/tss2_getinfo.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getinfo.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getinfo.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_getinfo.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_getinfo.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getinfo.c' object='tools/fapi/tss2-tss2_getinfo.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_getinfo.o `test -f 'tools/fapi/tss2_getinfo.c' || echo '$(srcdir)/'`tools/fapi/tss2_getinfo.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_getinfo.obj `if test -f 'tools/fapi/tss2_getinfo.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getinfo.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getinfo.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_getinfo.obj: tools/fapi/tss2_getinfo.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_getinfo.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getinfo.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_getinfo.obj `if test -f 'tools/fapi/tss2_getinfo.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getinfo.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getinfo.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getinfo.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getinfo.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getinfo.c' object='tools/fapi/tools_fapi_tss2-tss2_getinfo.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_createkey.o: tools/fapi/tss2_createkey.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_createkey.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_createkey.Tpo -c -o tools/fapi/tss2-tss2_createkey.o `test -f 'tools/fapi/tss2_createkey.c' || echo '$(srcdir)/'`tools/fapi/tss2_createkey.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_createkey.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_createkey.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_createkey.c' object='tools/fapi/tss2-tss2_createkey.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_getinfo.obj `if test -f 'tools/fapi/tss2_getinfo.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getinfo.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getinfo.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_createkey.o `test -f 'tools/fapi/tss2_createkey.c' || echo '$(srcdir)/'`tools/fapi/tss2_createkey.c
 
-tools/fapi/tools_fapi_tss2-tss2_createkey.o: tools/fapi/tss2_createkey.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_createkey.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createkey.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_createkey.o `test -f 'tools/fapi/tss2_createkey.c' || echo '$(srcdir)/'`tools/fapi/tss2_createkey.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createkey.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createkey.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_createkey.c' object='tools/fapi/tools_fapi_tss2-tss2_createkey.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_createkey.obj: tools/fapi/tss2_createkey.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_createkey.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_createkey.Tpo -c -o tools/fapi/tss2-tss2_createkey.obj `if test -f 'tools/fapi/tss2_createkey.c'; then $(CYGPATH_W) 'tools/fapi/tss2_createkey.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_createkey.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_createkey.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_createkey.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_createkey.c' object='tools/fapi/tss2-tss2_createkey.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_createkey.o `test -f 'tools/fapi/tss2_createkey.c' || echo '$(srcdir)/'`tools/fapi/tss2_createkey.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_createkey.obj `if test -f 'tools/fapi/tss2_createkey.c'; then $(CYGPATH_W) 'tools/fapi/tss2_createkey.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_createkey.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_createkey.obj: tools/fapi/tss2_createkey.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_createkey.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createkey.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_createkey.obj `if test -f 'tools/fapi/tss2_createkey.c'; then $(CYGPATH_W) 'tools/fapi/tss2_createkey.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_createkey.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createkey.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createkey.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_createkey.c' object='tools/fapi/tools_fapi_tss2-tss2_createkey.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_createseal.o: tools/fapi/tss2_createseal.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_createseal.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_createseal.Tpo -c -o tools/fapi/tss2-tss2_createseal.o `test -f 'tools/fapi/tss2_createseal.c' || echo '$(srcdir)/'`tools/fapi/tss2_createseal.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_createseal.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_createseal.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_createseal.c' object='tools/fapi/tss2-tss2_createseal.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_createkey.obj `if test -f 'tools/fapi/tss2_createkey.c'; then $(CYGPATH_W) 'tools/fapi/tss2_createkey.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_createkey.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_createseal.o `test -f 'tools/fapi/tss2_createseal.c' || echo '$(srcdir)/'`tools/fapi/tss2_createseal.c
 
-tools/fapi/tools_fapi_tss2-tss2_createseal.o: tools/fapi/tss2_createseal.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_createseal.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createseal.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_createseal.o `test -f 'tools/fapi/tss2_createseal.c' || echo '$(srcdir)/'`tools/fapi/tss2_createseal.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createseal.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createseal.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_createseal.c' object='tools/fapi/tools_fapi_tss2-tss2_createseal.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_createseal.obj: tools/fapi/tss2_createseal.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_createseal.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_createseal.Tpo -c -o tools/fapi/tss2-tss2_createseal.obj `if test -f 'tools/fapi/tss2_createseal.c'; then $(CYGPATH_W) 'tools/fapi/tss2_createseal.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_createseal.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_createseal.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_createseal.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_createseal.c' object='tools/fapi/tss2-tss2_createseal.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_createseal.o `test -f 'tools/fapi/tss2_createseal.c' || echo '$(srcdir)/'`tools/fapi/tss2_createseal.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_createseal.obj `if test -f 'tools/fapi/tss2_createseal.c'; then $(CYGPATH_W) 'tools/fapi/tss2_createseal.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_createseal.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_createseal.obj: tools/fapi/tss2_createseal.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_createseal.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createseal.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_createseal.obj `if test -f 'tools/fapi/tss2_createseal.c'; then $(CYGPATH_W) 'tools/fapi/tss2_createseal.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_createseal.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createseal.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createseal.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_createseal.c' object='tools/fapi/tools_fapi_tss2-tss2_createseal.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_exportkey.o: tools/fapi/tss2_exportkey.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_exportkey.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_exportkey.Tpo -c -o tools/fapi/tss2-tss2_exportkey.o `test -f 'tools/fapi/tss2_exportkey.c' || echo '$(srcdir)/'`tools/fapi/tss2_exportkey.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_exportkey.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_exportkey.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_exportkey.c' object='tools/fapi/tss2-tss2_exportkey.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_createseal.obj `if test -f 'tools/fapi/tss2_createseal.c'; then $(CYGPATH_W) 'tools/fapi/tss2_createseal.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_createseal.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_exportkey.o `test -f 'tools/fapi/tss2_exportkey.c' || echo '$(srcdir)/'`tools/fapi/tss2_exportkey.c
 
-tools/fapi/tools_fapi_tss2-tss2_exportkey.o: tools/fapi/tss2_exportkey.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_exportkey.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportkey.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_exportkey.o `test -f 'tools/fapi/tss2_exportkey.c' || echo '$(srcdir)/'`tools/fapi/tss2_exportkey.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportkey.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportkey.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_exportkey.c' object='tools/fapi/tools_fapi_tss2-tss2_exportkey.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_exportkey.obj: tools/fapi/tss2_exportkey.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_exportkey.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_exportkey.Tpo -c -o tools/fapi/tss2-tss2_exportkey.obj `if test -f 'tools/fapi/tss2_exportkey.c'; then $(CYGPATH_W) 'tools/fapi/tss2_exportkey.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_exportkey.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_exportkey.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_exportkey.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_exportkey.c' object='tools/fapi/tss2-tss2_exportkey.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_exportkey.o `test -f 'tools/fapi/tss2_exportkey.c' || echo '$(srcdir)/'`tools/fapi/tss2_exportkey.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_exportkey.obj `if test -f 'tools/fapi/tss2_exportkey.c'; then $(CYGPATH_W) 'tools/fapi/tss2_exportkey.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_exportkey.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_exportkey.obj: tools/fapi/tss2_exportkey.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_exportkey.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportkey.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_exportkey.obj `if test -f 'tools/fapi/tss2_exportkey.c'; then $(CYGPATH_W) 'tools/fapi/tss2_exportkey.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_exportkey.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportkey.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportkey.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_exportkey.c' object='tools/fapi/tools_fapi_tss2-tss2_exportkey.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_getcertificate.o: tools/fapi/tss2_getcertificate.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_getcertificate.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_getcertificate.Tpo -c -o tools/fapi/tss2-tss2_getcertificate.o `test -f 'tools/fapi/tss2_getcertificate.c' || echo '$(srcdir)/'`tools/fapi/tss2_getcertificate.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_getcertificate.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_getcertificate.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getcertificate.c' object='tools/fapi/tss2-tss2_getcertificate.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_exportkey.obj `if test -f 'tools/fapi/tss2_exportkey.c'; then $(CYGPATH_W) 'tools/fapi/tss2_exportkey.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_exportkey.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_getcertificate.o `test -f 'tools/fapi/tss2_getcertificate.c' || echo '$(srcdir)/'`tools/fapi/tss2_getcertificate.c
 
-tools/fapi/tools_fapi_tss2-tss2_getcertificate.o: tools/fapi/tss2_getcertificate.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_getcertificate.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getcertificate.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_getcertificate.o `test -f 'tools/fapi/tss2_getcertificate.c' || echo '$(srcdir)/'`tools/fapi/tss2_getcertificate.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getcertificate.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getcertificate.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getcertificate.c' object='tools/fapi/tools_fapi_tss2-tss2_getcertificate.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_getcertificate.obj: tools/fapi/tss2_getcertificate.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_getcertificate.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_getcertificate.Tpo -c -o tools/fapi/tss2-tss2_getcertificate.obj `if test -f 'tools/fapi/tss2_getcertificate.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getcertificate.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getcertificate.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_getcertificate.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_getcertificate.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getcertificate.c' object='tools/fapi/tss2-tss2_getcertificate.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_getcertificate.o `test -f 'tools/fapi/tss2_getcertificate.c' || echo '$(srcdir)/'`tools/fapi/tss2_getcertificate.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_getcertificate.obj `if test -f 'tools/fapi/tss2_getcertificate.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getcertificate.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getcertificate.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_getcertificate.obj: tools/fapi/tss2_getcertificate.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_getcertificate.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getcertificate.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_getcertificate.obj `if test -f 'tools/fapi/tss2_getcertificate.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getcertificate.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getcertificate.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getcertificate.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getcertificate.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getcertificate.c' object='tools/fapi/tools_fapi_tss2-tss2_getcertificate.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_getplatformcertificates.o: tools/fapi/tss2_getplatformcertificates.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_getplatformcertificates.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_getplatformcertificates.Tpo -c -o tools/fapi/tss2-tss2_getplatformcertificates.o `test -f 'tools/fapi/tss2_getplatformcertificates.c' || echo '$(srcdir)/'`tools/fapi/tss2_getplatformcertificates.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_getplatformcertificates.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_getplatformcertificates.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getplatformcertificates.c' object='tools/fapi/tss2-tss2_getplatformcertificates.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_getcertificate.obj `if test -f 'tools/fapi/tss2_getcertificate.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getcertificate.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getcertificate.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_getplatformcertificates.o `test -f 'tools/fapi/tss2_getplatformcertificates.c' || echo '$(srcdir)/'`tools/fapi/tss2_getplatformcertificates.c
 
-tools/fapi/tools_fapi_tss2-tss2_getplatformcertificates.o: tools/fapi/tss2_getplatformcertificates.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_getplatformcertificates.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getplatformcertificates.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_getplatformcertificates.o `test -f 'tools/fapi/tss2_getplatformcertificates.c' || echo '$(srcdir)/'`tools/fapi/tss2_getplatformcertificates.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getplatformcertificates.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getplatformcertificates.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getplatformcertificates.c' object='tools/fapi/tools_fapi_tss2-tss2_getplatformcertificates.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_getplatformcertificates.obj: tools/fapi/tss2_getplatformcertificates.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_getplatformcertificates.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_getplatformcertificates.Tpo -c -o tools/fapi/tss2-tss2_getplatformcertificates.obj `if test -f 'tools/fapi/tss2_getplatformcertificates.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getplatformcertificates.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getplatformcertificates.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_getplatformcertificates.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_getplatformcertificates.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getplatformcertificates.c' object='tools/fapi/tss2-tss2_getplatformcertificates.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_getplatformcertificates.o `test -f 'tools/fapi/tss2_getplatformcertificates.c' || echo '$(srcdir)/'`tools/fapi/tss2_getplatformcertificates.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_getplatformcertificates.obj `if test -f 'tools/fapi/tss2_getplatformcertificates.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getplatformcertificates.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getplatformcertificates.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_getplatformcertificates.obj: tools/fapi/tss2_getplatformcertificates.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_getplatformcertificates.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getplatformcertificates.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_getplatformcertificates.obj `if test -f 'tools/fapi/tss2_getplatformcertificates.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getplatformcertificates.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getplatformcertificates.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getplatformcertificates.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getplatformcertificates.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getplatformcertificates.c' object='tools/fapi/tools_fapi_tss2-tss2_getplatformcertificates.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_gettpmblobs.o: tools/fapi/tss2_gettpmblobs.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_gettpmblobs.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_gettpmblobs.Tpo -c -o tools/fapi/tss2-tss2_gettpmblobs.o `test -f 'tools/fapi/tss2_gettpmblobs.c' || echo '$(srcdir)/'`tools/fapi/tss2_gettpmblobs.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_gettpmblobs.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_gettpmblobs.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_gettpmblobs.c' object='tools/fapi/tss2-tss2_gettpmblobs.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_getplatformcertificates.obj `if test -f 'tools/fapi/tss2_getplatformcertificates.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getplatformcertificates.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getplatformcertificates.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_gettpmblobs.o `test -f 'tools/fapi/tss2_gettpmblobs.c' || echo '$(srcdir)/'`tools/fapi/tss2_gettpmblobs.c
 
-tools/fapi/tools_fapi_tss2-tss2_gettpmblobs.o: tools/fapi/tss2_gettpmblobs.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_gettpmblobs.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_gettpmblobs.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_gettpmblobs.o `test -f 'tools/fapi/tss2_gettpmblobs.c' || echo '$(srcdir)/'`tools/fapi/tss2_gettpmblobs.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_gettpmblobs.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_gettpmblobs.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_gettpmblobs.c' object='tools/fapi/tools_fapi_tss2-tss2_gettpmblobs.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_gettpmblobs.obj: tools/fapi/tss2_gettpmblobs.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_gettpmblobs.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_gettpmblobs.Tpo -c -o tools/fapi/tss2-tss2_gettpmblobs.obj `if test -f 'tools/fapi/tss2_gettpmblobs.c'; then $(CYGPATH_W) 'tools/fapi/tss2_gettpmblobs.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_gettpmblobs.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_gettpmblobs.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_gettpmblobs.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_gettpmblobs.c' object='tools/fapi/tss2-tss2_gettpmblobs.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_gettpmblobs.o `test -f 'tools/fapi/tss2_gettpmblobs.c' || echo '$(srcdir)/'`tools/fapi/tss2_gettpmblobs.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_gettpmblobs.obj `if test -f 'tools/fapi/tss2_gettpmblobs.c'; then $(CYGPATH_W) 'tools/fapi/tss2_gettpmblobs.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_gettpmblobs.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_gettpmblobs.obj: tools/fapi/tss2_gettpmblobs.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_gettpmblobs.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_gettpmblobs.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_gettpmblobs.obj `if test -f 'tools/fapi/tss2_gettpmblobs.c'; then $(CYGPATH_W) 'tools/fapi/tss2_gettpmblobs.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_gettpmblobs.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_gettpmblobs.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_gettpmblobs.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_gettpmblobs.c' object='tools/fapi/tools_fapi_tss2-tss2_gettpmblobs.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_getappdata.o: tools/fapi/tss2_getappdata.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_getappdata.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_getappdata.Tpo -c -o tools/fapi/tss2-tss2_getappdata.o `test -f 'tools/fapi/tss2_getappdata.c' || echo '$(srcdir)/'`tools/fapi/tss2_getappdata.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_getappdata.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_getappdata.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getappdata.c' object='tools/fapi/tss2-tss2_getappdata.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_gettpmblobs.obj `if test -f 'tools/fapi/tss2_gettpmblobs.c'; then $(CYGPATH_W) 'tools/fapi/tss2_gettpmblobs.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_gettpmblobs.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_getappdata.o `test -f 'tools/fapi/tss2_getappdata.c' || echo '$(srcdir)/'`tools/fapi/tss2_getappdata.c
 
-tools/fapi/tools_fapi_tss2-tss2_getappdata.o: tools/fapi/tss2_getappdata.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_getappdata.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getappdata.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_getappdata.o `test -f 'tools/fapi/tss2_getappdata.c' || echo '$(srcdir)/'`tools/fapi/tss2_getappdata.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getappdata.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getappdata.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getappdata.c' object='tools/fapi/tools_fapi_tss2-tss2_getappdata.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_getappdata.obj: tools/fapi/tss2_getappdata.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_getappdata.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_getappdata.Tpo -c -o tools/fapi/tss2-tss2_getappdata.obj `if test -f 'tools/fapi/tss2_getappdata.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getappdata.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getappdata.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_getappdata.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_getappdata.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getappdata.c' object='tools/fapi/tss2-tss2_getappdata.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_getappdata.o `test -f 'tools/fapi/tss2_getappdata.c' || echo '$(srcdir)/'`tools/fapi/tss2_getappdata.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_getappdata.obj `if test -f 'tools/fapi/tss2_getappdata.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getappdata.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getappdata.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_getappdata.obj: tools/fapi/tss2_getappdata.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_getappdata.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getappdata.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_getappdata.obj `if test -f 'tools/fapi/tss2_getappdata.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getappdata.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getappdata.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getappdata.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getappdata.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getappdata.c' object='tools/fapi/tools_fapi_tss2-tss2_getappdata.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_gettpm2object.o: tools/fapi/tss2_gettpm2object.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_gettpm2object.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_gettpm2object.Tpo -c -o tools/fapi/tss2-tss2_gettpm2object.o `test -f 'tools/fapi/tss2_gettpm2object.c' || echo '$(srcdir)/'`tools/fapi/tss2_gettpm2object.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_gettpm2object.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_gettpm2object.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_gettpm2object.c' object='tools/fapi/tss2-tss2_gettpm2object.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_getappdata.obj `if test -f 'tools/fapi/tss2_getappdata.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getappdata.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getappdata.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_gettpm2object.o `test -f 'tools/fapi/tss2_gettpm2object.c' || echo '$(srcdir)/'`tools/fapi/tss2_gettpm2object.c
 
-tools/fapi/tools_fapi_tss2-tss2_setappdata.o: tools/fapi/tss2_setappdata.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_setappdata.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setappdata.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_setappdata.o `test -f 'tools/fapi/tss2_setappdata.c' || echo '$(srcdir)/'`tools/fapi/tss2_setappdata.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setappdata.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setappdata.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_setappdata.c' object='tools/fapi/tools_fapi_tss2-tss2_setappdata.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_gettpm2object.obj: tools/fapi/tss2_gettpm2object.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_gettpm2object.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_gettpm2object.Tpo -c -o tools/fapi/tss2-tss2_gettpm2object.obj `if test -f 'tools/fapi/tss2_gettpm2object.c'; then $(CYGPATH_W) 'tools/fapi/tss2_gettpm2object.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_gettpm2object.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_gettpm2object.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_gettpm2object.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_gettpm2object.c' object='tools/fapi/tss2-tss2_gettpm2object.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_setappdata.o `test -f 'tools/fapi/tss2_setappdata.c' || echo '$(srcdir)/'`tools/fapi/tss2_setappdata.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_gettpm2object.obj `if test -f 'tools/fapi/tss2_gettpm2object.c'; then $(CYGPATH_W) 'tools/fapi/tss2_gettpm2object.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_gettpm2object.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_setappdata.obj: tools/fapi/tss2_setappdata.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_setappdata.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setappdata.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_setappdata.obj `if test -f 'tools/fapi/tss2_setappdata.c'; then $(CYGPATH_W) 'tools/fapi/tss2_setappdata.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_setappdata.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setappdata.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setappdata.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_setappdata.c' object='tools/fapi/tools_fapi_tss2-tss2_setappdata.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_setappdata.o: tools/fapi/tss2_setappdata.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_setappdata.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_setappdata.Tpo -c -o tools/fapi/tss2-tss2_setappdata.o `test -f 'tools/fapi/tss2_setappdata.c' || echo '$(srcdir)/'`tools/fapi/tss2_setappdata.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_setappdata.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_setappdata.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_setappdata.c' object='tools/fapi/tss2-tss2_setappdata.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_setappdata.obj `if test -f 'tools/fapi/tss2_setappdata.c'; then $(CYGPATH_W) 'tools/fapi/tss2_setappdata.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_setappdata.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_setappdata.o `test -f 'tools/fapi/tss2_setappdata.c' || echo '$(srcdir)/'`tools/fapi/tss2_setappdata.c
 
-tools/fapi/tools_fapi_tss2-tss2_setcertificate.o: tools/fapi/tss2_setcertificate.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_setcertificate.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setcertificate.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_setcertificate.o `test -f 'tools/fapi/tss2_setcertificate.c' || echo '$(srcdir)/'`tools/fapi/tss2_setcertificate.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setcertificate.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setcertificate.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_setcertificate.c' object='tools/fapi/tools_fapi_tss2-tss2_setcertificate.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_setappdata.obj: tools/fapi/tss2_setappdata.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_setappdata.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_setappdata.Tpo -c -o tools/fapi/tss2-tss2_setappdata.obj `if test -f 'tools/fapi/tss2_setappdata.c'; then $(CYGPATH_W) 'tools/fapi/tss2_setappdata.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_setappdata.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_setappdata.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_setappdata.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_setappdata.c' object='tools/fapi/tss2-tss2_setappdata.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_setcertificate.o `test -f 'tools/fapi/tss2_setcertificate.c' || echo '$(srcdir)/'`tools/fapi/tss2_setcertificate.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_setappdata.obj `if test -f 'tools/fapi/tss2_setappdata.c'; then $(CYGPATH_W) 'tools/fapi/tss2_setappdata.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_setappdata.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_setcertificate.obj: tools/fapi/tss2_setcertificate.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_setcertificate.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setcertificate.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_setcertificate.obj `if test -f 'tools/fapi/tss2_setcertificate.c'; then $(CYGPATH_W) 'tools/fapi/tss2_setcertificate.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_setcertificate.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setcertificate.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setcertificate.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_setcertificate.c' object='tools/fapi/tools_fapi_tss2-tss2_setcertificate.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_setcertificate.o: tools/fapi/tss2_setcertificate.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_setcertificate.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_setcertificate.Tpo -c -o tools/fapi/tss2-tss2_setcertificate.o `test -f 'tools/fapi/tss2_setcertificate.c' || echo '$(srcdir)/'`tools/fapi/tss2_setcertificate.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_setcertificate.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_setcertificate.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_setcertificate.c' object='tools/fapi/tss2-tss2_setcertificate.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_setcertificate.obj `if test -f 'tools/fapi/tss2_setcertificate.c'; then $(CYGPATH_W) 'tools/fapi/tss2_setcertificate.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_setcertificate.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_setcertificate.o `test -f 'tools/fapi/tss2_setcertificate.c' || echo '$(srcdir)/'`tools/fapi/tss2_setcertificate.c
 
-tools/fapi/tools_fapi_tss2-tss2_sign.o: tools/fapi/tss2_sign.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_sign.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_sign.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_sign.o `test -f 'tools/fapi/tss2_sign.c' || echo '$(srcdir)/'`tools/fapi/tss2_sign.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_sign.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_sign.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_sign.c' object='tools/fapi/tools_fapi_tss2-tss2_sign.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_setcertificate.obj: tools/fapi/tss2_setcertificate.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_setcertificate.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_setcertificate.Tpo -c -o tools/fapi/tss2-tss2_setcertificate.obj `if test -f 'tools/fapi/tss2_setcertificate.c'; then $(CYGPATH_W) 'tools/fapi/tss2_setcertificate.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_setcertificate.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_setcertificate.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_setcertificate.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_setcertificate.c' object='tools/fapi/tss2-tss2_setcertificate.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_sign.o `test -f 'tools/fapi/tss2_sign.c' || echo '$(srcdir)/'`tools/fapi/tss2_sign.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_setcertificate.obj `if test -f 'tools/fapi/tss2_setcertificate.c'; then $(CYGPATH_W) 'tools/fapi/tss2_setcertificate.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_setcertificate.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_sign.obj: tools/fapi/tss2_sign.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_sign.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_sign.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_sign.obj `if test -f 'tools/fapi/tss2_sign.c'; then $(CYGPATH_W) 'tools/fapi/tss2_sign.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_sign.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_sign.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_sign.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_sign.c' object='tools/fapi/tools_fapi_tss2-tss2_sign.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_sign.o: tools/fapi/tss2_sign.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_sign.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_sign.Tpo -c -o tools/fapi/tss2-tss2_sign.o `test -f 'tools/fapi/tss2_sign.c' || echo '$(srcdir)/'`tools/fapi/tss2_sign.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_sign.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_sign.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_sign.c' object='tools/fapi/tss2-tss2_sign.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_sign.obj `if test -f 'tools/fapi/tss2_sign.c'; then $(CYGPATH_W) 'tools/fapi/tss2_sign.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_sign.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_sign.o `test -f 'tools/fapi/tss2_sign.c' || echo '$(srcdir)/'`tools/fapi/tss2_sign.c
 
-tools/fapi/tools_fapi_tss2-tss2_verifysignature.o: tools/fapi/tss2_verifysignature.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_verifysignature.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifysignature.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_verifysignature.o `test -f 'tools/fapi/tss2_verifysignature.c' || echo '$(srcdir)/'`tools/fapi/tss2_verifysignature.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifysignature.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifysignature.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_verifysignature.c' object='tools/fapi/tools_fapi_tss2-tss2_verifysignature.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_sign.obj: tools/fapi/tss2_sign.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_sign.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_sign.Tpo -c -o tools/fapi/tss2-tss2_sign.obj `if test -f 'tools/fapi/tss2_sign.c'; then $(CYGPATH_W) 'tools/fapi/tss2_sign.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_sign.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_sign.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_sign.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_sign.c' object='tools/fapi/tss2-tss2_sign.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_verifysignature.o `test -f 'tools/fapi/tss2_verifysignature.c' || echo '$(srcdir)/'`tools/fapi/tss2_verifysignature.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_sign.obj `if test -f 'tools/fapi/tss2_sign.c'; then $(CYGPATH_W) 'tools/fapi/tss2_sign.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_sign.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_verifysignature.obj: tools/fapi/tss2_verifysignature.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_verifysignature.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifysignature.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_verifysignature.obj `if test -f 'tools/fapi/tss2_verifysignature.c'; then $(CYGPATH_W) 'tools/fapi/tss2_verifysignature.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_verifysignature.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifysignature.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifysignature.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_verifysignature.c' object='tools/fapi/tools_fapi_tss2-tss2_verifysignature.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_verifysignature.o: tools/fapi/tss2_verifysignature.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_verifysignature.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_verifysignature.Tpo -c -o tools/fapi/tss2-tss2_verifysignature.o `test -f 'tools/fapi/tss2_verifysignature.c' || echo '$(srcdir)/'`tools/fapi/tss2_verifysignature.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_verifysignature.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_verifysignature.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_verifysignature.c' object='tools/fapi/tss2-tss2_verifysignature.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_verifysignature.obj `if test -f 'tools/fapi/tss2_verifysignature.c'; then $(CYGPATH_W) 'tools/fapi/tss2_verifysignature.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_verifysignature.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_verifysignature.o `test -f 'tools/fapi/tss2_verifysignature.c' || echo '$(srcdir)/'`tools/fapi/tss2_verifysignature.c
 
-tools/fapi/tools_fapi_tss2-tss2_verifyquote.o: tools/fapi/tss2_verifyquote.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_verifyquote.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifyquote.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_verifyquote.o `test -f 'tools/fapi/tss2_verifyquote.c' || echo '$(srcdir)/'`tools/fapi/tss2_verifyquote.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifyquote.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifyquote.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_verifyquote.c' object='tools/fapi/tools_fapi_tss2-tss2_verifyquote.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_verifysignature.obj: tools/fapi/tss2_verifysignature.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_verifysignature.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_verifysignature.Tpo -c -o tools/fapi/tss2-tss2_verifysignature.obj `if test -f 'tools/fapi/tss2_verifysignature.c'; then $(CYGPATH_W) 'tools/fapi/tss2_verifysignature.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_verifysignature.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_verifysignature.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_verifysignature.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_verifysignature.c' object='tools/fapi/tss2-tss2_verifysignature.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_verifyquote.o `test -f 'tools/fapi/tss2_verifyquote.c' || echo '$(srcdir)/'`tools/fapi/tss2_verifyquote.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_verifysignature.obj `if test -f 'tools/fapi/tss2_verifysignature.c'; then $(CYGPATH_W) 'tools/fapi/tss2_verifysignature.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_verifysignature.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_verifyquote.obj: tools/fapi/tss2_verifyquote.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_verifyquote.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifyquote.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_verifyquote.obj `if test -f 'tools/fapi/tss2_verifyquote.c'; then $(CYGPATH_W) 'tools/fapi/tss2_verifyquote.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_verifyquote.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifyquote.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_verifyquote.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_verifyquote.c' object='tools/fapi/tools_fapi_tss2-tss2_verifyquote.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_verifyquote.o: tools/fapi/tss2_verifyquote.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_verifyquote.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_verifyquote.Tpo -c -o tools/fapi/tss2-tss2_verifyquote.o `test -f 'tools/fapi/tss2_verifyquote.c' || echo '$(srcdir)/'`tools/fapi/tss2_verifyquote.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_verifyquote.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_verifyquote.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_verifyquote.c' object='tools/fapi/tss2-tss2_verifyquote.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_verifyquote.obj `if test -f 'tools/fapi/tss2_verifyquote.c'; then $(CYGPATH_W) 'tools/fapi/tss2_verifyquote.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_verifyquote.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_verifyquote.o `test -f 'tools/fapi/tss2_verifyquote.c' || echo '$(srcdir)/'`tools/fapi/tss2_verifyquote.c
 
-tools/fapi/tools_fapi_tss2-tss2_createnv.o: tools/fapi/tss2_createnv.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_createnv.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createnv.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_createnv.o `test -f 'tools/fapi/tss2_createnv.c' || echo '$(srcdir)/'`tools/fapi/tss2_createnv.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createnv.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createnv.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_createnv.c' object='tools/fapi/tools_fapi_tss2-tss2_createnv.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_verifyquote.obj: tools/fapi/tss2_verifyquote.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_verifyquote.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_verifyquote.Tpo -c -o tools/fapi/tss2-tss2_verifyquote.obj `if test -f 'tools/fapi/tss2_verifyquote.c'; then $(CYGPATH_W) 'tools/fapi/tss2_verifyquote.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_verifyquote.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_verifyquote.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_verifyquote.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_verifyquote.c' object='tools/fapi/tss2-tss2_verifyquote.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_createnv.o `test -f 'tools/fapi/tss2_createnv.c' || echo '$(srcdir)/'`tools/fapi/tss2_createnv.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_verifyquote.obj `if test -f 'tools/fapi/tss2_verifyquote.c'; then $(CYGPATH_W) 'tools/fapi/tss2_verifyquote.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_verifyquote.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_createnv.obj: tools/fapi/tss2_createnv.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_createnv.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createnv.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_createnv.obj `if test -f 'tools/fapi/tss2_createnv.c'; then $(CYGPATH_W) 'tools/fapi/tss2_createnv.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_createnv.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createnv.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_createnv.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_createnv.c' object='tools/fapi/tools_fapi_tss2-tss2_createnv.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_createnv.o: tools/fapi/tss2_createnv.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_createnv.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_createnv.Tpo -c -o tools/fapi/tss2-tss2_createnv.o `test -f 'tools/fapi/tss2_createnv.c' || echo '$(srcdir)/'`tools/fapi/tss2_createnv.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_createnv.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_createnv.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_createnv.c' object='tools/fapi/tss2-tss2_createnv.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_createnv.obj `if test -f 'tools/fapi/tss2_createnv.c'; then $(CYGPATH_W) 'tools/fapi/tss2_createnv.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_createnv.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_createnv.o `test -f 'tools/fapi/tss2_createnv.c' || echo '$(srcdir)/'`tools/fapi/tss2_createnv.c
 
-tools/fapi/tools_fapi_tss2-tss2_nvextend.o: tools/fapi/tss2_nvextend.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_nvextend.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvextend.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_nvextend.o `test -f 'tools/fapi/tss2_nvextend.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvextend.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvextend.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvextend.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvextend.c' object='tools/fapi/tools_fapi_tss2-tss2_nvextend.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_createnv.obj: tools/fapi/tss2_createnv.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_createnv.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_createnv.Tpo -c -o tools/fapi/tss2-tss2_createnv.obj `if test -f 'tools/fapi/tss2_createnv.c'; then $(CYGPATH_W) 'tools/fapi/tss2_createnv.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_createnv.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_createnv.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_createnv.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_createnv.c' object='tools/fapi/tss2-tss2_createnv.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_nvextend.o `test -f 'tools/fapi/tss2_nvextend.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvextend.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_createnv.obj `if test -f 'tools/fapi/tss2_createnv.c'; then $(CYGPATH_W) 'tools/fapi/tss2_createnv.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_createnv.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_nvextend.obj: tools/fapi/tss2_nvextend.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_nvextend.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvextend.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_nvextend.obj `if test -f 'tools/fapi/tss2_nvextend.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvextend.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvextend.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvextend.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvextend.c' object='tools/fapi/tools_fapi_tss2-tss2_nvextend.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_nvextend.o: tools/fapi/tss2_nvextend.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_nvextend.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_nvextend.Tpo -c -o tools/fapi/tss2-tss2_nvextend.o `test -f 'tools/fapi/tss2_nvextend.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvextend.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_nvextend.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_nvextend.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvextend.c' object='tools/fapi/tss2-tss2_nvextend.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_nvextend.obj `if test -f 'tools/fapi/tss2_nvextend.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvextend.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_nvextend.o `test -f 'tools/fapi/tss2_nvextend.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvextend.c
 
-tools/fapi/tools_fapi_tss2-tss2_nvincrement.o: tools/fapi/tss2_nvincrement.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_nvincrement.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvincrement.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_nvincrement.o `test -f 'tools/fapi/tss2_nvincrement.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvincrement.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvincrement.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvincrement.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvincrement.c' object='tools/fapi/tools_fapi_tss2-tss2_nvincrement.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_nvextend.obj: tools/fapi/tss2_nvextend.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_nvextend.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_nvextend.Tpo -c -o tools/fapi/tss2-tss2_nvextend.obj `if test -f 'tools/fapi/tss2_nvextend.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvextend.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_nvextend.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_nvextend.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvextend.c' object='tools/fapi/tss2-tss2_nvextend.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_nvincrement.o `test -f 'tools/fapi/tss2_nvincrement.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvincrement.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_nvextend.obj `if test -f 'tools/fapi/tss2_nvextend.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvextend.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_nvincrement.obj: tools/fapi/tss2_nvincrement.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_nvincrement.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvincrement.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_nvincrement.obj `if test -f 'tools/fapi/tss2_nvincrement.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvincrement.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvincrement.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvincrement.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvincrement.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvincrement.c' object='tools/fapi/tools_fapi_tss2-tss2_nvincrement.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_nvincrement.o: tools/fapi/tss2_nvincrement.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_nvincrement.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_nvincrement.Tpo -c -o tools/fapi/tss2-tss2_nvincrement.o `test -f 'tools/fapi/tss2_nvincrement.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvincrement.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_nvincrement.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_nvincrement.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvincrement.c' object='tools/fapi/tss2-tss2_nvincrement.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_nvincrement.obj `if test -f 'tools/fapi/tss2_nvincrement.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvincrement.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvincrement.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_nvincrement.o `test -f 'tools/fapi/tss2_nvincrement.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvincrement.c
 
-tools/fapi/tools_fapi_tss2-tss2_nvread.o: tools/fapi/tss2_nvread.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_nvread.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvread.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_nvread.o `test -f 'tools/fapi/tss2_nvread.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvread.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvread.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvread.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvread.c' object='tools/fapi/tools_fapi_tss2-tss2_nvread.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_nvincrement.obj: tools/fapi/tss2_nvincrement.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_nvincrement.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_nvincrement.Tpo -c -o tools/fapi/tss2-tss2_nvincrement.obj `if test -f 'tools/fapi/tss2_nvincrement.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvincrement.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvincrement.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_nvincrement.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_nvincrement.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvincrement.c' object='tools/fapi/tss2-tss2_nvincrement.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_nvread.o `test -f 'tools/fapi/tss2_nvread.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvread.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_nvincrement.obj `if test -f 'tools/fapi/tss2_nvincrement.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvincrement.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvincrement.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_nvread.obj: tools/fapi/tss2_nvread.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_nvread.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvread.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_nvread.obj `if test -f 'tools/fapi/tss2_nvread.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvread.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvread.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvread.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvread.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvread.c' object='tools/fapi/tools_fapi_tss2-tss2_nvread.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_nvread.o: tools/fapi/tss2_nvread.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_nvread.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_nvread.Tpo -c -o tools/fapi/tss2-tss2_nvread.o `test -f 'tools/fapi/tss2_nvread.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvread.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_nvread.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_nvread.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvread.c' object='tools/fapi/tss2-tss2_nvread.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_nvread.obj `if test -f 'tools/fapi/tss2_nvread.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvread.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvread.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_nvread.o `test -f 'tools/fapi/tss2_nvread.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvread.c
 
-tools/fapi/tools_fapi_tss2-tss2_nvsetbits.o: tools/fapi/tss2_nvsetbits.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_nvsetbits.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvsetbits.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_nvsetbits.o `test -f 'tools/fapi/tss2_nvsetbits.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvsetbits.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvsetbits.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvsetbits.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvsetbits.c' object='tools/fapi/tools_fapi_tss2-tss2_nvsetbits.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_nvread.obj: tools/fapi/tss2_nvread.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_nvread.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_nvread.Tpo -c -o tools/fapi/tss2-tss2_nvread.obj `if test -f 'tools/fapi/tss2_nvread.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvread.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvread.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_nvread.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_nvread.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvread.c' object='tools/fapi/tss2-tss2_nvread.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_nvsetbits.o `test -f 'tools/fapi/tss2_nvsetbits.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvsetbits.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_nvread.obj `if test -f 'tools/fapi/tss2_nvread.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvread.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvread.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_nvsetbits.obj: tools/fapi/tss2_nvsetbits.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_nvsetbits.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvsetbits.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_nvsetbits.obj `if test -f 'tools/fapi/tss2_nvsetbits.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvsetbits.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvsetbits.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvsetbits.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvsetbits.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvsetbits.c' object='tools/fapi/tools_fapi_tss2-tss2_nvsetbits.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_nvsetbits.o: tools/fapi/tss2_nvsetbits.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_nvsetbits.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_nvsetbits.Tpo -c -o tools/fapi/tss2-tss2_nvsetbits.o `test -f 'tools/fapi/tss2_nvsetbits.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvsetbits.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_nvsetbits.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_nvsetbits.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvsetbits.c' object='tools/fapi/tss2-tss2_nvsetbits.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_nvsetbits.obj `if test -f 'tools/fapi/tss2_nvsetbits.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvsetbits.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvsetbits.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_nvsetbits.o `test -f 'tools/fapi/tss2_nvsetbits.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvsetbits.c
 
-tools/fapi/tools_fapi_tss2-tss2_nvwrite.o: tools/fapi/tss2_nvwrite.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_nvwrite.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvwrite.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_nvwrite.o `test -f 'tools/fapi/tss2_nvwrite.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvwrite.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvwrite.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvwrite.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvwrite.c' object='tools/fapi/tools_fapi_tss2-tss2_nvwrite.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_nvsetbits.obj: tools/fapi/tss2_nvsetbits.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_nvsetbits.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_nvsetbits.Tpo -c -o tools/fapi/tss2-tss2_nvsetbits.obj `if test -f 'tools/fapi/tss2_nvsetbits.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvsetbits.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvsetbits.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_nvsetbits.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_nvsetbits.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvsetbits.c' object='tools/fapi/tss2-tss2_nvsetbits.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_nvwrite.o `test -f 'tools/fapi/tss2_nvwrite.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvwrite.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_nvsetbits.obj `if test -f 'tools/fapi/tss2_nvsetbits.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvsetbits.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvsetbits.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_nvwrite.obj: tools/fapi/tss2_nvwrite.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_nvwrite.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvwrite.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_nvwrite.obj `if test -f 'tools/fapi/tss2_nvwrite.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvwrite.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvwrite.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvwrite.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_nvwrite.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvwrite.c' object='tools/fapi/tools_fapi_tss2-tss2_nvwrite.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_nvwrite.o: tools/fapi/tss2_nvwrite.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_nvwrite.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_nvwrite.Tpo -c -o tools/fapi/tss2-tss2_nvwrite.o `test -f 'tools/fapi/tss2_nvwrite.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvwrite.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_nvwrite.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_nvwrite.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvwrite.c' object='tools/fapi/tss2-tss2_nvwrite.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_nvwrite.obj `if test -f 'tools/fapi/tss2_nvwrite.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvwrite.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvwrite.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_nvwrite.o `test -f 'tools/fapi/tss2_nvwrite.c' || echo '$(srcdir)/'`tools/fapi/tss2_nvwrite.c
 
-tools/fapi/tools_fapi_tss2-tss2_getdescription.o: tools/fapi/tss2_getdescription.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_getdescription.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getdescription.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_getdescription.o `test -f 'tools/fapi/tss2_getdescription.c' || echo '$(srcdir)/'`tools/fapi/tss2_getdescription.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getdescription.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getdescription.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getdescription.c' object='tools/fapi/tools_fapi_tss2-tss2_getdescription.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_nvwrite.obj: tools/fapi/tss2_nvwrite.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_nvwrite.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_nvwrite.Tpo -c -o tools/fapi/tss2-tss2_nvwrite.obj `if test -f 'tools/fapi/tss2_nvwrite.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvwrite.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvwrite.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_nvwrite.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_nvwrite.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_nvwrite.c' object='tools/fapi/tss2-tss2_nvwrite.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_getdescription.o `test -f 'tools/fapi/tss2_getdescription.c' || echo '$(srcdir)/'`tools/fapi/tss2_getdescription.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_nvwrite.obj `if test -f 'tools/fapi/tss2_nvwrite.c'; then $(CYGPATH_W) 'tools/fapi/tss2_nvwrite.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_nvwrite.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_getdescription.obj: tools/fapi/tss2_getdescription.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_getdescription.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getdescription.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_getdescription.obj `if test -f 'tools/fapi/tss2_getdescription.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getdescription.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getdescription.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getdescription.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getdescription.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getdescription.c' object='tools/fapi/tools_fapi_tss2-tss2_getdescription.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_getdescription.o: tools/fapi/tss2_getdescription.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_getdescription.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_getdescription.Tpo -c -o tools/fapi/tss2-tss2_getdescription.o `test -f 'tools/fapi/tss2_getdescription.c' || echo '$(srcdir)/'`tools/fapi/tss2_getdescription.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_getdescription.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_getdescription.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getdescription.c' object='tools/fapi/tss2-tss2_getdescription.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_getdescription.obj `if test -f 'tools/fapi/tss2_getdescription.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getdescription.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getdescription.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_getdescription.o `test -f 'tools/fapi/tss2_getdescription.c' || echo '$(srcdir)/'`tools/fapi/tss2_getdescription.c
 
-tools/fapi/tools_fapi_tss2-tss2_setdescription.o: tools/fapi/tss2_setdescription.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_setdescription.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setdescription.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_setdescription.o `test -f 'tools/fapi/tss2_setdescription.c' || echo '$(srcdir)/'`tools/fapi/tss2_setdescription.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setdescription.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setdescription.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_setdescription.c' object='tools/fapi/tools_fapi_tss2-tss2_setdescription.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_getdescription.obj: tools/fapi/tss2_getdescription.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_getdescription.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_getdescription.Tpo -c -o tools/fapi/tss2-tss2_getdescription.obj `if test -f 'tools/fapi/tss2_getdescription.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getdescription.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getdescription.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_getdescription.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_getdescription.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getdescription.c' object='tools/fapi/tss2-tss2_getdescription.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_setdescription.o `test -f 'tools/fapi/tss2_setdescription.c' || echo '$(srcdir)/'`tools/fapi/tss2_setdescription.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_getdescription.obj `if test -f 'tools/fapi/tss2_getdescription.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getdescription.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getdescription.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_setdescription.obj: tools/fapi/tss2_setdescription.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_setdescription.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setdescription.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_setdescription.obj `if test -f 'tools/fapi/tss2_setdescription.c'; then $(CYGPATH_W) 'tools/fapi/tss2_setdescription.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_setdescription.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setdescription.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_setdescription.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_setdescription.c' object='tools/fapi/tools_fapi_tss2-tss2_setdescription.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_setdescription.o: tools/fapi/tss2_setdescription.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_setdescription.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_setdescription.Tpo -c -o tools/fapi/tss2-tss2_setdescription.o `test -f 'tools/fapi/tss2_setdescription.c' || echo '$(srcdir)/'`tools/fapi/tss2_setdescription.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_setdescription.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_setdescription.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_setdescription.c' object='tools/fapi/tss2-tss2_setdescription.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_setdescription.obj `if test -f 'tools/fapi/tss2_setdescription.c'; then $(CYGPATH_W) 'tools/fapi/tss2_setdescription.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_setdescription.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_setdescription.o `test -f 'tools/fapi/tss2_setdescription.c' || echo '$(srcdir)/'`tools/fapi/tss2_setdescription.c
 
-tools/fapi/tools_fapi_tss2-tss2_pcrextend.o: tools/fapi/tss2_pcrextend.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_pcrextend.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrextend.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_pcrextend.o `test -f 'tools/fapi/tss2_pcrextend.c' || echo '$(srcdir)/'`tools/fapi/tss2_pcrextend.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrextend.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrextend.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_pcrextend.c' object='tools/fapi/tools_fapi_tss2-tss2_pcrextend.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_setdescription.obj: tools/fapi/tss2_setdescription.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_setdescription.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_setdescription.Tpo -c -o tools/fapi/tss2-tss2_setdescription.obj `if test -f 'tools/fapi/tss2_setdescription.c'; then $(CYGPATH_W) 'tools/fapi/tss2_setdescription.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_setdescription.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_setdescription.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_setdescription.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_setdescription.c' object='tools/fapi/tss2-tss2_setdescription.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_pcrextend.o `test -f 'tools/fapi/tss2_pcrextend.c' || echo '$(srcdir)/'`tools/fapi/tss2_pcrextend.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_setdescription.obj `if test -f 'tools/fapi/tss2_setdescription.c'; then $(CYGPATH_W) 'tools/fapi/tss2_setdescription.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_setdescription.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_pcrextend.obj: tools/fapi/tss2_pcrextend.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_pcrextend.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrextend.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_pcrextend.obj `if test -f 'tools/fapi/tss2_pcrextend.c'; then $(CYGPATH_W) 'tools/fapi/tss2_pcrextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_pcrextend.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrextend.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrextend.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_pcrextend.c' object='tools/fapi/tools_fapi_tss2-tss2_pcrextend.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_pcrextend.o: tools/fapi/tss2_pcrextend.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_pcrextend.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_pcrextend.Tpo -c -o tools/fapi/tss2-tss2_pcrextend.o `test -f 'tools/fapi/tss2_pcrextend.c' || echo '$(srcdir)/'`tools/fapi/tss2_pcrextend.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_pcrextend.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_pcrextend.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_pcrextend.c' object='tools/fapi/tss2-tss2_pcrextend.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_pcrextend.obj `if test -f 'tools/fapi/tss2_pcrextend.c'; then $(CYGPATH_W) 'tools/fapi/tss2_pcrextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_pcrextend.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_pcrextend.o `test -f 'tools/fapi/tss2_pcrextend.c' || echo '$(srcdir)/'`tools/fapi/tss2_pcrextend.c
 
-tools/fapi/tools_fapi_tss2-tss2_quote.o: tools/fapi/tss2_quote.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_quote.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_quote.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_quote.o `test -f 'tools/fapi/tss2_quote.c' || echo '$(srcdir)/'`tools/fapi/tss2_quote.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_quote.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_quote.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_quote.c' object='tools/fapi/tools_fapi_tss2-tss2_quote.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_pcrextend.obj: tools/fapi/tss2_pcrextend.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_pcrextend.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_pcrextend.Tpo -c -o tools/fapi/tss2-tss2_pcrextend.obj `if test -f 'tools/fapi/tss2_pcrextend.c'; then $(CYGPATH_W) 'tools/fapi/tss2_pcrextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_pcrextend.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_pcrextend.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_pcrextend.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_pcrextend.c' object='tools/fapi/tss2-tss2_pcrextend.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_quote.o `test -f 'tools/fapi/tss2_quote.c' || echo '$(srcdir)/'`tools/fapi/tss2_quote.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_pcrextend.obj `if test -f 'tools/fapi/tss2_pcrextend.c'; then $(CYGPATH_W) 'tools/fapi/tss2_pcrextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_pcrextend.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_quote.obj: tools/fapi/tss2_quote.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_quote.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_quote.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_quote.obj `if test -f 'tools/fapi/tss2_quote.c'; then $(CYGPATH_W) 'tools/fapi/tss2_quote.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_quote.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_quote.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_quote.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_quote.c' object='tools/fapi/tools_fapi_tss2-tss2_quote.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_quote.o: tools/fapi/tss2_quote.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_quote.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_quote.Tpo -c -o tools/fapi/tss2-tss2_quote.o `test -f 'tools/fapi/tss2_quote.c' || echo '$(srcdir)/'`tools/fapi/tss2_quote.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_quote.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_quote.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_quote.c' object='tools/fapi/tss2-tss2_quote.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_quote.obj `if test -f 'tools/fapi/tss2_quote.c'; then $(CYGPATH_W) 'tools/fapi/tss2_quote.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_quote.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_quote.o `test -f 'tools/fapi/tss2_quote.c' || echo '$(srcdir)/'`tools/fapi/tss2_quote.c
 
-tools/fapi/tools_fapi_tss2-tss2_pcrread.o: tools/fapi/tss2_pcrread.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_pcrread.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrread.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_pcrread.o `test -f 'tools/fapi/tss2_pcrread.c' || echo '$(srcdir)/'`tools/fapi/tss2_pcrread.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrread.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrread.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_pcrread.c' object='tools/fapi/tools_fapi_tss2-tss2_pcrread.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_quote.obj: tools/fapi/tss2_quote.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_quote.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_quote.Tpo -c -o tools/fapi/tss2-tss2_quote.obj `if test -f 'tools/fapi/tss2_quote.c'; then $(CYGPATH_W) 'tools/fapi/tss2_quote.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_quote.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_quote.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_quote.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_quote.c' object='tools/fapi/tss2-tss2_quote.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_pcrread.o `test -f 'tools/fapi/tss2_pcrread.c' || echo '$(srcdir)/'`tools/fapi/tss2_pcrread.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_quote.obj `if test -f 'tools/fapi/tss2_quote.c'; then $(CYGPATH_W) 'tools/fapi/tss2_quote.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_quote.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_pcrread.obj: tools/fapi/tss2_pcrread.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_pcrread.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrread.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_pcrread.obj `if test -f 'tools/fapi/tss2_pcrread.c'; then $(CYGPATH_W) 'tools/fapi/tss2_pcrread.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_pcrread.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrread.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_pcrread.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_pcrread.c' object='tools/fapi/tools_fapi_tss2-tss2_pcrread.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_pcrread.o: tools/fapi/tss2_pcrread.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_pcrread.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_pcrread.Tpo -c -o tools/fapi/tss2-tss2_pcrread.o `test -f 'tools/fapi/tss2_pcrread.c' || echo '$(srcdir)/'`tools/fapi/tss2_pcrread.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_pcrread.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_pcrread.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_pcrread.c' object='tools/fapi/tss2-tss2_pcrread.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_pcrread.obj `if test -f 'tools/fapi/tss2_pcrread.c'; then $(CYGPATH_W) 'tools/fapi/tss2_pcrread.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_pcrread.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_pcrread.o `test -f 'tools/fapi/tss2_pcrread.c' || echo '$(srcdir)/'`tools/fapi/tss2_pcrread.c
 
-tools/fapi/tools_fapi_tss2-tss2_authorizepolicy.o: tools/fapi/tss2_authorizepolicy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_authorizepolicy.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_authorizepolicy.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_authorizepolicy.o `test -f 'tools/fapi/tss2_authorizepolicy.c' || echo '$(srcdir)/'`tools/fapi/tss2_authorizepolicy.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_authorizepolicy.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_authorizepolicy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_authorizepolicy.c' object='tools/fapi/tools_fapi_tss2-tss2_authorizepolicy.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_pcrread.obj: tools/fapi/tss2_pcrread.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_pcrread.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_pcrread.Tpo -c -o tools/fapi/tss2-tss2_pcrread.obj `if test -f 'tools/fapi/tss2_pcrread.c'; then $(CYGPATH_W) 'tools/fapi/tss2_pcrread.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_pcrread.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_pcrread.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_pcrread.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_pcrread.c' object='tools/fapi/tss2-tss2_pcrread.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_authorizepolicy.o `test -f 'tools/fapi/tss2_authorizepolicy.c' || echo '$(srcdir)/'`tools/fapi/tss2_authorizepolicy.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_pcrread.obj `if test -f 'tools/fapi/tss2_pcrread.c'; then $(CYGPATH_W) 'tools/fapi/tss2_pcrread.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_pcrread.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_authorizepolicy.obj: tools/fapi/tss2_authorizepolicy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_authorizepolicy.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_authorizepolicy.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_authorizepolicy.obj `if test -f 'tools/fapi/tss2_authorizepolicy.c'; then $(CYGPATH_W) 'tools/fapi/tss2_authorizepolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_authorizepolicy.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_authorizepolicy.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_authorizepolicy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_authorizepolicy.c' object='tools/fapi/tools_fapi_tss2-tss2_authorizepolicy.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_authorizepolicy.o: tools/fapi/tss2_authorizepolicy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_authorizepolicy.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_authorizepolicy.Tpo -c -o tools/fapi/tss2-tss2_authorizepolicy.o `test -f 'tools/fapi/tss2_authorizepolicy.c' || echo '$(srcdir)/'`tools/fapi/tss2_authorizepolicy.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_authorizepolicy.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_authorizepolicy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_authorizepolicy.c' object='tools/fapi/tss2-tss2_authorizepolicy.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_authorizepolicy.obj `if test -f 'tools/fapi/tss2_authorizepolicy.c'; then $(CYGPATH_W) 'tools/fapi/tss2_authorizepolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_authorizepolicy.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_authorizepolicy.o `test -f 'tools/fapi/tss2_authorizepolicy.c' || echo '$(srcdir)/'`tools/fapi/tss2_authorizepolicy.c
 
-tools/fapi/tools_fapi_tss2-tss2_exportpolicy.o: tools/fapi/tss2_exportpolicy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_exportpolicy.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportpolicy.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_exportpolicy.o `test -f 'tools/fapi/tss2_exportpolicy.c' || echo '$(srcdir)/'`tools/fapi/tss2_exportpolicy.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportpolicy.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportpolicy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_exportpolicy.c' object='tools/fapi/tools_fapi_tss2-tss2_exportpolicy.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_authorizepolicy.obj: tools/fapi/tss2_authorizepolicy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_authorizepolicy.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_authorizepolicy.Tpo -c -o tools/fapi/tss2-tss2_authorizepolicy.obj `if test -f 'tools/fapi/tss2_authorizepolicy.c'; then $(CYGPATH_W) 'tools/fapi/tss2_authorizepolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_authorizepolicy.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_authorizepolicy.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_authorizepolicy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_authorizepolicy.c' object='tools/fapi/tss2-tss2_authorizepolicy.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_exportpolicy.o `test -f 'tools/fapi/tss2_exportpolicy.c' || echo '$(srcdir)/'`tools/fapi/tss2_exportpolicy.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_authorizepolicy.obj `if test -f 'tools/fapi/tss2_authorizepolicy.c'; then $(CYGPATH_W) 'tools/fapi/tss2_authorizepolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_authorizepolicy.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_exportpolicy.obj: tools/fapi/tss2_exportpolicy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_exportpolicy.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportpolicy.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_exportpolicy.obj `if test -f 'tools/fapi/tss2_exportpolicy.c'; then $(CYGPATH_W) 'tools/fapi/tss2_exportpolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_exportpolicy.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportpolicy.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_exportpolicy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_exportpolicy.c' object='tools/fapi/tools_fapi_tss2-tss2_exportpolicy.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_exportpolicy.o: tools/fapi/tss2_exportpolicy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_exportpolicy.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_exportpolicy.Tpo -c -o tools/fapi/tss2-tss2_exportpolicy.o `test -f 'tools/fapi/tss2_exportpolicy.c' || echo '$(srcdir)/'`tools/fapi/tss2_exportpolicy.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_exportpolicy.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_exportpolicy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_exportpolicy.c' object='tools/fapi/tss2-tss2_exportpolicy.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_exportpolicy.obj `if test -f 'tools/fapi/tss2_exportpolicy.c'; then $(CYGPATH_W) 'tools/fapi/tss2_exportpolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_exportpolicy.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_exportpolicy.o `test -f 'tools/fapi/tss2_exportpolicy.c' || echo '$(srcdir)/'`tools/fapi/tss2_exportpolicy.c
 
-tools/fapi/tools_fapi_tss2-tss2_provision.o: tools/fapi/tss2_provision.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_provision.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_provision.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_provision.o `test -f 'tools/fapi/tss2_provision.c' || echo '$(srcdir)/'`tools/fapi/tss2_provision.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_provision.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_provision.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_provision.c' object='tools/fapi/tools_fapi_tss2-tss2_provision.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_exportpolicy.obj: tools/fapi/tss2_exportpolicy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_exportpolicy.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_exportpolicy.Tpo -c -o tools/fapi/tss2-tss2_exportpolicy.obj `if test -f 'tools/fapi/tss2_exportpolicy.c'; then $(CYGPATH_W) 'tools/fapi/tss2_exportpolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_exportpolicy.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_exportpolicy.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_exportpolicy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_exportpolicy.c' object='tools/fapi/tss2-tss2_exportpolicy.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_provision.o `test -f 'tools/fapi/tss2_provision.c' || echo '$(srcdir)/'`tools/fapi/tss2_provision.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_exportpolicy.obj `if test -f 'tools/fapi/tss2_exportpolicy.c'; then $(CYGPATH_W) 'tools/fapi/tss2_exportpolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_exportpolicy.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_provision.obj: tools/fapi/tss2_provision.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_provision.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_provision.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_provision.obj `if test -f 'tools/fapi/tss2_provision.c'; then $(CYGPATH_W) 'tools/fapi/tss2_provision.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_provision.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_provision.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_provision.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_provision.c' object='tools/fapi/tools_fapi_tss2-tss2_provision.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_provision.o: tools/fapi/tss2_provision.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_provision.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_provision.Tpo -c -o tools/fapi/tss2-tss2_provision.o `test -f 'tools/fapi/tss2_provision.c' || echo '$(srcdir)/'`tools/fapi/tss2_provision.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_provision.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_provision.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_provision.c' object='tools/fapi/tss2-tss2_provision.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_provision.obj `if test -f 'tools/fapi/tss2_provision.c'; then $(CYGPATH_W) 'tools/fapi/tss2_provision.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_provision.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_provision.o `test -f 'tools/fapi/tss2_provision.c' || echo '$(srcdir)/'`tools/fapi/tss2_provision.c
 
-tools/fapi/tools_fapi_tss2-tss2_getrandom.o: tools/fapi/tss2_getrandom.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_getrandom.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getrandom.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_getrandom.o `test -f 'tools/fapi/tss2_getrandom.c' || echo '$(srcdir)/'`tools/fapi/tss2_getrandom.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getrandom.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getrandom.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getrandom.c' object='tools/fapi/tools_fapi_tss2-tss2_getrandom.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_provision.obj: tools/fapi/tss2_provision.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_provision.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_provision.Tpo -c -o tools/fapi/tss2-tss2_provision.obj `if test -f 'tools/fapi/tss2_provision.c'; then $(CYGPATH_W) 'tools/fapi/tss2_provision.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_provision.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_provision.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_provision.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_provision.c' object='tools/fapi/tss2-tss2_provision.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_getrandom.o `test -f 'tools/fapi/tss2_getrandom.c' || echo '$(srcdir)/'`tools/fapi/tss2_getrandom.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_provision.obj `if test -f 'tools/fapi/tss2_provision.c'; then $(CYGPATH_W) 'tools/fapi/tss2_provision.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_provision.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_getrandom.obj: tools/fapi/tss2_getrandom.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_getrandom.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getrandom.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_getrandom.obj `if test -f 'tools/fapi/tss2_getrandom.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getrandom.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getrandom.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getrandom.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_getrandom.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getrandom.c' object='tools/fapi/tools_fapi_tss2-tss2_getrandom.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_getrandom.o: tools/fapi/tss2_getrandom.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_getrandom.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_getrandom.Tpo -c -o tools/fapi/tss2-tss2_getrandom.o `test -f 'tools/fapi/tss2_getrandom.c' || echo '$(srcdir)/'`tools/fapi/tss2_getrandom.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_getrandom.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_getrandom.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getrandom.c' object='tools/fapi/tss2-tss2_getrandom.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_getrandom.obj `if test -f 'tools/fapi/tss2_getrandom.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getrandom.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getrandom.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_getrandom.o `test -f 'tools/fapi/tss2_getrandom.c' || echo '$(srcdir)/'`tools/fapi/tss2_getrandom.c
 
-tools/fapi/tools_fapi_tss2-tss2_unseal.o: tools/fapi/tss2_unseal.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_unseal.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_unseal.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_unseal.o `test -f 'tools/fapi/tss2_unseal.c' || echo '$(srcdir)/'`tools/fapi/tss2_unseal.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_unseal.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_unseal.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_unseal.c' object='tools/fapi/tools_fapi_tss2-tss2_unseal.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_getrandom.obj: tools/fapi/tss2_getrandom.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_getrandom.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_getrandom.Tpo -c -o tools/fapi/tss2-tss2_getrandom.obj `if test -f 'tools/fapi/tss2_getrandom.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getrandom.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getrandom.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_getrandom.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_getrandom.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_getrandom.c' object='tools/fapi/tss2-tss2_getrandom.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_unseal.o `test -f 'tools/fapi/tss2_unseal.c' || echo '$(srcdir)/'`tools/fapi/tss2_unseal.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_getrandom.obj `if test -f 'tools/fapi/tss2_getrandom.c'; then $(CYGPATH_W) 'tools/fapi/tss2_getrandom.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_getrandom.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_unseal.obj: tools/fapi/tss2_unseal.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_unseal.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_unseal.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_unseal.obj `if test -f 'tools/fapi/tss2_unseal.c'; then $(CYGPATH_W) 'tools/fapi/tss2_unseal.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_unseal.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_unseal.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_unseal.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_unseal.c' object='tools/fapi/tools_fapi_tss2-tss2_unseal.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_unseal.o: tools/fapi/tss2_unseal.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_unseal.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_unseal.Tpo -c -o tools/fapi/tss2-tss2_unseal.o `test -f 'tools/fapi/tss2_unseal.c' || echo '$(srcdir)/'`tools/fapi/tss2_unseal.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_unseal.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_unseal.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_unseal.c' object='tools/fapi/tss2-tss2_unseal.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_unseal.obj `if test -f 'tools/fapi/tss2_unseal.c'; then $(CYGPATH_W) 'tools/fapi/tss2_unseal.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_unseal.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_unseal.o `test -f 'tools/fapi/tss2_unseal.c' || echo '$(srcdir)/'`tools/fapi/tss2_unseal.c
 
-tools/fapi/tools_fapi_tss2-tss2_writeauthorizenv.o: tools/fapi/tss2_writeauthorizenv.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_writeauthorizenv.o -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_writeauthorizenv.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_writeauthorizenv.o `test -f 'tools/fapi/tss2_writeauthorizenv.c' || echo '$(srcdir)/'`tools/fapi/tss2_writeauthorizenv.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_writeauthorizenv.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_writeauthorizenv.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_writeauthorizenv.c' object='tools/fapi/tools_fapi_tss2-tss2_writeauthorizenv.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_unseal.obj: tools/fapi/tss2_unseal.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_unseal.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_unseal.Tpo -c -o tools/fapi/tss2-tss2_unseal.obj `if test -f 'tools/fapi/tss2_unseal.c'; then $(CYGPATH_W) 'tools/fapi/tss2_unseal.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_unseal.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_unseal.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_unseal.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_unseal.c' object='tools/fapi/tss2-tss2_unseal.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_writeauthorizenv.o `test -f 'tools/fapi/tss2_writeauthorizenv.c' || echo '$(srcdir)/'`tools/fapi/tss2_writeauthorizenv.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_unseal.obj `if test -f 'tools/fapi/tss2_unseal.c'; then $(CYGPATH_W) 'tools/fapi/tss2_unseal.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_unseal.c'; fi`
 
-tools/fapi/tools_fapi_tss2-tss2_writeauthorizenv.obj: tools/fapi/tss2_writeauthorizenv.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tools_fapi_tss2-tss2_writeauthorizenv.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_writeauthorizenv.Tpo -c -o tools/fapi/tools_fapi_tss2-tss2_writeauthorizenv.obj `if test -f 'tools/fapi/tss2_writeauthorizenv.c'; then $(CYGPATH_W) 'tools/fapi/tss2_writeauthorizenv.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_writeauthorizenv.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_writeauthorizenv.Tpo tools/fapi/$(DEPDIR)/tools_fapi_tss2-tss2_writeauthorizenv.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_writeauthorizenv.c' object='tools/fapi/tools_fapi_tss2-tss2_writeauthorizenv.obj' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_writeauthorizenv.o: tools/fapi/tss2_writeauthorizenv.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_writeauthorizenv.o -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_writeauthorizenv.Tpo -c -o tools/fapi/tss2-tss2_writeauthorizenv.o `test -f 'tools/fapi/tss2_writeauthorizenv.c' || echo '$(srcdir)/'`tools/fapi/tss2_writeauthorizenv.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_writeauthorizenv.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_writeauthorizenv.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_writeauthorizenv.c' object='tools/fapi/tss2-tss2_writeauthorizenv.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tools_fapi_tss2-tss2_writeauthorizenv.obj `if test -f 'tools/fapi/tss2_writeauthorizenv.c'; then $(CYGPATH_W) 'tools/fapi/tss2_writeauthorizenv.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_writeauthorizenv.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_writeauthorizenv.o `test -f 'tools/fapi/tss2_writeauthorizenv.c' || echo '$(srcdir)/'`tools/fapi/tss2_writeauthorizenv.c
 
-tools/tools_tpm2-tpm2_tool.o: tools/tpm2_tool.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_tool.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_tool.Tpo -c -o tools/tools_tpm2-tpm2_tool.o `test -f 'tools/tpm2_tool.c' || echo '$(srcdir)/'`tools/tpm2_tool.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_tool.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_tool.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_tool.c' object='tools/tools_tpm2-tpm2_tool.o' libtool=no @AMDEPBACKSLASH@
+tools/fapi/tss2-tss2_writeauthorizenv.obj: tools/fapi/tss2_writeauthorizenv.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -MT tools/fapi/tss2-tss2_writeauthorizenv.obj -MD -MP -MF tools/fapi/$(DEPDIR)/tss2-tss2_writeauthorizenv.Tpo -c -o tools/fapi/tss2-tss2_writeauthorizenv.obj `if test -f 'tools/fapi/tss2_writeauthorizenv.c'; then $(CYGPATH_W) 'tools/fapi/tss2_writeauthorizenv.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_writeauthorizenv.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/fapi/$(DEPDIR)/tss2-tss2_writeauthorizenv.Tpo tools/fapi/$(DEPDIR)/tss2-tss2_writeauthorizenv.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/fapi/tss2_writeauthorizenv.c' object='tools/fapi/tss2-tss2_writeauthorizenv.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_tool.o `test -f 'tools/tpm2_tool.c' || echo '$(srcdir)/'`tools/tpm2_tool.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_fapi_tss2_CFLAGS) $(CFLAGS) -c -o tools/fapi/tss2-tss2_writeauthorizenv.obj `if test -f 'tools/fapi/tss2_writeauthorizenv.c'; then $(CYGPATH_W) 'tools/fapi/tss2_writeauthorizenv.c'; else $(CYGPATH_W) '$(srcdir)/tools/fapi/tss2_writeauthorizenv.c'; fi`
 
-tools/tools_tpm2-tpm2_tool.obj: tools/tpm2_tool.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_tool.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_tool.Tpo -c -o tools/tools_tpm2-tpm2_tool.obj `if test -f 'tools/tpm2_tool.c'; then $(CYGPATH_W) 'tools/tpm2_tool.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_tool.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_tool.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_tool.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_tool.c' object='tools/tools_tpm2-tpm2_tool.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_tool.o: tools/tpm2_tool.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_tool.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_tool.Tpo -c -o tools/tpm2-tpm2_tool.o `test -f 'tools/tpm2_tool.c' || echo '$(srcdir)/'`tools/tpm2_tool.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_tool.Tpo tools/$(DEPDIR)/tpm2-tpm2_tool.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_tool.c' object='tools/tpm2-tpm2_tool.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_tool.obj `if test -f 'tools/tpm2_tool.c'; then $(CYGPATH_W) 'tools/tpm2_tool.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_tool.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_tool.o `test -f 'tools/tpm2_tool.c' || echo '$(srcdir)/'`tools/tpm2_tool.c
 
-tools/misc/tools_tpm2-tpm2_certifyX509certutil.o: tools/misc/tpm2_certifyX509certutil.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tools_tpm2-tpm2_certifyX509certutil.o -MD -MP -MF tools/misc/$(DEPDIR)/tools_tpm2-tpm2_certifyX509certutil.Tpo -c -o tools/misc/tools_tpm2-tpm2_certifyX509certutil.o `test -f 'tools/misc/tpm2_certifyX509certutil.c' || echo '$(srcdir)/'`tools/misc/tpm2_certifyX509certutil.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tools_tpm2-tpm2_certifyX509certutil.Tpo tools/misc/$(DEPDIR)/tools_tpm2-tpm2_certifyX509certutil.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_certifyX509certutil.c' object='tools/misc/tools_tpm2-tpm2_certifyX509certutil.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_tool.obj: tools/tpm2_tool.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_tool.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_tool.Tpo -c -o tools/tpm2-tpm2_tool.obj `if test -f 'tools/tpm2_tool.c'; then $(CYGPATH_W) 'tools/tpm2_tool.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_tool.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_tool.Tpo tools/$(DEPDIR)/tpm2-tpm2_tool.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_tool.c' object='tools/tpm2-tpm2_tool.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tools_tpm2-tpm2_certifyX509certutil.o `test -f 'tools/misc/tpm2_certifyX509certutil.c' || echo '$(srcdir)/'`tools/misc/tpm2_certifyX509certutil.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_tool.obj `if test -f 'tools/tpm2_tool.c'; then $(CYGPATH_W) 'tools/tpm2_tool.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_tool.c'; fi`
 
-tools/misc/tools_tpm2-tpm2_certifyX509certutil.obj: tools/misc/tpm2_certifyX509certutil.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tools_tpm2-tpm2_certifyX509certutil.obj -MD -MP -MF tools/misc/$(DEPDIR)/tools_tpm2-tpm2_certifyX509certutil.Tpo -c -o tools/misc/tools_tpm2-tpm2_certifyX509certutil.obj `if test -f 'tools/misc/tpm2_certifyX509certutil.c'; then $(CYGPATH_W) 'tools/misc/tpm2_certifyX509certutil.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_certifyX509certutil.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tools_tpm2-tpm2_certifyX509certutil.Tpo tools/misc/$(DEPDIR)/tools_tpm2-tpm2_certifyX509certutil.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_certifyX509certutil.c' object='tools/misc/tools_tpm2-tpm2_certifyX509certutil.obj' libtool=no @AMDEPBACKSLASH@
+tools/misc/tpm2-tpm2_certifyX509certutil.o: tools/misc/tpm2_certifyX509certutil.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tpm2-tpm2_certifyX509certutil.o -MD -MP -MF tools/misc/$(DEPDIR)/tpm2-tpm2_certifyX509certutil.Tpo -c -o tools/misc/tpm2-tpm2_certifyX509certutil.o `test -f 'tools/misc/tpm2_certifyX509certutil.c' || echo '$(srcdir)/'`tools/misc/tpm2_certifyX509certutil.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tpm2-tpm2_certifyX509certutil.Tpo tools/misc/$(DEPDIR)/tpm2-tpm2_certifyX509certutil.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_certifyX509certutil.c' object='tools/misc/tpm2-tpm2_certifyX509certutil.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tools_tpm2-tpm2_certifyX509certutil.obj `if test -f 'tools/misc/tpm2_certifyX509certutil.c'; then $(CYGPATH_W) 'tools/misc/tpm2_certifyX509certutil.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_certifyX509certutil.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tpm2-tpm2_certifyX509certutil.o `test -f 'tools/misc/tpm2_certifyX509certutil.c' || echo '$(srcdir)/'`tools/misc/tpm2_certifyX509certutil.c
 
-tools/misc/tools_tpm2-tpm2_checkquote.o: tools/misc/tpm2_checkquote.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tools_tpm2-tpm2_checkquote.o -MD -MP -MF tools/misc/$(DEPDIR)/tools_tpm2-tpm2_checkquote.Tpo -c -o tools/misc/tools_tpm2-tpm2_checkquote.o `test -f 'tools/misc/tpm2_checkquote.c' || echo '$(srcdir)/'`tools/misc/tpm2_checkquote.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tools_tpm2-tpm2_checkquote.Tpo tools/misc/$(DEPDIR)/tools_tpm2-tpm2_checkquote.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_checkquote.c' object='tools/misc/tools_tpm2-tpm2_checkquote.o' libtool=no @AMDEPBACKSLASH@
+tools/misc/tpm2-tpm2_certifyX509certutil.obj: tools/misc/tpm2_certifyX509certutil.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tpm2-tpm2_certifyX509certutil.obj -MD -MP -MF tools/misc/$(DEPDIR)/tpm2-tpm2_certifyX509certutil.Tpo -c -o tools/misc/tpm2-tpm2_certifyX509certutil.obj `if test -f 'tools/misc/tpm2_certifyX509certutil.c'; then $(CYGPATH_W) 'tools/misc/tpm2_certifyX509certutil.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_certifyX509certutil.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tpm2-tpm2_certifyX509certutil.Tpo tools/misc/$(DEPDIR)/tpm2-tpm2_certifyX509certutil.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_certifyX509certutil.c' object='tools/misc/tpm2-tpm2_certifyX509certutil.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tools_tpm2-tpm2_checkquote.o `test -f 'tools/misc/tpm2_checkquote.c' || echo '$(srcdir)/'`tools/misc/tpm2_checkquote.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tpm2-tpm2_certifyX509certutil.obj `if test -f 'tools/misc/tpm2_certifyX509certutil.c'; then $(CYGPATH_W) 'tools/misc/tpm2_certifyX509certutil.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_certifyX509certutil.c'; fi`
 
-tools/misc/tools_tpm2-tpm2_checkquote.obj: tools/misc/tpm2_checkquote.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tools_tpm2-tpm2_checkquote.obj -MD -MP -MF tools/misc/$(DEPDIR)/tools_tpm2-tpm2_checkquote.Tpo -c -o tools/misc/tools_tpm2-tpm2_checkquote.obj `if test -f 'tools/misc/tpm2_checkquote.c'; then $(CYGPATH_W) 'tools/misc/tpm2_checkquote.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_checkquote.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tools_tpm2-tpm2_checkquote.Tpo tools/misc/$(DEPDIR)/tools_tpm2-tpm2_checkquote.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_checkquote.c' object='tools/misc/tools_tpm2-tpm2_checkquote.obj' libtool=no @AMDEPBACKSLASH@
+tools/misc/tpm2-tpm2_checkquote.o: tools/misc/tpm2_checkquote.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tpm2-tpm2_checkquote.o -MD -MP -MF tools/misc/$(DEPDIR)/tpm2-tpm2_checkquote.Tpo -c -o tools/misc/tpm2-tpm2_checkquote.o `test -f 'tools/misc/tpm2_checkquote.c' || echo '$(srcdir)/'`tools/misc/tpm2_checkquote.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tpm2-tpm2_checkquote.Tpo tools/misc/$(DEPDIR)/tpm2-tpm2_checkquote.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_checkquote.c' object='tools/misc/tpm2-tpm2_checkquote.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tools_tpm2-tpm2_checkquote.obj `if test -f 'tools/misc/tpm2_checkquote.c'; then $(CYGPATH_W) 'tools/misc/tpm2_checkquote.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_checkquote.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tpm2-tpm2_checkquote.o `test -f 'tools/misc/tpm2_checkquote.c' || echo '$(srcdir)/'`tools/misc/tpm2_checkquote.c
 
-tools/misc/tools_tpm2-tpm2_eventlog.o: tools/misc/tpm2_eventlog.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tools_tpm2-tpm2_eventlog.o -MD -MP -MF tools/misc/$(DEPDIR)/tools_tpm2-tpm2_eventlog.Tpo -c -o tools/misc/tools_tpm2-tpm2_eventlog.o `test -f 'tools/misc/tpm2_eventlog.c' || echo '$(srcdir)/'`tools/misc/tpm2_eventlog.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tools_tpm2-tpm2_eventlog.Tpo tools/misc/$(DEPDIR)/tools_tpm2-tpm2_eventlog.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_eventlog.c' object='tools/misc/tools_tpm2-tpm2_eventlog.o' libtool=no @AMDEPBACKSLASH@
+tools/misc/tpm2-tpm2_checkquote.obj: tools/misc/tpm2_checkquote.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tpm2-tpm2_checkquote.obj -MD -MP -MF tools/misc/$(DEPDIR)/tpm2-tpm2_checkquote.Tpo -c -o tools/misc/tpm2-tpm2_checkquote.obj `if test -f 'tools/misc/tpm2_checkquote.c'; then $(CYGPATH_W) 'tools/misc/tpm2_checkquote.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_checkquote.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tpm2-tpm2_checkquote.Tpo tools/misc/$(DEPDIR)/tpm2-tpm2_checkquote.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_checkquote.c' object='tools/misc/tpm2-tpm2_checkquote.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tools_tpm2-tpm2_eventlog.o `test -f 'tools/misc/tpm2_eventlog.c' || echo '$(srcdir)/'`tools/misc/tpm2_eventlog.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tpm2-tpm2_checkquote.obj `if test -f 'tools/misc/tpm2_checkquote.c'; then $(CYGPATH_W) 'tools/misc/tpm2_checkquote.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_checkquote.c'; fi`
 
-tools/misc/tools_tpm2-tpm2_eventlog.obj: tools/misc/tpm2_eventlog.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tools_tpm2-tpm2_eventlog.obj -MD -MP -MF tools/misc/$(DEPDIR)/tools_tpm2-tpm2_eventlog.Tpo -c -o tools/misc/tools_tpm2-tpm2_eventlog.obj `if test -f 'tools/misc/tpm2_eventlog.c'; then $(CYGPATH_W) 'tools/misc/tpm2_eventlog.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_eventlog.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tools_tpm2-tpm2_eventlog.Tpo tools/misc/$(DEPDIR)/tools_tpm2-tpm2_eventlog.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_eventlog.c' object='tools/misc/tools_tpm2-tpm2_eventlog.obj' libtool=no @AMDEPBACKSLASH@
+tools/misc/tpm2-tpm2_encodeobject.o: tools/misc/tpm2_encodeobject.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tpm2-tpm2_encodeobject.o -MD -MP -MF tools/misc/$(DEPDIR)/tpm2-tpm2_encodeobject.Tpo -c -o tools/misc/tpm2-tpm2_encodeobject.o `test -f 'tools/misc/tpm2_encodeobject.c' || echo '$(srcdir)/'`tools/misc/tpm2_encodeobject.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tpm2-tpm2_encodeobject.Tpo tools/misc/$(DEPDIR)/tpm2-tpm2_encodeobject.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_encodeobject.c' object='tools/misc/tpm2-tpm2_encodeobject.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tools_tpm2-tpm2_eventlog.obj `if test -f 'tools/misc/tpm2_eventlog.c'; then $(CYGPATH_W) 'tools/misc/tpm2_eventlog.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_eventlog.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tpm2-tpm2_encodeobject.o `test -f 'tools/misc/tpm2_encodeobject.c' || echo '$(srcdir)/'`tools/misc/tpm2_encodeobject.c
 
-tools/misc/tools_tpm2-tpm2_print.o: tools/misc/tpm2_print.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tools_tpm2-tpm2_print.o -MD -MP -MF tools/misc/$(DEPDIR)/tools_tpm2-tpm2_print.Tpo -c -o tools/misc/tools_tpm2-tpm2_print.o `test -f 'tools/misc/tpm2_print.c' || echo '$(srcdir)/'`tools/misc/tpm2_print.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tools_tpm2-tpm2_print.Tpo tools/misc/$(DEPDIR)/tools_tpm2-tpm2_print.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_print.c' object='tools/misc/tools_tpm2-tpm2_print.o' libtool=no @AMDEPBACKSLASH@
+tools/misc/tpm2-tpm2_encodeobject.obj: tools/misc/tpm2_encodeobject.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tpm2-tpm2_encodeobject.obj -MD -MP -MF tools/misc/$(DEPDIR)/tpm2-tpm2_encodeobject.Tpo -c -o tools/misc/tpm2-tpm2_encodeobject.obj `if test -f 'tools/misc/tpm2_encodeobject.c'; then $(CYGPATH_W) 'tools/misc/tpm2_encodeobject.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_encodeobject.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tpm2-tpm2_encodeobject.Tpo tools/misc/$(DEPDIR)/tpm2-tpm2_encodeobject.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_encodeobject.c' object='tools/misc/tpm2-tpm2_encodeobject.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tools_tpm2-tpm2_print.o `test -f 'tools/misc/tpm2_print.c' || echo '$(srcdir)/'`tools/misc/tpm2_print.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tpm2-tpm2_encodeobject.obj `if test -f 'tools/misc/tpm2_encodeobject.c'; then $(CYGPATH_W) 'tools/misc/tpm2_encodeobject.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_encodeobject.c'; fi`
 
-tools/misc/tools_tpm2-tpm2_print.obj: tools/misc/tpm2_print.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tools_tpm2-tpm2_print.obj -MD -MP -MF tools/misc/$(DEPDIR)/tools_tpm2-tpm2_print.Tpo -c -o tools/misc/tools_tpm2-tpm2_print.obj `if test -f 'tools/misc/tpm2_print.c'; then $(CYGPATH_W) 'tools/misc/tpm2_print.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_print.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tools_tpm2-tpm2_print.Tpo tools/misc/$(DEPDIR)/tools_tpm2-tpm2_print.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_print.c' object='tools/misc/tools_tpm2-tpm2_print.obj' libtool=no @AMDEPBACKSLASH@
+tools/misc/tpm2-tpm2_eventlog.o: tools/misc/tpm2_eventlog.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tpm2-tpm2_eventlog.o -MD -MP -MF tools/misc/$(DEPDIR)/tpm2-tpm2_eventlog.Tpo -c -o tools/misc/tpm2-tpm2_eventlog.o `test -f 'tools/misc/tpm2_eventlog.c' || echo '$(srcdir)/'`tools/misc/tpm2_eventlog.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tpm2-tpm2_eventlog.Tpo tools/misc/$(DEPDIR)/tpm2-tpm2_eventlog.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_eventlog.c' object='tools/misc/tpm2-tpm2_eventlog.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tools_tpm2-tpm2_print.obj `if test -f 'tools/misc/tpm2_print.c'; then $(CYGPATH_W) 'tools/misc/tpm2_print.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_print.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tpm2-tpm2_eventlog.o `test -f 'tools/misc/tpm2_eventlog.c' || echo '$(srcdir)/'`tools/misc/tpm2_eventlog.c
 
-tools/misc/tools_tpm2-tpm2_rc_decode.o: tools/misc/tpm2_rc_decode.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tools_tpm2-tpm2_rc_decode.o -MD -MP -MF tools/misc/$(DEPDIR)/tools_tpm2-tpm2_rc_decode.Tpo -c -o tools/misc/tools_tpm2-tpm2_rc_decode.o `test -f 'tools/misc/tpm2_rc_decode.c' || echo '$(srcdir)/'`tools/misc/tpm2_rc_decode.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tools_tpm2-tpm2_rc_decode.Tpo tools/misc/$(DEPDIR)/tools_tpm2-tpm2_rc_decode.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_rc_decode.c' object='tools/misc/tools_tpm2-tpm2_rc_decode.o' libtool=no @AMDEPBACKSLASH@
+tools/misc/tpm2-tpm2_eventlog.obj: tools/misc/tpm2_eventlog.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tpm2-tpm2_eventlog.obj -MD -MP -MF tools/misc/$(DEPDIR)/tpm2-tpm2_eventlog.Tpo -c -o tools/misc/tpm2-tpm2_eventlog.obj `if test -f 'tools/misc/tpm2_eventlog.c'; then $(CYGPATH_W) 'tools/misc/tpm2_eventlog.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_eventlog.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tpm2-tpm2_eventlog.Tpo tools/misc/$(DEPDIR)/tpm2-tpm2_eventlog.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_eventlog.c' object='tools/misc/tpm2-tpm2_eventlog.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tools_tpm2-tpm2_rc_decode.o `test -f 'tools/misc/tpm2_rc_decode.c' || echo '$(srcdir)/'`tools/misc/tpm2_rc_decode.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tpm2-tpm2_eventlog.obj `if test -f 'tools/misc/tpm2_eventlog.c'; then $(CYGPATH_W) 'tools/misc/tpm2_eventlog.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_eventlog.c'; fi`
 
-tools/misc/tools_tpm2-tpm2_rc_decode.obj: tools/misc/tpm2_rc_decode.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tools_tpm2-tpm2_rc_decode.obj -MD -MP -MF tools/misc/$(DEPDIR)/tools_tpm2-tpm2_rc_decode.Tpo -c -o tools/misc/tools_tpm2-tpm2_rc_decode.obj `if test -f 'tools/misc/tpm2_rc_decode.c'; then $(CYGPATH_W) 'tools/misc/tpm2_rc_decode.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_rc_decode.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tools_tpm2-tpm2_rc_decode.Tpo tools/misc/$(DEPDIR)/tools_tpm2-tpm2_rc_decode.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_rc_decode.c' object='tools/misc/tools_tpm2-tpm2_rc_decode.obj' libtool=no @AMDEPBACKSLASH@
+tools/misc/tpm2-tpm2_print.o: tools/misc/tpm2_print.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tpm2-tpm2_print.o -MD -MP -MF tools/misc/$(DEPDIR)/tpm2-tpm2_print.Tpo -c -o tools/misc/tpm2-tpm2_print.o `test -f 'tools/misc/tpm2_print.c' || echo '$(srcdir)/'`tools/misc/tpm2_print.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tpm2-tpm2_print.Tpo tools/misc/$(DEPDIR)/tpm2-tpm2_print.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_print.c' object='tools/misc/tpm2-tpm2_print.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tools_tpm2-tpm2_rc_decode.obj `if test -f 'tools/misc/tpm2_rc_decode.c'; then $(CYGPATH_W) 'tools/misc/tpm2_rc_decode.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_rc_decode.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tpm2-tpm2_print.o `test -f 'tools/misc/tpm2_print.c' || echo '$(srcdir)/'`tools/misc/tpm2_print.c
 
-tools/tools_tpm2-tpm2_activatecredential.o: tools/tpm2_activatecredential.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_activatecredential.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_activatecredential.Tpo -c -o tools/tools_tpm2-tpm2_activatecredential.o `test -f 'tools/tpm2_activatecredential.c' || echo '$(srcdir)/'`tools/tpm2_activatecredential.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_activatecredential.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_activatecredential.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_activatecredential.c' object='tools/tools_tpm2-tpm2_activatecredential.o' libtool=no @AMDEPBACKSLASH@
+tools/misc/tpm2-tpm2_print.obj: tools/misc/tpm2_print.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tpm2-tpm2_print.obj -MD -MP -MF tools/misc/$(DEPDIR)/tpm2-tpm2_print.Tpo -c -o tools/misc/tpm2-tpm2_print.obj `if test -f 'tools/misc/tpm2_print.c'; then $(CYGPATH_W) 'tools/misc/tpm2_print.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_print.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tpm2-tpm2_print.Tpo tools/misc/$(DEPDIR)/tpm2-tpm2_print.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_print.c' object='tools/misc/tpm2-tpm2_print.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_activatecredential.o `test -f 'tools/tpm2_activatecredential.c' || echo '$(srcdir)/'`tools/tpm2_activatecredential.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tpm2-tpm2_print.obj `if test -f 'tools/misc/tpm2_print.c'; then $(CYGPATH_W) 'tools/misc/tpm2_print.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_print.c'; fi`
 
-tools/tools_tpm2-tpm2_activatecredential.obj: tools/tpm2_activatecredential.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_activatecredential.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_activatecredential.Tpo -c -o tools/tools_tpm2-tpm2_activatecredential.obj `if test -f 'tools/tpm2_activatecredential.c'; then $(CYGPATH_W) 'tools/tpm2_activatecredential.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_activatecredential.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_activatecredential.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_activatecredential.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_activatecredential.c' object='tools/tools_tpm2-tpm2_activatecredential.obj' libtool=no @AMDEPBACKSLASH@
+tools/misc/tpm2-tpm2_rc_decode.o: tools/misc/tpm2_rc_decode.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tpm2-tpm2_rc_decode.o -MD -MP -MF tools/misc/$(DEPDIR)/tpm2-tpm2_rc_decode.Tpo -c -o tools/misc/tpm2-tpm2_rc_decode.o `test -f 'tools/misc/tpm2_rc_decode.c' || echo '$(srcdir)/'`tools/misc/tpm2_rc_decode.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tpm2-tpm2_rc_decode.Tpo tools/misc/$(DEPDIR)/tpm2-tpm2_rc_decode.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_rc_decode.c' object='tools/misc/tpm2-tpm2_rc_decode.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_activatecredential.obj `if test -f 'tools/tpm2_activatecredential.c'; then $(CYGPATH_W) 'tools/tpm2_activatecredential.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_activatecredential.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tpm2-tpm2_rc_decode.o `test -f 'tools/misc/tpm2_rc_decode.c' || echo '$(srcdir)/'`tools/misc/tpm2_rc_decode.c
 
-tools/tools_tpm2-tpm2_certify.o: tools/tpm2_certify.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_certify.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_certify.Tpo -c -o tools/tools_tpm2-tpm2_certify.o `test -f 'tools/tpm2_certify.c' || echo '$(srcdir)/'`tools/tpm2_certify.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_certify.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_certify.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_certify.c' object='tools/tools_tpm2-tpm2_certify.o' libtool=no @AMDEPBACKSLASH@
+tools/misc/tpm2-tpm2_rc_decode.obj: tools/misc/tpm2_rc_decode.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/misc/tpm2-tpm2_rc_decode.obj -MD -MP -MF tools/misc/$(DEPDIR)/tpm2-tpm2_rc_decode.Tpo -c -o tools/misc/tpm2-tpm2_rc_decode.obj `if test -f 'tools/misc/tpm2_rc_decode.c'; then $(CYGPATH_W) 'tools/misc/tpm2_rc_decode.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_rc_decode.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/misc/$(DEPDIR)/tpm2-tpm2_rc_decode.Tpo tools/misc/$(DEPDIR)/tpm2-tpm2_rc_decode.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/misc/tpm2_rc_decode.c' object='tools/misc/tpm2-tpm2_rc_decode.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_certify.o `test -f 'tools/tpm2_certify.c' || echo '$(srcdir)/'`tools/tpm2_certify.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/misc/tpm2-tpm2_rc_decode.obj `if test -f 'tools/misc/tpm2_rc_decode.c'; then $(CYGPATH_W) 'tools/misc/tpm2_rc_decode.c'; else $(CYGPATH_W) '$(srcdir)/tools/misc/tpm2_rc_decode.c'; fi`
 
-tools/tools_tpm2-tpm2_certify.obj: tools/tpm2_certify.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_certify.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_certify.Tpo -c -o tools/tools_tpm2-tpm2_certify.obj `if test -f 'tools/tpm2_certify.c'; then $(CYGPATH_W) 'tools/tpm2_certify.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_certify.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_certify.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_certify.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_certify.c' object='tools/tools_tpm2-tpm2_certify.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_activatecredential.o: tools/tpm2_activatecredential.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_activatecredential.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_activatecredential.Tpo -c -o tools/tpm2-tpm2_activatecredential.o `test -f 'tools/tpm2_activatecredential.c' || echo '$(srcdir)/'`tools/tpm2_activatecredential.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_activatecredential.Tpo tools/$(DEPDIR)/tpm2-tpm2_activatecredential.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_activatecredential.c' object='tools/tpm2-tpm2_activatecredential.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_certify.obj `if test -f 'tools/tpm2_certify.c'; then $(CYGPATH_W) 'tools/tpm2_certify.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_certify.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_activatecredential.o `test -f 'tools/tpm2_activatecredential.c' || echo '$(srcdir)/'`tools/tpm2_activatecredential.c
 
-tools/tools_tpm2-tpm2_changeauth.o: tools/tpm2_changeauth.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_changeauth.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_changeauth.Tpo -c -o tools/tools_tpm2-tpm2_changeauth.o `test -f 'tools/tpm2_changeauth.c' || echo '$(srcdir)/'`tools/tpm2_changeauth.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_changeauth.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_changeauth.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_changeauth.c' object='tools/tools_tpm2-tpm2_changeauth.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_activatecredential.obj: tools/tpm2_activatecredential.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_activatecredential.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_activatecredential.Tpo -c -o tools/tpm2-tpm2_activatecredential.obj `if test -f 'tools/tpm2_activatecredential.c'; then $(CYGPATH_W) 'tools/tpm2_activatecredential.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_activatecredential.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_activatecredential.Tpo tools/$(DEPDIR)/tpm2-tpm2_activatecredential.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_activatecredential.c' object='tools/tpm2-tpm2_activatecredential.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_changeauth.o `test -f 'tools/tpm2_changeauth.c' || echo '$(srcdir)/'`tools/tpm2_changeauth.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_activatecredential.obj `if test -f 'tools/tpm2_activatecredential.c'; then $(CYGPATH_W) 'tools/tpm2_activatecredential.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_activatecredential.c'; fi`
 
-tools/tools_tpm2-tpm2_changeauth.obj: tools/tpm2_changeauth.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_changeauth.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_changeauth.Tpo -c -o tools/tools_tpm2-tpm2_changeauth.obj `if test -f 'tools/tpm2_changeauth.c'; then $(CYGPATH_W) 'tools/tpm2_changeauth.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_changeauth.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_changeauth.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_changeauth.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_changeauth.c' object='tools/tools_tpm2-tpm2_changeauth.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_certify.o: tools/tpm2_certify.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_certify.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_certify.Tpo -c -o tools/tpm2-tpm2_certify.o `test -f 'tools/tpm2_certify.c' || echo '$(srcdir)/'`tools/tpm2_certify.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_certify.Tpo tools/$(DEPDIR)/tpm2-tpm2_certify.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_certify.c' object='tools/tpm2-tpm2_certify.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_changeauth.obj `if test -f 'tools/tpm2_changeauth.c'; then $(CYGPATH_W) 'tools/tpm2_changeauth.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_changeauth.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_certify.o `test -f 'tools/tpm2_certify.c' || echo '$(srcdir)/'`tools/tpm2_certify.c
 
-tools/tools_tpm2-tpm2_changeeps.o: tools/tpm2_changeeps.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_changeeps.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_changeeps.Tpo -c -o tools/tools_tpm2-tpm2_changeeps.o `test -f 'tools/tpm2_changeeps.c' || echo '$(srcdir)/'`tools/tpm2_changeeps.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_changeeps.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_changeeps.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_changeeps.c' object='tools/tools_tpm2-tpm2_changeeps.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_certify.obj: tools/tpm2_certify.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_certify.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_certify.Tpo -c -o tools/tpm2-tpm2_certify.obj `if test -f 'tools/tpm2_certify.c'; then $(CYGPATH_W) 'tools/tpm2_certify.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_certify.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_certify.Tpo tools/$(DEPDIR)/tpm2-tpm2_certify.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_certify.c' object='tools/tpm2-tpm2_certify.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_changeeps.o `test -f 'tools/tpm2_changeeps.c' || echo '$(srcdir)/'`tools/tpm2_changeeps.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_certify.obj `if test -f 'tools/tpm2_certify.c'; then $(CYGPATH_W) 'tools/tpm2_certify.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_certify.c'; fi`
 
-tools/tools_tpm2-tpm2_changeeps.obj: tools/tpm2_changeeps.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_changeeps.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_changeeps.Tpo -c -o tools/tools_tpm2-tpm2_changeeps.obj `if test -f 'tools/tpm2_changeeps.c'; then $(CYGPATH_W) 'tools/tpm2_changeeps.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_changeeps.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_changeeps.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_changeeps.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_changeeps.c' object='tools/tools_tpm2-tpm2_changeeps.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_changeauth.o: tools/tpm2_changeauth.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_changeauth.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_changeauth.Tpo -c -o tools/tpm2-tpm2_changeauth.o `test -f 'tools/tpm2_changeauth.c' || echo '$(srcdir)/'`tools/tpm2_changeauth.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_changeauth.Tpo tools/$(DEPDIR)/tpm2-tpm2_changeauth.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_changeauth.c' object='tools/tpm2-tpm2_changeauth.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_changeeps.obj `if test -f 'tools/tpm2_changeeps.c'; then $(CYGPATH_W) 'tools/tpm2_changeeps.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_changeeps.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_changeauth.o `test -f 'tools/tpm2_changeauth.c' || echo '$(srcdir)/'`tools/tpm2_changeauth.c
 
-tools/tools_tpm2-tpm2_changepps.o: tools/tpm2_changepps.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_changepps.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_changepps.Tpo -c -o tools/tools_tpm2-tpm2_changepps.o `test -f 'tools/tpm2_changepps.c' || echo '$(srcdir)/'`tools/tpm2_changepps.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_changepps.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_changepps.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_changepps.c' object='tools/tools_tpm2-tpm2_changepps.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_changeauth.obj: tools/tpm2_changeauth.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_changeauth.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_changeauth.Tpo -c -o tools/tpm2-tpm2_changeauth.obj `if test -f 'tools/tpm2_changeauth.c'; then $(CYGPATH_W) 'tools/tpm2_changeauth.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_changeauth.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_changeauth.Tpo tools/$(DEPDIR)/tpm2-tpm2_changeauth.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_changeauth.c' object='tools/tpm2-tpm2_changeauth.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_changepps.o `test -f 'tools/tpm2_changepps.c' || echo '$(srcdir)/'`tools/tpm2_changepps.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_changeauth.obj `if test -f 'tools/tpm2_changeauth.c'; then $(CYGPATH_W) 'tools/tpm2_changeauth.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_changeauth.c'; fi`
 
-tools/tools_tpm2-tpm2_changepps.obj: tools/tpm2_changepps.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_changepps.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_changepps.Tpo -c -o tools/tools_tpm2-tpm2_changepps.obj `if test -f 'tools/tpm2_changepps.c'; then $(CYGPATH_W) 'tools/tpm2_changepps.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_changepps.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_changepps.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_changepps.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_changepps.c' object='tools/tools_tpm2-tpm2_changepps.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_changeeps.o: tools/tpm2_changeeps.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_changeeps.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_changeeps.Tpo -c -o tools/tpm2-tpm2_changeeps.o `test -f 'tools/tpm2_changeeps.c' || echo '$(srcdir)/'`tools/tpm2_changeeps.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_changeeps.Tpo tools/$(DEPDIR)/tpm2-tpm2_changeeps.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_changeeps.c' object='tools/tpm2-tpm2_changeeps.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_changepps.obj `if test -f 'tools/tpm2_changepps.c'; then $(CYGPATH_W) 'tools/tpm2_changepps.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_changepps.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_changeeps.o `test -f 'tools/tpm2_changeeps.c' || echo '$(srcdir)/'`tools/tpm2_changeeps.c
 
-tools/tools_tpm2-tpm2_clear.o: tools/tpm2_clear.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_clear.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_clear.Tpo -c -o tools/tools_tpm2-tpm2_clear.o `test -f 'tools/tpm2_clear.c' || echo '$(srcdir)/'`tools/tpm2_clear.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_clear.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_clear.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_clear.c' object='tools/tools_tpm2-tpm2_clear.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_changeeps.obj: tools/tpm2_changeeps.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_changeeps.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_changeeps.Tpo -c -o tools/tpm2-tpm2_changeeps.obj `if test -f 'tools/tpm2_changeeps.c'; then $(CYGPATH_W) 'tools/tpm2_changeeps.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_changeeps.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_changeeps.Tpo tools/$(DEPDIR)/tpm2-tpm2_changeeps.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_changeeps.c' object='tools/tpm2-tpm2_changeeps.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_clear.o `test -f 'tools/tpm2_clear.c' || echo '$(srcdir)/'`tools/tpm2_clear.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_changeeps.obj `if test -f 'tools/tpm2_changeeps.c'; then $(CYGPATH_W) 'tools/tpm2_changeeps.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_changeeps.c'; fi`
 
-tools/tools_tpm2-tpm2_clear.obj: tools/tpm2_clear.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_clear.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_clear.Tpo -c -o tools/tools_tpm2-tpm2_clear.obj `if test -f 'tools/tpm2_clear.c'; then $(CYGPATH_W) 'tools/tpm2_clear.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_clear.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_clear.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_clear.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_clear.c' object='tools/tools_tpm2-tpm2_clear.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_changepps.o: tools/tpm2_changepps.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_changepps.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_changepps.Tpo -c -o tools/tpm2-tpm2_changepps.o `test -f 'tools/tpm2_changepps.c' || echo '$(srcdir)/'`tools/tpm2_changepps.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_changepps.Tpo tools/$(DEPDIR)/tpm2-tpm2_changepps.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_changepps.c' object='tools/tpm2-tpm2_changepps.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_clear.obj `if test -f 'tools/tpm2_clear.c'; then $(CYGPATH_W) 'tools/tpm2_clear.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_clear.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_changepps.o `test -f 'tools/tpm2_changepps.c' || echo '$(srcdir)/'`tools/tpm2_changepps.c
 
-tools/tools_tpm2-tpm2_clearcontrol.o: tools/tpm2_clearcontrol.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_clearcontrol.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_clearcontrol.Tpo -c -o tools/tools_tpm2-tpm2_clearcontrol.o `test -f 'tools/tpm2_clearcontrol.c' || echo '$(srcdir)/'`tools/tpm2_clearcontrol.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_clearcontrol.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_clearcontrol.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_clearcontrol.c' object='tools/tools_tpm2-tpm2_clearcontrol.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_changepps.obj: tools/tpm2_changepps.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_changepps.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_changepps.Tpo -c -o tools/tpm2-tpm2_changepps.obj `if test -f 'tools/tpm2_changepps.c'; then $(CYGPATH_W) 'tools/tpm2_changepps.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_changepps.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_changepps.Tpo tools/$(DEPDIR)/tpm2-tpm2_changepps.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_changepps.c' object='tools/tpm2-tpm2_changepps.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_clearcontrol.o `test -f 'tools/tpm2_clearcontrol.c' || echo '$(srcdir)/'`tools/tpm2_clearcontrol.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_changepps.obj `if test -f 'tools/tpm2_changepps.c'; then $(CYGPATH_W) 'tools/tpm2_changepps.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_changepps.c'; fi`
 
-tools/tools_tpm2-tpm2_clearcontrol.obj: tools/tpm2_clearcontrol.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_clearcontrol.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_clearcontrol.Tpo -c -o tools/tools_tpm2-tpm2_clearcontrol.obj `if test -f 'tools/tpm2_clearcontrol.c'; then $(CYGPATH_W) 'tools/tpm2_clearcontrol.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_clearcontrol.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_clearcontrol.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_clearcontrol.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_clearcontrol.c' object='tools/tools_tpm2-tpm2_clearcontrol.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_clear.o: tools/tpm2_clear.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_clear.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_clear.Tpo -c -o tools/tpm2-tpm2_clear.o `test -f 'tools/tpm2_clear.c' || echo '$(srcdir)/'`tools/tpm2_clear.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_clear.Tpo tools/$(DEPDIR)/tpm2-tpm2_clear.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_clear.c' object='tools/tpm2-tpm2_clear.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_clearcontrol.obj `if test -f 'tools/tpm2_clearcontrol.c'; then $(CYGPATH_W) 'tools/tpm2_clearcontrol.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_clearcontrol.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_clear.o `test -f 'tools/tpm2_clear.c' || echo '$(srcdir)/'`tools/tpm2_clear.c
 
-tools/tools_tpm2-tpm2_clockrateadjust.o: tools/tpm2_clockrateadjust.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_clockrateadjust.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_clockrateadjust.Tpo -c -o tools/tools_tpm2-tpm2_clockrateadjust.o `test -f 'tools/tpm2_clockrateadjust.c' || echo '$(srcdir)/'`tools/tpm2_clockrateadjust.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_clockrateadjust.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_clockrateadjust.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_clockrateadjust.c' object='tools/tools_tpm2-tpm2_clockrateadjust.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_clear.obj: tools/tpm2_clear.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_clear.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_clear.Tpo -c -o tools/tpm2-tpm2_clear.obj `if test -f 'tools/tpm2_clear.c'; then $(CYGPATH_W) 'tools/tpm2_clear.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_clear.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_clear.Tpo tools/$(DEPDIR)/tpm2-tpm2_clear.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_clear.c' object='tools/tpm2-tpm2_clear.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_clockrateadjust.o `test -f 'tools/tpm2_clockrateadjust.c' || echo '$(srcdir)/'`tools/tpm2_clockrateadjust.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_clear.obj `if test -f 'tools/tpm2_clear.c'; then $(CYGPATH_W) 'tools/tpm2_clear.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_clear.c'; fi`
 
-tools/tools_tpm2-tpm2_clockrateadjust.obj: tools/tpm2_clockrateadjust.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_clockrateadjust.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_clockrateadjust.Tpo -c -o tools/tools_tpm2-tpm2_clockrateadjust.obj `if test -f 'tools/tpm2_clockrateadjust.c'; then $(CYGPATH_W) 'tools/tpm2_clockrateadjust.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_clockrateadjust.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_clockrateadjust.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_clockrateadjust.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_clockrateadjust.c' object='tools/tools_tpm2-tpm2_clockrateadjust.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_clearcontrol.o: tools/tpm2_clearcontrol.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_clearcontrol.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_clearcontrol.Tpo -c -o tools/tpm2-tpm2_clearcontrol.o `test -f 'tools/tpm2_clearcontrol.c' || echo '$(srcdir)/'`tools/tpm2_clearcontrol.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_clearcontrol.Tpo tools/$(DEPDIR)/tpm2-tpm2_clearcontrol.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_clearcontrol.c' object='tools/tpm2-tpm2_clearcontrol.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_clockrateadjust.obj `if test -f 'tools/tpm2_clockrateadjust.c'; then $(CYGPATH_W) 'tools/tpm2_clockrateadjust.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_clockrateadjust.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_clearcontrol.o `test -f 'tools/tpm2_clearcontrol.c' || echo '$(srcdir)/'`tools/tpm2_clearcontrol.c
 
-tools/tools_tpm2-tpm2_create.o: tools/tpm2_create.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_create.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_create.Tpo -c -o tools/tools_tpm2-tpm2_create.o `test -f 'tools/tpm2_create.c' || echo '$(srcdir)/'`tools/tpm2_create.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_create.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_create.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_create.c' object='tools/tools_tpm2-tpm2_create.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_clearcontrol.obj: tools/tpm2_clearcontrol.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_clearcontrol.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_clearcontrol.Tpo -c -o tools/tpm2-tpm2_clearcontrol.obj `if test -f 'tools/tpm2_clearcontrol.c'; then $(CYGPATH_W) 'tools/tpm2_clearcontrol.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_clearcontrol.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_clearcontrol.Tpo tools/$(DEPDIR)/tpm2-tpm2_clearcontrol.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_clearcontrol.c' object='tools/tpm2-tpm2_clearcontrol.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_create.o `test -f 'tools/tpm2_create.c' || echo '$(srcdir)/'`tools/tpm2_create.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_clearcontrol.obj `if test -f 'tools/tpm2_clearcontrol.c'; then $(CYGPATH_W) 'tools/tpm2_clearcontrol.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_clearcontrol.c'; fi`
 
-tools/tools_tpm2-tpm2_create.obj: tools/tpm2_create.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_create.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_create.Tpo -c -o tools/tools_tpm2-tpm2_create.obj `if test -f 'tools/tpm2_create.c'; then $(CYGPATH_W) 'tools/tpm2_create.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_create.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_create.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_create.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_create.c' object='tools/tools_tpm2-tpm2_create.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_clockrateadjust.o: tools/tpm2_clockrateadjust.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_clockrateadjust.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_clockrateadjust.Tpo -c -o tools/tpm2-tpm2_clockrateadjust.o `test -f 'tools/tpm2_clockrateadjust.c' || echo '$(srcdir)/'`tools/tpm2_clockrateadjust.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_clockrateadjust.Tpo tools/$(DEPDIR)/tpm2-tpm2_clockrateadjust.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_clockrateadjust.c' object='tools/tpm2-tpm2_clockrateadjust.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_create.obj `if test -f 'tools/tpm2_create.c'; then $(CYGPATH_W) 'tools/tpm2_create.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_create.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_clockrateadjust.o `test -f 'tools/tpm2_clockrateadjust.c' || echo '$(srcdir)/'`tools/tpm2_clockrateadjust.c
 
-tools/tools_tpm2-tpm2_createak.o: tools/tpm2_createak.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_createak.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_createak.Tpo -c -o tools/tools_tpm2-tpm2_createak.o `test -f 'tools/tpm2_createak.c' || echo '$(srcdir)/'`tools/tpm2_createak.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_createak.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_createak.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createak.c' object='tools/tools_tpm2-tpm2_createak.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_clockrateadjust.obj: tools/tpm2_clockrateadjust.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_clockrateadjust.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_clockrateadjust.Tpo -c -o tools/tpm2-tpm2_clockrateadjust.obj `if test -f 'tools/tpm2_clockrateadjust.c'; then $(CYGPATH_W) 'tools/tpm2_clockrateadjust.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_clockrateadjust.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_clockrateadjust.Tpo tools/$(DEPDIR)/tpm2-tpm2_clockrateadjust.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_clockrateadjust.c' object='tools/tpm2-tpm2_clockrateadjust.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_createak.o `test -f 'tools/tpm2_createak.c' || echo '$(srcdir)/'`tools/tpm2_createak.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_clockrateadjust.obj `if test -f 'tools/tpm2_clockrateadjust.c'; then $(CYGPATH_W) 'tools/tpm2_clockrateadjust.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_clockrateadjust.c'; fi`
 
-tools/tools_tpm2-tpm2_createak.obj: tools/tpm2_createak.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_createak.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_createak.Tpo -c -o tools/tools_tpm2-tpm2_createak.obj `if test -f 'tools/tpm2_createak.c'; then $(CYGPATH_W) 'tools/tpm2_createak.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createak.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_createak.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_createak.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createak.c' object='tools/tools_tpm2-tpm2_createak.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_create.o: tools/tpm2_create.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_create.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_create.Tpo -c -o tools/tpm2-tpm2_create.o `test -f 'tools/tpm2_create.c' || echo '$(srcdir)/'`tools/tpm2_create.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_create.Tpo tools/$(DEPDIR)/tpm2-tpm2_create.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_create.c' object='tools/tpm2-tpm2_create.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_createak.obj `if test -f 'tools/tpm2_createak.c'; then $(CYGPATH_W) 'tools/tpm2_createak.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createak.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_create.o `test -f 'tools/tpm2_create.c' || echo '$(srcdir)/'`tools/tpm2_create.c
 
-tools/tools_tpm2-tpm2_createek.o: tools/tpm2_createek.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_createek.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_createek.Tpo -c -o tools/tools_tpm2-tpm2_createek.o `test -f 'tools/tpm2_createek.c' || echo '$(srcdir)/'`tools/tpm2_createek.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_createek.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_createek.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createek.c' object='tools/tools_tpm2-tpm2_createek.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_create.obj: tools/tpm2_create.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_create.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_create.Tpo -c -o tools/tpm2-tpm2_create.obj `if test -f 'tools/tpm2_create.c'; then $(CYGPATH_W) 'tools/tpm2_create.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_create.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_create.Tpo tools/$(DEPDIR)/tpm2-tpm2_create.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_create.c' object='tools/tpm2-tpm2_create.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_createek.o `test -f 'tools/tpm2_createek.c' || echo '$(srcdir)/'`tools/tpm2_createek.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_create.obj `if test -f 'tools/tpm2_create.c'; then $(CYGPATH_W) 'tools/tpm2_create.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_create.c'; fi`
 
-tools/tools_tpm2-tpm2_createek.obj: tools/tpm2_createek.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_createek.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_createek.Tpo -c -o tools/tools_tpm2-tpm2_createek.obj `if test -f 'tools/tpm2_createek.c'; then $(CYGPATH_W) 'tools/tpm2_createek.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createek.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_createek.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_createek.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createek.c' object='tools/tools_tpm2-tpm2_createek.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_createak.o: tools/tpm2_createak.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_createak.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_createak.Tpo -c -o tools/tpm2-tpm2_createak.o `test -f 'tools/tpm2_createak.c' || echo '$(srcdir)/'`tools/tpm2_createak.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_createak.Tpo tools/$(DEPDIR)/tpm2-tpm2_createak.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createak.c' object='tools/tpm2-tpm2_createak.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_createek.obj `if test -f 'tools/tpm2_createek.c'; then $(CYGPATH_W) 'tools/tpm2_createek.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createek.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_createak.o `test -f 'tools/tpm2_createak.c' || echo '$(srcdir)/'`tools/tpm2_createak.c
 
-tools/tools_tpm2-tpm2_createpolicy.o: tools/tpm2_createpolicy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_createpolicy.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_createpolicy.Tpo -c -o tools/tools_tpm2-tpm2_createpolicy.o `test -f 'tools/tpm2_createpolicy.c' || echo '$(srcdir)/'`tools/tpm2_createpolicy.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_createpolicy.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_createpolicy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createpolicy.c' object='tools/tools_tpm2-tpm2_createpolicy.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_createak.obj: tools/tpm2_createak.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_createak.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_createak.Tpo -c -o tools/tpm2-tpm2_createak.obj `if test -f 'tools/tpm2_createak.c'; then $(CYGPATH_W) 'tools/tpm2_createak.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createak.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_createak.Tpo tools/$(DEPDIR)/tpm2-tpm2_createak.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createak.c' object='tools/tpm2-tpm2_createak.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_createpolicy.o `test -f 'tools/tpm2_createpolicy.c' || echo '$(srcdir)/'`tools/tpm2_createpolicy.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_createak.obj `if test -f 'tools/tpm2_createak.c'; then $(CYGPATH_W) 'tools/tpm2_createak.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createak.c'; fi`
 
-tools/tools_tpm2-tpm2_createpolicy.obj: tools/tpm2_createpolicy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_createpolicy.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_createpolicy.Tpo -c -o tools/tools_tpm2-tpm2_createpolicy.obj `if test -f 'tools/tpm2_createpolicy.c'; then $(CYGPATH_W) 'tools/tpm2_createpolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createpolicy.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_createpolicy.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_createpolicy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createpolicy.c' object='tools/tools_tpm2-tpm2_createpolicy.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_createek.o: tools/tpm2_createek.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_createek.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_createek.Tpo -c -o tools/tpm2-tpm2_createek.o `test -f 'tools/tpm2_createek.c' || echo '$(srcdir)/'`tools/tpm2_createek.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_createek.Tpo tools/$(DEPDIR)/tpm2-tpm2_createek.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createek.c' object='tools/tpm2-tpm2_createek.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_createpolicy.obj `if test -f 'tools/tpm2_createpolicy.c'; then $(CYGPATH_W) 'tools/tpm2_createpolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createpolicy.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_createek.o `test -f 'tools/tpm2_createek.c' || echo '$(srcdir)/'`tools/tpm2_createek.c
 
-tools/tools_tpm2-tpm2_setprimarypolicy.o: tools/tpm2_setprimarypolicy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_setprimarypolicy.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_setprimarypolicy.Tpo -c -o tools/tools_tpm2-tpm2_setprimarypolicy.o `test -f 'tools/tpm2_setprimarypolicy.c' || echo '$(srcdir)/'`tools/tpm2_setprimarypolicy.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_setprimarypolicy.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_setprimarypolicy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_setprimarypolicy.c' object='tools/tools_tpm2-tpm2_setprimarypolicy.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_createek.obj: tools/tpm2_createek.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_createek.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_createek.Tpo -c -o tools/tpm2-tpm2_createek.obj `if test -f 'tools/tpm2_createek.c'; then $(CYGPATH_W) 'tools/tpm2_createek.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createek.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_createek.Tpo tools/$(DEPDIR)/tpm2-tpm2_createek.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createek.c' object='tools/tpm2-tpm2_createek.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_setprimarypolicy.o `test -f 'tools/tpm2_setprimarypolicy.c' || echo '$(srcdir)/'`tools/tpm2_setprimarypolicy.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_createek.obj `if test -f 'tools/tpm2_createek.c'; then $(CYGPATH_W) 'tools/tpm2_createek.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createek.c'; fi`
 
-tools/tools_tpm2-tpm2_setprimarypolicy.obj: tools/tpm2_setprimarypolicy.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_setprimarypolicy.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_setprimarypolicy.Tpo -c -o tools/tools_tpm2-tpm2_setprimarypolicy.obj `if test -f 'tools/tpm2_setprimarypolicy.c'; then $(CYGPATH_W) 'tools/tpm2_setprimarypolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_setprimarypolicy.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_setprimarypolicy.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_setprimarypolicy.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_setprimarypolicy.c' object='tools/tools_tpm2-tpm2_setprimarypolicy.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_createpolicy.o: tools/tpm2_createpolicy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_createpolicy.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_createpolicy.Tpo -c -o tools/tpm2-tpm2_createpolicy.o `test -f 'tools/tpm2_createpolicy.c' || echo '$(srcdir)/'`tools/tpm2_createpolicy.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_createpolicy.Tpo tools/$(DEPDIR)/tpm2-tpm2_createpolicy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createpolicy.c' object='tools/tpm2-tpm2_createpolicy.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_setprimarypolicy.obj `if test -f 'tools/tpm2_setprimarypolicy.c'; then $(CYGPATH_W) 'tools/tpm2_setprimarypolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_setprimarypolicy.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_createpolicy.o `test -f 'tools/tpm2_createpolicy.c' || echo '$(srcdir)/'`tools/tpm2_createpolicy.c
 
-tools/tools_tpm2-tpm2_createprimary.o: tools/tpm2_createprimary.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_createprimary.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_createprimary.Tpo -c -o tools/tools_tpm2-tpm2_createprimary.o `test -f 'tools/tpm2_createprimary.c' || echo '$(srcdir)/'`tools/tpm2_createprimary.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_createprimary.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_createprimary.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createprimary.c' object='tools/tools_tpm2-tpm2_createprimary.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_createpolicy.obj: tools/tpm2_createpolicy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_createpolicy.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_createpolicy.Tpo -c -o tools/tpm2-tpm2_createpolicy.obj `if test -f 'tools/tpm2_createpolicy.c'; then $(CYGPATH_W) 'tools/tpm2_createpolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createpolicy.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_createpolicy.Tpo tools/$(DEPDIR)/tpm2-tpm2_createpolicy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createpolicy.c' object='tools/tpm2-tpm2_createpolicy.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_createprimary.o `test -f 'tools/tpm2_createprimary.c' || echo '$(srcdir)/'`tools/tpm2_createprimary.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_createpolicy.obj `if test -f 'tools/tpm2_createpolicy.c'; then $(CYGPATH_W) 'tools/tpm2_createpolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createpolicy.c'; fi`
 
-tools/tools_tpm2-tpm2_createprimary.obj: tools/tpm2_createprimary.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_createprimary.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_createprimary.Tpo -c -o tools/tools_tpm2-tpm2_createprimary.obj `if test -f 'tools/tpm2_createprimary.c'; then $(CYGPATH_W) 'tools/tpm2_createprimary.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createprimary.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_createprimary.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_createprimary.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createprimary.c' object='tools/tools_tpm2-tpm2_createprimary.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_setprimarypolicy.o: tools/tpm2_setprimarypolicy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_setprimarypolicy.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_setprimarypolicy.Tpo -c -o tools/tpm2-tpm2_setprimarypolicy.o `test -f 'tools/tpm2_setprimarypolicy.c' || echo '$(srcdir)/'`tools/tpm2_setprimarypolicy.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_setprimarypolicy.Tpo tools/$(DEPDIR)/tpm2-tpm2_setprimarypolicy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_setprimarypolicy.c' object='tools/tpm2-tpm2_setprimarypolicy.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_createprimary.obj `if test -f 'tools/tpm2_createprimary.c'; then $(CYGPATH_W) 'tools/tpm2_createprimary.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createprimary.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_setprimarypolicy.o `test -f 'tools/tpm2_setprimarypolicy.c' || echo '$(srcdir)/'`tools/tpm2_setprimarypolicy.c
 
-tools/tools_tpm2-tpm2_dictionarylockout.o: tools/tpm2_dictionarylockout.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_dictionarylockout.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_dictionarylockout.Tpo -c -o tools/tools_tpm2-tpm2_dictionarylockout.o `test -f 'tools/tpm2_dictionarylockout.c' || echo '$(srcdir)/'`tools/tpm2_dictionarylockout.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_dictionarylockout.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_dictionarylockout.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_dictionarylockout.c' object='tools/tools_tpm2-tpm2_dictionarylockout.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_setprimarypolicy.obj: tools/tpm2_setprimarypolicy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_setprimarypolicy.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_setprimarypolicy.Tpo -c -o tools/tpm2-tpm2_setprimarypolicy.obj `if test -f 'tools/tpm2_setprimarypolicy.c'; then $(CYGPATH_W) 'tools/tpm2_setprimarypolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_setprimarypolicy.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_setprimarypolicy.Tpo tools/$(DEPDIR)/tpm2-tpm2_setprimarypolicy.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_setprimarypolicy.c' object='tools/tpm2-tpm2_setprimarypolicy.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_dictionarylockout.o `test -f 'tools/tpm2_dictionarylockout.c' || echo '$(srcdir)/'`tools/tpm2_dictionarylockout.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_setprimarypolicy.obj `if test -f 'tools/tpm2_setprimarypolicy.c'; then $(CYGPATH_W) 'tools/tpm2_setprimarypolicy.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_setprimarypolicy.c'; fi`
 
-tools/tools_tpm2-tpm2_dictionarylockout.obj: tools/tpm2_dictionarylockout.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_dictionarylockout.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_dictionarylockout.Tpo -c -o tools/tools_tpm2-tpm2_dictionarylockout.obj `if test -f 'tools/tpm2_dictionarylockout.c'; then $(CYGPATH_W) 'tools/tpm2_dictionarylockout.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_dictionarylockout.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_dictionarylockout.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_dictionarylockout.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_dictionarylockout.c' object='tools/tools_tpm2-tpm2_dictionarylockout.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_createprimary.o: tools/tpm2_createprimary.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_createprimary.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_createprimary.Tpo -c -o tools/tpm2-tpm2_createprimary.o `test -f 'tools/tpm2_createprimary.c' || echo '$(srcdir)/'`tools/tpm2_createprimary.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_createprimary.Tpo tools/$(DEPDIR)/tpm2-tpm2_createprimary.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createprimary.c' object='tools/tpm2-tpm2_createprimary.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_dictionarylockout.obj `if test -f 'tools/tpm2_dictionarylockout.c'; then $(CYGPATH_W) 'tools/tpm2_dictionarylockout.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_dictionarylockout.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_createprimary.o `test -f 'tools/tpm2_createprimary.c' || echo '$(srcdir)/'`tools/tpm2_createprimary.c
 
-tools/tools_tpm2-tpm2_duplicate.o: tools/tpm2_duplicate.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_duplicate.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_duplicate.Tpo -c -o tools/tools_tpm2-tpm2_duplicate.o `test -f 'tools/tpm2_duplicate.c' || echo '$(srcdir)/'`tools/tpm2_duplicate.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_duplicate.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_duplicate.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_duplicate.c' object='tools/tools_tpm2-tpm2_duplicate.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_createprimary.obj: tools/tpm2_createprimary.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_createprimary.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_createprimary.Tpo -c -o tools/tpm2-tpm2_createprimary.obj `if test -f 'tools/tpm2_createprimary.c'; then $(CYGPATH_W) 'tools/tpm2_createprimary.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createprimary.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_createprimary.Tpo tools/$(DEPDIR)/tpm2-tpm2_createprimary.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_createprimary.c' object='tools/tpm2-tpm2_createprimary.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_duplicate.o `test -f 'tools/tpm2_duplicate.c' || echo '$(srcdir)/'`tools/tpm2_duplicate.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_createprimary.obj `if test -f 'tools/tpm2_createprimary.c'; then $(CYGPATH_W) 'tools/tpm2_createprimary.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_createprimary.c'; fi`
 
-tools/tools_tpm2-tpm2_duplicate.obj: tools/tpm2_duplicate.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_duplicate.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_duplicate.Tpo -c -o tools/tools_tpm2-tpm2_duplicate.obj `if test -f 'tools/tpm2_duplicate.c'; then $(CYGPATH_W) 'tools/tpm2_duplicate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_duplicate.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_duplicate.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_duplicate.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_duplicate.c' object='tools/tools_tpm2-tpm2_duplicate.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_dictionarylockout.o: tools/tpm2_dictionarylockout.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_dictionarylockout.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_dictionarylockout.Tpo -c -o tools/tpm2-tpm2_dictionarylockout.o `test -f 'tools/tpm2_dictionarylockout.c' || echo '$(srcdir)/'`tools/tpm2_dictionarylockout.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_dictionarylockout.Tpo tools/$(DEPDIR)/tpm2-tpm2_dictionarylockout.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_dictionarylockout.c' object='tools/tpm2-tpm2_dictionarylockout.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_duplicate.obj `if test -f 'tools/tpm2_duplicate.c'; then $(CYGPATH_W) 'tools/tpm2_duplicate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_duplicate.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_dictionarylockout.o `test -f 'tools/tpm2_dictionarylockout.c' || echo '$(srcdir)/'`tools/tpm2_dictionarylockout.c
 
-tools/tools_tpm2-tpm2_getcap.o: tools/tpm2_getcap.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_getcap.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_getcap.Tpo -c -o tools/tools_tpm2-tpm2_getcap.o `test -f 'tools/tpm2_getcap.c' || echo '$(srcdir)/'`tools/tpm2_getcap.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_getcap.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_getcap.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getcap.c' object='tools/tools_tpm2-tpm2_getcap.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_dictionarylockout.obj: tools/tpm2_dictionarylockout.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_dictionarylockout.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_dictionarylockout.Tpo -c -o tools/tpm2-tpm2_dictionarylockout.obj `if test -f 'tools/tpm2_dictionarylockout.c'; then $(CYGPATH_W) 'tools/tpm2_dictionarylockout.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_dictionarylockout.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_dictionarylockout.Tpo tools/$(DEPDIR)/tpm2-tpm2_dictionarylockout.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_dictionarylockout.c' object='tools/tpm2-tpm2_dictionarylockout.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_getcap.o `test -f 'tools/tpm2_getcap.c' || echo '$(srcdir)/'`tools/tpm2_getcap.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_dictionarylockout.obj `if test -f 'tools/tpm2_dictionarylockout.c'; then $(CYGPATH_W) 'tools/tpm2_dictionarylockout.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_dictionarylockout.c'; fi`
 
-tools/tools_tpm2-tpm2_getcap.obj: tools/tpm2_getcap.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_getcap.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_getcap.Tpo -c -o tools/tools_tpm2-tpm2_getcap.obj `if test -f 'tools/tpm2_getcap.c'; then $(CYGPATH_W) 'tools/tpm2_getcap.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getcap.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_getcap.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_getcap.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getcap.c' object='tools/tools_tpm2-tpm2_getcap.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_duplicate.o: tools/tpm2_duplicate.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_duplicate.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_duplicate.Tpo -c -o tools/tpm2-tpm2_duplicate.o `test -f 'tools/tpm2_duplicate.c' || echo '$(srcdir)/'`tools/tpm2_duplicate.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_duplicate.Tpo tools/$(DEPDIR)/tpm2-tpm2_duplicate.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_duplicate.c' object='tools/tpm2-tpm2_duplicate.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_getcap.obj `if test -f 'tools/tpm2_getcap.c'; then $(CYGPATH_W) 'tools/tpm2_getcap.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getcap.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_duplicate.o `test -f 'tools/tpm2_duplicate.c' || echo '$(srcdir)/'`tools/tpm2_duplicate.c
 
-tools/tools_tpm2-tpm2_gettestresult.o: tools/tpm2_gettestresult.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_gettestresult.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_gettestresult.Tpo -c -o tools/tools_tpm2-tpm2_gettestresult.o `test -f 'tools/tpm2_gettestresult.c' || echo '$(srcdir)/'`tools/tpm2_gettestresult.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_gettestresult.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_gettestresult.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_gettestresult.c' object='tools/tools_tpm2-tpm2_gettestresult.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_duplicate.obj: tools/tpm2_duplicate.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_duplicate.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_duplicate.Tpo -c -o tools/tpm2-tpm2_duplicate.obj `if test -f 'tools/tpm2_duplicate.c'; then $(CYGPATH_W) 'tools/tpm2_duplicate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_duplicate.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_duplicate.Tpo tools/$(DEPDIR)/tpm2-tpm2_duplicate.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_duplicate.c' object='tools/tpm2-tpm2_duplicate.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_gettestresult.o `test -f 'tools/tpm2_gettestresult.c' || echo '$(srcdir)/'`tools/tpm2_gettestresult.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_duplicate.obj `if test -f 'tools/tpm2_duplicate.c'; then $(CYGPATH_W) 'tools/tpm2_duplicate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_duplicate.c'; fi`
 
-tools/tools_tpm2-tpm2_gettestresult.obj: tools/tpm2_gettestresult.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_gettestresult.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_gettestresult.Tpo -c -o tools/tools_tpm2-tpm2_gettestresult.obj `if test -f 'tools/tpm2_gettestresult.c'; then $(CYGPATH_W) 'tools/tpm2_gettestresult.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_gettestresult.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_gettestresult.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_gettestresult.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_gettestresult.c' object='tools/tools_tpm2-tpm2_gettestresult.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_getcap.o: tools/tpm2_getcap.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_getcap.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_getcap.Tpo -c -o tools/tpm2-tpm2_getcap.o `test -f 'tools/tpm2_getcap.c' || echo '$(srcdir)/'`tools/tpm2_getcap.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_getcap.Tpo tools/$(DEPDIR)/tpm2-tpm2_getcap.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getcap.c' object='tools/tpm2-tpm2_getcap.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_gettestresult.obj `if test -f 'tools/tpm2_gettestresult.c'; then $(CYGPATH_W) 'tools/tpm2_gettestresult.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_gettestresult.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_getcap.o `test -f 'tools/tpm2_getcap.c' || echo '$(srcdir)/'`tools/tpm2_getcap.c
 
-tools/tools_tpm2-tpm2_encryptdecrypt.o: tools/tpm2_encryptdecrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_encryptdecrypt.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_encryptdecrypt.Tpo -c -o tools/tools_tpm2-tpm2_encryptdecrypt.o `test -f 'tools/tpm2_encryptdecrypt.c' || echo '$(srcdir)/'`tools/tpm2_encryptdecrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_encryptdecrypt.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_encryptdecrypt.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_encryptdecrypt.c' object='tools/tools_tpm2-tpm2_encryptdecrypt.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_getcap.obj: tools/tpm2_getcap.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_getcap.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_getcap.Tpo -c -o tools/tpm2-tpm2_getcap.obj `if test -f 'tools/tpm2_getcap.c'; then $(CYGPATH_W) 'tools/tpm2_getcap.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getcap.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_getcap.Tpo tools/$(DEPDIR)/tpm2-tpm2_getcap.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getcap.c' object='tools/tpm2-tpm2_getcap.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_encryptdecrypt.o `test -f 'tools/tpm2_encryptdecrypt.c' || echo '$(srcdir)/'`tools/tpm2_encryptdecrypt.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_getcap.obj `if test -f 'tools/tpm2_getcap.c'; then $(CYGPATH_W) 'tools/tpm2_getcap.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getcap.c'; fi`
 
-tools/tools_tpm2-tpm2_encryptdecrypt.obj: tools/tpm2_encryptdecrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_encryptdecrypt.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_encryptdecrypt.Tpo -c -o tools/tools_tpm2-tpm2_encryptdecrypt.obj `if test -f 'tools/tpm2_encryptdecrypt.c'; then $(CYGPATH_W) 'tools/tpm2_encryptdecrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_encryptdecrypt.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_encryptdecrypt.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_encryptdecrypt.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_encryptdecrypt.c' object='tools/tools_tpm2-tpm2_encryptdecrypt.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_gettestresult.o: tools/tpm2_gettestresult.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_gettestresult.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_gettestresult.Tpo -c -o tools/tpm2-tpm2_gettestresult.o `test -f 'tools/tpm2_gettestresult.c' || echo '$(srcdir)/'`tools/tpm2_gettestresult.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_gettestresult.Tpo tools/$(DEPDIR)/tpm2-tpm2_gettestresult.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_gettestresult.c' object='tools/tpm2-tpm2_gettestresult.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_encryptdecrypt.obj `if test -f 'tools/tpm2_encryptdecrypt.c'; then $(CYGPATH_W) 'tools/tpm2_encryptdecrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_encryptdecrypt.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_gettestresult.o `test -f 'tools/tpm2_gettestresult.c' || echo '$(srcdir)/'`tools/tpm2_gettestresult.c
 
-tools/tools_tpm2-tpm2_evictcontrol.o: tools/tpm2_evictcontrol.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_evictcontrol.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_evictcontrol.Tpo -c -o tools/tools_tpm2-tpm2_evictcontrol.o `test -f 'tools/tpm2_evictcontrol.c' || echo '$(srcdir)/'`tools/tpm2_evictcontrol.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_evictcontrol.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_evictcontrol.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_evictcontrol.c' object='tools/tools_tpm2-tpm2_evictcontrol.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_gettestresult.obj: tools/tpm2_gettestresult.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_gettestresult.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_gettestresult.Tpo -c -o tools/tpm2-tpm2_gettestresult.obj `if test -f 'tools/tpm2_gettestresult.c'; then $(CYGPATH_W) 'tools/tpm2_gettestresult.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_gettestresult.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_gettestresult.Tpo tools/$(DEPDIR)/tpm2-tpm2_gettestresult.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_gettestresult.c' object='tools/tpm2-tpm2_gettestresult.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_evictcontrol.o `test -f 'tools/tpm2_evictcontrol.c' || echo '$(srcdir)/'`tools/tpm2_evictcontrol.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_gettestresult.obj `if test -f 'tools/tpm2_gettestresult.c'; then $(CYGPATH_W) 'tools/tpm2_gettestresult.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_gettestresult.c'; fi`
 
-tools/tools_tpm2-tpm2_evictcontrol.obj: tools/tpm2_evictcontrol.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_evictcontrol.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_evictcontrol.Tpo -c -o tools/tools_tpm2-tpm2_evictcontrol.obj `if test -f 'tools/tpm2_evictcontrol.c'; then $(CYGPATH_W) 'tools/tpm2_evictcontrol.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_evictcontrol.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_evictcontrol.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_evictcontrol.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_evictcontrol.c' object='tools/tools_tpm2-tpm2_evictcontrol.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_encryptdecrypt.o: tools/tpm2_encryptdecrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_encryptdecrypt.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_encryptdecrypt.Tpo -c -o tools/tpm2-tpm2_encryptdecrypt.o `test -f 'tools/tpm2_encryptdecrypt.c' || echo '$(srcdir)/'`tools/tpm2_encryptdecrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_encryptdecrypt.Tpo tools/$(DEPDIR)/tpm2-tpm2_encryptdecrypt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_encryptdecrypt.c' object='tools/tpm2-tpm2_encryptdecrypt.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_evictcontrol.obj `if test -f 'tools/tpm2_evictcontrol.c'; then $(CYGPATH_W) 'tools/tpm2_evictcontrol.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_evictcontrol.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_encryptdecrypt.o `test -f 'tools/tpm2_encryptdecrypt.c' || echo '$(srcdir)/'`tools/tpm2_encryptdecrypt.c
 
-tools/tools_tpm2-tpm2_flushcontext.o: tools/tpm2_flushcontext.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_flushcontext.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_flushcontext.Tpo -c -o tools/tools_tpm2-tpm2_flushcontext.o `test -f 'tools/tpm2_flushcontext.c' || echo '$(srcdir)/'`tools/tpm2_flushcontext.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_flushcontext.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_flushcontext.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_flushcontext.c' object='tools/tools_tpm2-tpm2_flushcontext.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_encryptdecrypt.obj: tools/tpm2_encryptdecrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_encryptdecrypt.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_encryptdecrypt.Tpo -c -o tools/tpm2-tpm2_encryptdecrypt.obj `if test -f 'tools/tpm2_encryptdecrypt.c'; then $(CYGPATH_W) 'tools/tpm2_encryptdecrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_encryptdecrypt.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_encryptdecrypt.Tpo tools/$(DEPDIR)/tpm2-tpm2_encryptdecrypt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_encryptdecrypt.c' object='tools/tpm2-tpm2_encryptdecrypt.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_flushcontext.o `test -f 'tools/tpm2_flushcontext.c' || echo '$(srcdir)/'`tools/tpm2_flushcontext.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_encryptdecrypt.obj `if test -f 'tools/tpm2_encryptdecrypt.c'; then $(CYGPATH_W) 'tools/tpm2_encryptdecrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_encryptdecrypt.c'; fi`
 
-tools/tools_tpm2-tpm2_flushcontext.obj: tools/tpm2_flushcontext.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_flushcontext.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_flushcontext.Tpo -c -o tools/tools_tpm2-tpm2_flushcontext.obj `if test -f 'tools/tpm2_flushcontext.c'; then $(CYGPATH_W) 'tools/tpm2_flushcontext.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_flushcontext.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_flushcontext.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_flushcontext.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_flushcontext.c' object='tools/tools_tpm2-tpm2_flushcontext.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_evictcontrol.o: tools/tpm2_evictcontrol.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_evictcontrol.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_evictcontrol.Tpo -c -o tools/tpm2-tpm2_evictcontrol.o `test -f 'tools/tpm2_evictcontrol.c' || echo '$(srcdir)/'`tools/tpm2_evictcontrol.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_evictcontrol.Tpo tools/$(DEPDIR)/tpm2-tpm2_evictcontrol.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_evictcontrol.c' object='tools/tpm2-tpm2_evictcontrol.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_flushcontext.obj `if test -f 'tools/tpm2_flushcontext.c'; then $(CYGPATH_W) 'tools/tpm2_flushcontext.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_flushcontext.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_evictcontrol.o `test -f 'tools/tpm2_evictcontrol.c' || echo '$(srcdir)/'`tools/tpm2_evictcontrol.c
 
-tools/tools_tpm2-tpm2_getekcertificate.o: tools/tpm2_getekcertificate.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_getekcertificate.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_getekcertificate.Tpo -c -o tools/tools_tpm2-tpm2_getekcertificate.o `test -f 'tools/tpm2_getekcertificate.c' || echo '$(srcdir)/'`tools/tpm2_getekcertificate.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_getekcertificate.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_getekcertificate.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getekcertificate.c' object='tools/tools_tpm2-tpm2_getekcertificate.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_evictcontrol.obj: tools/tpm2_evictcontrol.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_evictcontrol.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_evictcontrol.Tpo -c -o tools/tpm2-tpm2_evictcontrol.obj `if test -f 'tools/tpm2_evictcontrol.c'; then $(CYGPATH_W) 'tools/tpm2_evictcontrol.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_evictcontrol.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_evictcontrol.Tpo tools/$(DEPDIR)/tpm2-tpm2_evictcontrol.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_evictcontrol.c' object='tools/tpm2-tpm2_evictcontrol.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_getekcertificate.o `test -f 'tools/tpm2_getekcertificate.c' || echo '$(srcdir)/'`tools/tpm2_getekcertificate.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_evictcontrol.obj `if test -f 'tools/tpm2_evictcontrol.c'; then $(CYGPATH_W) 'tools/tpm2_evictcontrol.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_evictcontrol.c'; fi`
 
-tools/tools_tpm2-tpm2_getekcertificate.obj: tools/tpm2_getekcertificate.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_getekcertificate.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_getekcertificate.Tpo -c -o tools/tools_tpm2-tpm2_getekcertificate.obj `if test -f 'tools/tpm2_getekcertificate.c'; then $(CYGPATH_W) 'tools/tpm2_getekcertificate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getekcertificate.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_getekcertificate.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_getekcertificate.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getekcertificate.c' object='tools/tools_tpm2-tpm2_getekcertificate.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_flushcontext.o: tools/tpm2_flushcontext.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_flushcontext.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_flushcontext.Tpo -c -o tools/tpm2-tpm2_flushcontext.o `test -f 'tools/tpm2_flushcontext.c' || echo '$(srcdir)/'`tools/tpm2_flushcontext.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_flushcontext.Tpo tools/$(DEPDIR)/tpm2-tpm2_flushcontext.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_flushcontext.c' object='tools/tpm2-tpm2_flushcontext.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_getekcertificate.obj `if test -f 'tools/tpm2_getekcertificate.c'; then $(CYGPATH_W) 'tools/tpm2_getekcertificate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getekcertificate.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_flushcontext.o `test -f 'tools/tpm2_flushcontext.c' || echo '$(srcdir)/'`tools/tpm2_flushcontext.c
 
-tools/tools_tpm2-tpm2_getrandom.o: tools/tpm2_getrandom.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_getrandom.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_getrandom.Tpo -c -o tools/tools_tpm2-tpm2_getrandom.o `test -f 'tools/tpm2_getrandom.c' || echo '$(srcdir)/'`tools/tpm2_getrandom.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_getrandom.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_getrandom.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getrandom.c' object='tools/tools_tpm2-tpm2_getrandom.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_flushcontext.obj: tools/tpm2_flushcontext.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_flushcontext.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_flushcontext.Tpo -c -o tools/tpm2-tpm2_flushcontext.obj `if test -f 'tools/tpm2_flushcontext.c'; then $(CYGPATH_W) 'tools/tpm2_flushcontext.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_flushcontext.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_flushcontext.Tpo tools/$(DEPDIR)/tpm2-tpm2_flushcontext.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_flushcontext.c' object='tools/tpm2-tpm2_flushcontext.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_getrandom.o `test -f 'tools/tpm2_getrandom.c' || echo '$(srcdir)/'`tools/tpm2_getrandom.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_flushcontext.obj `if test -f 'tools/tpm2_flushcontext.c'; then $(CYGPATH_W) 'tools/tpm2_flushcontext.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_flushcontext.c'; fi`
 
-tools/tools_tpm2-tpm2_getrandom.obj: tools/tpm2_getrandom.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_getrandom.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_getrandom.Tpo -c -o tools/tools_tpm2-tpm2_getrandom.obj `if test -f 'tools/tpm2_getrandom.c'; then $(CYGPATH_W) 'tools/tpm2_getrandom.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getrandom.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_getrandom.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_getrandom.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getrandom.c' object='tools/tools_tpm2-tpm2_getrandom.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_getekcertificate.o: tools/tpm2_getekcertificate.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_getekcertificate.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_getekcertificate.Tpo -c -o tools/tpm2-tpm2_getekcertificate.o `test -f 'tools/tpm2_getekcertificate.c' || echo '$(srcdir)/'`tools/tpm2_getekcertificate.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_getekcertificate.Tpo tools/$(DEPDIR)/tpm2-tpm2_getekcertificate.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getekcertificate.c' object='tools/tpm2-tpm2_getekcertificate.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_getrandom.obj `if test -f 'tools/tpm2_getrandom.c'; then $(CYGPATH_W) 'tools/tpm2_getrandom.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getrandom.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_getekcertificate.o `test -f 'tools/tpm2_getekcertificate.c' || echo '$(srcdir)/'`tools/tpm2_getekcertificate.c
 
-tools/tools_tpm2-tpm2_gettime.o: tools/tpm2_gettime.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_gettime.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_gettime.Tpo -c -o tools/tools_tpm2-tpm2_gettime.o `test -f 'tools/tpm2_gettime.c' || echo '$(srcdir)/'`tools/tpm2_gettime.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_gettime.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_gettime.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_gettime.c' object='tools/tools_tpm2-tpm2_gettime.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_getekcertificate.obj: tools/tpm2_getekcertificate.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_getekcertificate.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_getekcertificate.Tpo -c -o tools/tpm2-tpm2_getekcertificate.obj `if test -f 'tools/tpm2_getekcertificate.c'; then $(CYGPATH_W) 'tools/tpm2_getekcertificate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getekcertificate.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_getekcertificate.Tpo tools/$(DEPDIR)/tpm2-tpm2_getekcertificate.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getekcertificate.c' object='tools/tpm2-tpm2_getekcertificate.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_gettime.o `test -f 'tools/tpm2_gettime.c' || echo '$(srcdir)/'`tools/tpm2_gettime.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_getekcertificate.obj `if test -f 'tools/tpm2_getekcertificate.c'; then $(CYGPATH_W) 'tools/tpm2_getekcertificate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getekcertificate.c'; fi`
 
-tools/tools_tpm2-tpm2_gettime.obj: tools/tpm2_gettime.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_gettime.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_gettime.Tpo -c -o tools/tools_tpm2-tpm2_gettime.obj `if test -f 'tools/tpm2_gettime.c'; then $(CYGPATH_W) 'tools/tpm2_gettime.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_gettime.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_gettime.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_gettime.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_gettime.c' object='tools/tools_tpm2-tpm2_gettime.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_getrandom.o: tools/tpm2_getrandom.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_getrandom.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_getrandom.Tpo -c -o tools/tpm2-tpm2_getrandom.o `test -f 'tools/tpm2_getrandom.c' || echo '$(srcdir)/'`tools/tpm2_getrandom.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_getrandom.Tpo tools/$(DEPDIR)/tpm2-tpm2_getrandom.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getrandom.c' object='tools/tpm2-tpm2_getrandom.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_gettime.obj `if test -f 'tools/tpm2_gettime.c'; then $(CYGPATH_W) 'tools/tpm2_gettime.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_gettime.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_getrandom.o `test -f 'tools/tpm2_getrandom.c' || echo '$(srcdir)/'`tools/tpm2_getrandom.c
 
-tools/tools_tpm2-tpm2_hash.o: tools/tpm2_hash.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_hash.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_hash.Tpo -c -o tools/tools_tpm2-tpm2_hash.o `test -f 'tools/tpm2_hash.c' || echo '$(srcdir)/'`tools/tpm2_hash.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_hash.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_hash.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_hash.c' object='tools/tools_tpm2-tpm2_hash.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_getrandom.obj: tools/tpm2_getrandom.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_getrandom.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_getrandom.Tpo -c -o tools/tpm2-tpm2_getrandom.obj `if test -f 'tools/tpm2_getrandom.c'; then $(CYGPATH_W) 'tools/tpm2_getrandom.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getrandom.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_getrandom.Tpo tools/$(DEPDIR)/tpm2-tpm2_getrandom.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getrandom.c' object='tools/tpm2-tpm2_getrandom.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_hash.o `test -f 'tools/tpm2_hash.c' || echo '$(srcdir)/'`tools/tpm2_hash.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_getrandom.obj `if test -f 'tools/tpm2_getrandom.c'; then $(CYGPATH_W) 'tools/tpm2_getrandom.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getrandom.c'; fi`
 
-tools/tools_tpm2-tpm2_hash.obj: tools/tpm2_hash.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_hash.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_hash.Tpo -c -o tools/tools_tpm2-tpm2_hash.obj `if test -f 'tools/tpm2_hash.c'; then $(CYGPATH_W) 'tools/tpm2_hash.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_hash.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_hash.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_hash.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_hash.c' object='tools/tools_tpm2-tpm2_hash.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_gettime.o: tools/tpm2_gettime.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_gettime.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_gettime.Tpo -c -o tools/tpm2-tpm2_gettime.o `test -f 'tools/tpm2_gettime.c' || echo '$(srcdir)/'`tools/tpm2_gettime.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_gettime.Tpo tools/$(DEPDIR)/tpm2-tpm2_gettime.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_gettime.c' object='tools/tpm2-tpm2_gettime.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_hash.obj `if test -f 'tools/tpm2_hash.c'; then $(CYGPATH_W) 'tools/tpm2_hash.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_hash.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_gettime.o `test -f 'tools/tpm2_gettime.c' || echo '$(srcdir)/'`tools/tpm2_gettime.c
 
-tools/tools_tpm2-tpm2_hierarchycontrol.o: tools/tpm2_hierarchycontrol.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_hierarchycontrol.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_hierarchycontrol.Tpo -c -o tools/tools_tpm2-tpm2_hierarchycontrol.o `test -f 'tools/tpm2_hierarchycontrol.c' || echo '$(srcdir)/'`tools/tpm2_hierarchycontrol.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_hierarchycontrol.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_hierarchycontrol.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_hierarchycontrol.c' object='tools/tools_tpm2-tpm2_hierarchycontrol.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_gettime.obj: tools/tpm2_gettime.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_gettime.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_gettime.Tpo -c -o tools/tpm2-tpm2_gettime.obj `if test -f 'tools/tpm2_gettime.c'; then $(CYGPATH_W) 'tools/tpm2_gettime.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_gettime.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_gettime.Tpo tools/$(DEPDIR)/tpm2-tpm2_gettime.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_gettime.c' object='tools/tpm2-tpm2_gettime.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_hierarchycontrol.o `test -f 'tools/tpm2_hierarchycontrol.c' || echo '$(srcdir)/'`tools/tpm2_hierarchycontrol.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_gettime.obj `if test -f 'tools/tpm2_gettime.c'; then $(CYGPATH_W) 'tools/tpm2_gettime.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_gettime.c'; fi`
 
-tools/tools_tpm2-tpm2_hierarchycontrol.obj: tools/tpm2_hierarchycontrol.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_hierarchycontrol.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_hierarchycontrol.Tpo -c -o tools/tools_tpm2-tpm2_hierarchycontrol.obj `if test -f 'tools/tpm2_hierarchycontrol.c'; then $(CYGPATH_W) 'tools/tpm2_hierarchycontrol.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_hierarchycontrol.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_hierarchycontrol.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_hierarchycontrol.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_hierarchycontrol.c' object='tools/tools_tpm2-tpm2_hierarchycontrol.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_hash.o: tools/tpm2_hash.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_hash.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_hash.Tpo -c -o tools/tpm2-tpm2_hash.o `test -f 'tools/tpm2_hash.c' || echo '$(srcdir)/'`tools/tpm2_hash.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_hash.Tpo tools/$(DEPDIR)/tpm2-tpm2_hash.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_hash.c' object='tools/tpm2-tpm2_hash.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_hierarchycontrol.obj `if test -f 'tools/tpm2_hierarchycontrol.c'; then $(CYGPATH_W) 'tools/tpm2_hierarchycontrol.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_hierarchycontrol.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_hash.o `test -f 'tools/tpm2_hash.c' || echo '$(srcdir)/'`tools/tpm2_hash.c
 
-tools/tools_tpm2-tpm2_hmac.o: tools/tpm2_hmac.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_hmac.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_hmac.Tpo -c -o tools/tools_tpm2-tpm2_hmac.o `test -f 'tools/tpm2_hmac.c' || echo '$(srcdir)/'`tools/tpm2_hmac.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_hmac.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_hmac.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_hmac.c' object='tools/tools_tpm2-tpm2_hmac.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_hash.obj: tools/tpm2_hash.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_hash.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_hash.Tpo -c -o tools/tpm2-tpm2_hash.obj `if test -f 'tools/tpm2_hash.c'; then $(CYGPATH_W) 'tools/tpm2_hash.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_hash.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_hash.Tpo tools/$(DEPDIR)/tpm2-tpm2_hash.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_hash.c' object='tools/tpm2-tpm2_hash.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_hmac.o `test -f 'tools/tpm2_hmac.c' || echo '$(srcdir)/'`tools/tpm2_hmac.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_hash.obj `if test -f 'tools/tpm2_hash.c'; then $(CYGPATH_W) 'tools/tpm2_hash.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_hash.c'; fi`
 
-tools/tools_tpm2-tpm2_hmac.obj: tools/tpm2_hmac.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_hmac.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_hmac.Tpo -c -o tools/tools_tpm2-tpm2_hmac.obj `if test -f 'tools/tpm2_hmac.c'; then $(CYGPATH_W) 'tools/tpm2_hmac.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_hmac.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_hmac.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_hmac.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_hmac.c' object='tools/tools_tpm2-tpm2_hmac.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_hierarchycontrol.o: tools/tpm2_hierarchycontrol.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_hierarchycontrol.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_hierarchycontrol.Tpo -c -o tools/tpm2-tpm2_hierarchycontrol.o `test -f 'tools/tpm2_hierarchycontrol.c' || echo '$(srcdir)/'`tools/tpm2_hierarchycontrol.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_hierarchycontrol.Tpo tools/$(DEPDIR)/tpm2-tpm2_hierarchycontrol.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_hierarchycontrol.c' object='tools/tpm2-tpm2_hierarchycontrol.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_hmac.obj `if test -f 'tools/tpm2_hmac.c'; then $(CYGPATH_W) 'tools/tpm2_hmac.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_hmac.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_hierarchycontrol.o `test -f 'tools/tpm2_hierarchycontrol.c' || echo '$(srcdir)/'`tools/tpm2_hierarchycontrol.c
 
-tools/tools_tpm2-tpm2_import.o: tools/tpm2_import.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_import.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_import.Tpo -c -o tools/tools_tpm2-tpm2_import.o `test -f 'tools/tpm2_import.c' || echo '$(srcdir)/'`tools/tpm2_import.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_import.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_import.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_import.c' object='tools/tools_tpm2-tpm2_import.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_hierarchycontrol.obj: tools/tpm2_hierarchycontrol.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_hierarchycontrol.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_hierarchycontrol.Tpo -c -o tools/tpm2-tpm2_hierarchycontrol.obj `if test -f 'tools/tpm2_hierarchycontrol.c'; then $(CYGPATH_W) 'tools/tpm2_hierarchycontrol.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_hierarchycontrol.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_hierarchycontrol.Tpo tools/$(DEPDIR)/tpm2-tpm2_hierarchycontrol.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_hierarchycontrol.c' object='tools/tpm2-tpm2_hierarchycontrol.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_import.o `test -f 'tools/tpm2_import.c' || echo '$(srcdir)/'`tools/tpm2_import.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_hierarchycontrol.obj `if test -f 'tools/tpm2_hierarchycontrol.c'; then $(CYGPATH_W) 'tools/tpm2_hierarchycontrol.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_hierarchycontrol.c'; fi`
 
-tools/tools_tpm2-tpm2_import.obj: tools/tpm2_import.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_import.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_import.Tpo -c -o tools/tools_tpm2-tpm2_import.obj `if test -f 'tools/tpm2_import.c'; then $(CYGPATH_W) 'tools/tpm2_import.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_import.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_import.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_import.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_import.c' object='tools/tools_tpm2-tpm2_import.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_hmac.o: tools/tpm2_hmac.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_hmac.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_hmac.Tpo -c -o tools/tpm2-tpm2_hmac.o `test -f 'tools/tpm2_hmac.c' || echo '$(srcdir)/'`tools/tpm2_hmac.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_hmac.Tpo tools/$(DEPDIR)/tpm2-tpm2_hmac.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_hmac.c' object='tools/tpm2-tpm2_hmac.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_import.obj `if test -f 'tools/tpm2_import.c'; then $(CYGPATH_W) 'tools/tpm2_import.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_import.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_hmac.o `test -f 'tools/tpm2_hmac.c' || echo '$(srcdir)/'`tools/tpm2_hmac.c
 
-tools/tools_tpm2-tpm2_incrementalselftest.o: tools/tpm2_incrementalselftest.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_incrementalselftest.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_incrementalselftest.Tpo -c -o tools/tools_tpm2-tpm2_incrementalselftest.o `test -f 'tools/tpm2_incrementalselftest.c' || echo '$(srcdir)/'`tools/tpm2_incrementalselftest.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_incrementalselftest.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_incrementalselftest.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_incrementalselftest.c' object='tools/tools_tpm2-tpm2_incrementalselftest.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_hmac.obj: tools/tpm2_hmac.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_hmac.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_hmac.Tpo -c -o tools/tpm2-tpm2_hmac.obj `if test -f 'tools/tpm2_hmac.c'; then $(CYGPATH_W) 'tools/tpm2_hmac.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_hmac.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_hmac.Tpo tools/$(DEPDIR)/tpm2-tpm2_hmac.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_hmac.c' object='tools/tpm2-tpm2_hmac.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_incrementalselftest.o `test -f 'tools/tpm2_incrementalselftest.c' || echo '$(srcdir)/'`tools/tpm2_incrementalselftest.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_hmac.obj `if test -f 'tools/tpm2_hmac.c'; then $(CYGPATH_W) 'tools/tpm2_hmac.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_hmac.c'; fi`
 
-tools/tools_tpm2-tpm2_incrementalselftest.obj: tools/tpm2_incrementalselftest.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_incrementalselftest.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_incrementalselftest.Tpo -c -o tools/tools_tpm2-tpm2_incrementalselftest.obj `if test -f 'tools/tpm2_incrementalselftest.c'; then $(CYGPATH_W) 'tools/tpm2_incrementalselftest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_incrementalselftest.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_incrementalselftest.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_incrementalselftest.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_incrementalselftest.c' object='tools/tools_tpm2-tpm2_incrementalselftest.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_import.o: tools/tpm2_import.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_import.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_import.Tpo -c -o tools/tpm2-tpm2_import.o `test -f 'tools/tpm2_import.c' || echo '$(srcdir)/'`tools/tpm2_import.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_import.Tpo tools/$(DEPDIR)/tpm2-tpm2_import.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_import.c' object='tools/tpm2-tpm2_import.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_incrementalselftest.obj `if test -f 'tools/tpm2_incrementalselftest.c'; then $(CYGPATH_W) 'tools/tpm2_incrementalselftest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_incrementalselftest.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_import.o `test -f 'tools/tpm2_import.c' || echo '$(srcdir)/'`tools/tpm2_import.c
 
-tools/tools_tpm2-tpm2_load.o: tools/tpm2_load.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_load.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_load.Tpo -c -o tools/tools_tpm2-tpm2_load.o `test -f 'tools/tpm2_load.c' || echo '$(srcdir)/'`tools/tpm2_load.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_load.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_load.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_load.c' object='tools/tools_tpm2-tpm2_load.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_import.obj: tools/tpm2_import.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_import.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_import.Tpo -c -o tools/tpm2-tpm2_import.obj `if test -f 'tools/tpm2_import.c'; then $(CYGPATH_W) 'tools/tpm2_import.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_import.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_import.Tpo tools/$(DEPDIR)/tpm2-tpm2_import.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_import.c' object='tools/tpm2-tpm2_import.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_load.o `test -f 'tools/tpm2_load.c' || echo '$(srcdir)/'`tools/tpm2_load.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_import.obj `if test -f 'tools/tpm2_import.c'; then $(CYGPATH_W) 'tools/tpm2_import.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_import.c'; fi`
 
-tools/tools_tpm2-tpm2_load.obj: tools/tpm2_load.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_load.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_load.Tpo -c -o tools/tools_tpm2-tpm2_load.obj `if test -f 'tools/tpm2_load.c'; then $(CYGPATH_W) 'tools/tpm2_load.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_load.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_load.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_load.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_load.c' object='tools/tools_tpm2-tpm2_load.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_incrementalselftest.o: tools/tpm2_incrementalselftest.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_incrementalselftest.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_incrementalselftest.Tpo -c -o tools/tpm2-tpm2_incrementalselftest.o `test -f 'tools/tpm2_incrementalselftest.c' || echo '$(srcdir)/'`tools/tpm2_incrementalselftest.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_incrementalselftest.Tpo tools/$(DEPDIR)/tpm2-tpm2_incrementalselftest.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_incrementalselftest.c' object='tools/tpm2-tpm2_incrementalselftest.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_load.obj `if test -f 'tools/tpm2_load.c'; then $(CYGPATH_W) 'tools/tpm2_load.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_load.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_incrementalselftest.o `test -f 'tools/tpm2_incrementalselftest.c' || echo '$(srcdir)/'`tools/tpm2_incrementalselftest.c
 
-tools/tools_tpm2-tpm2_loadexternal.o: tools/tpm2_loadexternal.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_loadexternal.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_loadexternal.Tpo -c -o tools/tools_tpm2-tpm2_loadexternal.o `test -f 'tools/tpm2_loadexternal.c' || echo '$(srcdir)/'`tools/tpm2_loadexternal.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_loadexternal.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_loadexternal.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_loadexternal.c' object='tools/tools_tpm2-tpm2_loadexternal.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_incrementalselftest.obj: tools/tpm2_incrementalselftest.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_incrementalselftest.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_incrementalselftest.Tpo -c -o tools/tpm2-tpm2_incrementalselftest.obj `if test -f 'tools/tpm2_incrementalselftest.c'; then $(CYGPATH_W) 'tools/tpm2_incrementalselftest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_incrementalselftest.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_incrementalselftest.Tpo tools/$(DEPDIR)/tpm2-tpm2_incrementalselftest.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_incrementalselftest.c' object='tools/tpm2-tpm2_incrementalselftest.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_loadexternal.o `test -f 'tools/tpm2_loadexternal.c' || echo '$(srcdir)/'`tools/tpm2_loadexternal.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_incrementalselftest.obj `if test -f 'tools/tpm2_incrementalselftest.c'; then $(CYGPATH_W) 'tools/tpm2_incrementalselftest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_incrementalselftest.c'; fi`
 
-tools/tools_tpm2-tpm2_loadexternal.obj: tools/tpm2_loadexternal.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_loadexternal.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_loadexternal.Tpo -c -o tools/tools_tpm2-tpm2_loadexternal.obj `if test -f 'tools/tpm2_loadexternal.c'; then $(CYGPATH_W) 'tools/tpm2_loadexternal.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_loadexternal.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_loadexternal.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_loadexternal.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_loadexternal.c' object='tools/tools_tpm2-tpm2_loadexternal.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_load.o: tools/tpm2_load.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_load.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_load.Tpo -c -o tools/tpm2-tpm2_load.o `test -f 'tools/tpm2_load.c' || echo '$(srcdir)/'`tools/tpm2_load.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_load.Tpo tools/$(DEPDIR)/tpm2-tpm2_load.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_load.c' object='tools/tpm2-tpm2_load.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_loadexternal.obj `if test -f 'tools/tpm2_loadexternal.c'; then $(CYGPATH_W) 'tools/tpm2_loadexternal.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_loadexternal.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_load.o `test -f 'tools/tpm2_load.c' || echo '$(srcdir)/'`tools/tpm2_load.c
 
-tools/tools_tpm2-tpm2_makecredential.o: tools/tpm2_makecredential.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_makecredential.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_makecredential.Tpo -c -o tools/tools_tpm2-tpm2_makecredential.o `test -f 'tools/tpm2_makecredential.c' || echo '$(srcdir)/'`tools/tpm2_makecredential.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_makecredential.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_makecredential.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_makecredential.c' object='tools/tools_tpm2-tpm2_makecredential.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_load.obj: tools/tpm2_load.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_load.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_load.Tpo -c -o tools/tpm2-tpm2_load.obj `if test -f 'tools/tpm2_load.c'; then $(CYGPATH_W) 'tools/tpm2_load.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_load.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_load.Tpo tools/$(DEPDIR)/tpm2-tpm2_load.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_load.c' object='tools/tpm2-tpm2_load.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_makecredential.o `test -f 'tools/tpm2_makecredential.c' || echo '$(srcdir)/'`tools/tpm2_makecredential.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_load.obj `if test -f 'tools/tpm2_load.c'; then $(CYGPATH_W) 'tools/tpm2_load.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_load.c'; fi`
 
-tools/tools_tpm2-tpm2_makecredential.obj: tools/tpm2_makecredential.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_makecredential.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_makecredential.Tpo -c -o tools/tools_tpm2-tpm2_makecredential.obj `if test -f 'tools/tpm2_makecredential.c'; then $(CYGPATH_W) 'tools/tpm2_makecredential.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_makecredential.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_makecredential.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_makecredential.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_makecredential.c' object='tools/tools_tpm2-tpm2_makecredential.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_loadexternal.o: tools/tpm2_loadexternal.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_loadexternal.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_loadexternal.Tpo -c -o tools/tpm2-tpm2_loadexternal.o `test -f 'tools/tpm2_loadexternal.c' || echo '$(srcdir)/'`tools/tpm2_loadexternal.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_loadexternal.Tpo tools/$(DEPDIR)/tpm2-tpm2_loadexternal.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_loadexternal.c' object='tools/tpm2-tpm2_loadexternal.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_makecredential.obj `if test -f 'tools/tpm2_makecredential.c'; then $(CYGPATH_W) 'tools/tpm2_makecredential.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_makecredential.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_loadexternal.o `test -f 'tools/tpm2_loadexternal.c' || echo '$(srcdir)/'`tools/tpm2_loadexternal.c
 
-tools/tools_tpm2-tpm2_nvdefine.o: tools/tpm2_nvdefine.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvdefine.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvdefine.Tpo -c -o tools/tools_tpm2-tpm2_nvdefine.o `test -f 'tools/tpm2_nvdefine.c' || echo '$(srcdir)/'`tools/tpm2_nvdefine.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvdefine.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvdefine.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvdefine.c' object='tools/tools_tpm2-tpm2_nvdefine.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_loadexternal.obj: tools/tpm2_loadexternal.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_loadexternal.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_loadexternal.Tpo -c -o tools/tpm2-tpm2_loadexternal.obj `if test -f 'tools/tpm2_loadexternal.c'; then $(CYGPATH_W) 'tools/tpm2_loadexternal.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_loadexternal.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_loadexternal.Tpo tools/$(DEPDIR)/tpm2-tpm2_loadexternal.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_loadexternal.c' object='tools/tpm2-tpm2_loadexternal.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvdefine.o `test -f 'tools/tpm2_nvdefine.c' || echo '$(srcdir)/'`tools/tpm2_nvdefine.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_loadexternal.obj `if test -f 'tools/tpm2_loadexternal.c'; then $(CYGPATH_W) 'tools/tpm2_loadexternal.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_loadexternal.c'; fi`
 
-tools/tools_tpm2-tpm2_nvdefine.obj: tools/tpm2_nvdefine.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvdefine.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvdefine.Tpo -c -o tools/tools_tpm2-tpm2_nvdefine.obj `if test -f 'tools/tpm2_nvdefine.c'; then $(CYGPATH_W) 'tools/tpm2_nvdefine.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvdefine.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvdefine.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvdefine.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvdefine.c' object='tools/tools_tpm2-tpm2_nvdefine.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_makecredential.o: tools/tpm2_makecredential.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_makecredential.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_makecredential.Tpo -c -o tools/tpm2-tpm2_makecredential.o `test -f 'tools/tpm2_makecredential.c' || echo '$(srcdir)/'`tools/tpm2_makecredential.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_makecredential.Tpo tools/$(DEPDIR)/tpm2-tpm2_makecredential.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_makecredential.c' object='tools/tpm2-tpm2_makecredential.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvdefine.obj `if test -f 'tools/tpm2_nvdefine.c'; then $(CYGPATH_W) 'tools/tpm2_nvdefine.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvdefine.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_makecredential.o `test -f 'tools/tpm2_makecredential.c' || echo '$(srcdir)/'`tools/tpm2_makecredential.c
 
-tools/tools_tpm2-tpm2_nvextend.o: tools/tpm2_nvextend.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvextend.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvextend.Tpo -c -o tools/tools_tpm2-tpm2_nvextend.o `test -f 'tools/tpm2_nvextend.c' || echo '$(srcdir)/'`tools/tpm2_nvextend.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvextend.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvextend.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvextend.c' object='tools/tools_tpm2-tpm2_nvextend.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_makecredential.obj: tools/tpm2_makecredential.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_makecredential.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_makecredential.Tpo -c -o tools/tpm2-tpm2_makecredential.obj `if test -f 'tools/tpm2_makecredential.c'; then $(CYGPATH_W) 'tools/tpm2_makecredential.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_makecredential.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_makecredential.Tpo tools/$(DEPDIR)/tpm2-tpm2_makecredential.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_makecredential.c' object='tools/tpm2-tpm2_makecredential.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvextend.o `test -f 'tools/tpm2_nvextend.c' || echo '$(srcdir)/'`tools/tpm2_nvextend.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_makecredential.obj `if test -f 'tools/tpm2_makecredential.c'; then $(CYGPATH_W) 'tools/tpm2_makecredential.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_makecredential.c'; fi`
 
-tools/tools_tpm2-tpm2_nvextend.obj: tools/tpm2_nvextend.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvextend.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvextend.Tpo -c -o tools/tools_tpm2-tpm2_nvextend.obj `if test -f 'tools/tpm2_nvextend.c'; then $(CYGPATH_W) 'tools/tpm2_nvextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvextend.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvextend.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvextend.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvextend.c' object='tools/tools_tpm2-tpm2_nvextend.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvdefine.o: tools/tpm2_nvdefine.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvdefine.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvdefine.Tpo -c -o tools/tpm2-tpm2_nvdefine.o `test -f 'tools/tpm2_nvdefine.c' || echo '$(srcdir)/'`tools/tpm2_nvdefine.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvdefine.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvdefine.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvdefine.c' object='tools/tpm2-tpm2_nvdefine.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvextend.obj `if test -f 'tools/tpm2_nvextend.c'; then $(CYGPATH_W) 'tools/tpm2_nvextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvextend.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvdefine.o `test -f 'tools/tpm2_nvdefine.c' || echo '$(srcdir)/'`tools/tpm2_nvdefine.c
 
-tools/tools_tpm2-tpm2_nvincrement.o: tools/tpm2_nvincrement.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvincrement.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvincrement.Tpo -c -o tools/tools_tpm2-tpm2_nvincrement.o `test -f 'tools/tpm2_nvincrement.c' || echo '$(srcdir)/'`tools/tpm2_nvincrement.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvincrement.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvincrement.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvincrement.c' object='tools/tools_tpm2-tpm2_nvincrement.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvdefine.obj: tools/tpm2_nvdefine.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvdefine.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvdefine.Tpo -c -o tools/tpm2-tpm2_nvdefine.obj `if test -f 'tools/tpm2_nvdefine.c'; then $(CYGPATH_W) 'tools/tpm2_nvdefine.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvdefine.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvdefine.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvdefine.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvdefine.c' object='tools/tpm2-tpm2_nvdefine.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvincrement.o `test -f 'tools/tpm2_nvincrement.c' || echo '$(srcdir)/'`tools/tpm2_nvincrement.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvdefine.obj `if test -f 'tools/tpm2_nvdefine.c'; then $(CYGPATH_W) 'tools/tpm2_nvdefine.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvdefine.c'; fi`
 
-tools/tools_tpm2-tpm2_nvincrement.obj: tools/tpm2_nvincrement.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvincrement.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvincrement.Tpo -c -o tools/tools_tpm2-tpm2_nvincrement.obj `if test -f 'tools/tpm2_nvincrement.c'; then $(CYGPATH_W) 'tools/tpm2_nvincrement.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvincrement.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvincrement.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvincrement.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvincrement.c' object='tools/tools_tpm2-tpm2_nvincrement.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvextend.o: tools/tpm2_nvextend.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvextend.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvextend.Tpo -c -o tools/tpm2-tpm2_nvextend.o `test -f 'tools/tpm2_nvextend.c' || echo '$(srcdir)/'`tools/tpm2_nvextend.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvextend.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvextend.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvextend.c' object='tools/tpm2-tpm2_nvextend.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvincrement.obj `if test -f 'tools/tpm2_nvincrement.c'; then $(CYGPATH_W) 'tools/tpm2_nvincrement.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvincrement.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvextend.o `test -f 'tools/tpm2_nvextend.c' || echo '$(srcdir)/'`tools/tpm2_nvextend.c
 
-tools/tools_tpm2-tpm2_nvreadpublic.o: tools/tpm2_nvreadpublic.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvreadpublic.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadpublic.Tpo -c -o tools/tools_tpm2-tpm2_nvreadpublic.o `test -f 'tools/tpm2_nvreadpublic.c' || echo '$(srcdir)/'`tools/tpm2_nvreadpublic.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadpublic.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadpublic.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvreadpublic.c' object='tools/tools_tpm2-tpm2_nvreadpublic.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvextend.obj: tools/tpm2_nvextend.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvextend.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvextend.Tpo -c -o tools/tpm2-tpm2_nvextend.obj `if test -f 'tools/tpm2_nvextend.c'; then $(CYGPATH_W) 'tools/tpm2_nvextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvextend.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvextend.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvextend.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvextend.c' object='tools/tpm2-tpm2_nvextend.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvreadpublic.o `test -f 'tools/tpm2_nvreadpublic.c' || echo '$(srcdir)/'`tools/tpm2_nvreadpublic.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvextend.obj `if test -f 'tools/tpm2_nvextend.c'; then $(CYGPATH_W) 'tools/tpm2_nvextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvextend.c'; fi`
 
-tools/tools_tpm2-tpm2_nvreadpublic.obj: tools/tpm2_nvreadpublic.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvreadpublic.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadpublic.Tpo -c -o tools/tools_tpm2-tpm2_nvreadpublic.obj `if test -f 'tools/tpm2_nvreadpublic.c'; then $(CYGPATH_W) 'tools/tpm2_nvreadpublic.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvreadpublic.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadpublic.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadpublic.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvreadpublic.c' object='tools/tools_tpm2-tpm2_nvreadpublic.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvincrement.o: tools/tpm2_nvincrement.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvincrement.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvincrement.Tpo -c -o tools/tpm2-tpm2_nvincrement.o `test -f 'tools/tpm2_nvincrement.c' || echo '$(srcdir)/'`tools/tpm2_nvincrement.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvincrement.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvincrement.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvincrement.c' object='tools/tpm2-tpm2_nvincrement.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvreadpublic.obj `if test -f 'tools/tpm2_nvreadpublic.c'; then $(CYGPATH_W) 'tools/tpm2_nvreadpublic.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvreadpublic.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvincrement.o `test -f 'tools/tpm2_nvincrement.c' || echo '$(srcdir)/'`tools/tpm2_nvincrement.c
 
-tools/tools_tpm2-tpm2_nvread.o: tools/tpm2_nvread.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvread.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvread.Tpo -c -o tools/tools_tpm2-tpm2_nvread.o `test -f 'tools/tpm2_nvread.c' || echo '$(srcdir)/'`tools/tpm2_nvread.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvread.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvread.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvread.c' object='tools/tools_tpm2-tpm2_nvread.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvincrement.obj: tools/tpm2_nvincrement.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvincrement.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvincrement.Tpo -c -o tools/tpm2-tpm2_nvincrement.obj `if test -f 'tools/tpm2_nvincrement.c'; then $(CYGPATH_W) 'tools/tpm2_nvincrement.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvincrement.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvincrement.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvincrement.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvincrement.c' object='tools/tpm2-tpm2_nvincrement.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvread.o `test -f 'tools/tpm2_nvread.c' || echo '$(srcdir)/'`tools/tpm2_nvread.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvincrement.obj `if test -f 'tools/tpm2_nvincrement.c'; then $(CYGPATH_W) 'tools/tpm2_nvincrement.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvincrement.c'; fi`
 
-tools/tools_tpm2-tpm2_nvread.obj: tools/tpm2_nvread.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvread.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvread.Tpo -c -o tools/tools_tpm2-tpm2_nvread.obj `if test -f 'tools/tpm2_nvread.c'; then $(CYGPATH_W) 'tools/tpm2_nvread.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvread.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvread.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvread.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvread.c' object='tools/tools_tpm2-tpm2_nvread.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvreadpublic.o: tools/tpm2_nvreadpublic.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvreadpublic.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvreadpublic.Tpo -c -o tools/tpm2-tpm2_nvreadpublic.o `test -f 'tools/tpm2_nvreadpublic.c' || echo '$(srcdir)/'`tools/tpm2_nvreadpublic.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvreadpublic.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvreadpublic.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvreadpublic.c' object='tools/tpm2-tpm2_nvreadpublic.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvread.obj `if test -f 'tools/tpm2_nvread.c'; then $(CYGPATH_W) 'tools/tpm2_nvread.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvread.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvreadpublic.o `test -f 'tools/tpm2_nvreadpublic.c' || echo '$(srcdir)/'`tools/tpm2_nvreadpublic.c
 
-tools/tools_tpm2-tpm2_nvreadlock.o: tools/tpm2_nvreadlock.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvreadlock.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadlock.Tpo -c -o tools/tools_tpm2-tpm2_nvreadlock.o `test -f 'tools/tpm2_nvreadlock.c' || echo '$(srcdir)/'`tools/tpm2_nvreadlock.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadlock.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadlock.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvreadlock.c' object='tools/tools_tpm2-tpm2_nvreadlock.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvreadpublic.obj: tools/tpm2_nvreadpublic.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvreadpublic.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvreadpublic.Tpo -c -o tools/tpm2-tpm2_nvreadpublic.obj `if test -f 'tools/tpm2_nvreadpublic.c'; then $(CYGPATH_W) 'tools/tpm2_nvreadpublic.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvreadpublic.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvreadpublic.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvreadpublic.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvreadpublic.c' object='tools/tpm2-tpm2_nvreadpublic.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvreadlock.o `test -f 'tools/tpm2_nvreadlock.c' || echo '$(srcdir)/'`tools/tpm2_nvreadlock.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvreadpublic.obj `if test -f 'tools/tpm2_nvreadpublic.c'; then $(CYGPATH_W) 'tools/tpm2_nvreadpublic.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvreadpublic.c'; fi`
 
-tools/tools_tpm2-tpm2_nvreadlock.obj: tools/tpm2_nvreadlock.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvreadlock.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadlock.Tpo -c -o tools/tools_tpm2-tpm2_nvreadlock.obj `if test -f 'tools/tpm2_nvreadlock.c'; then $(CYGPATH_W) 'tools/tpm2_nvreadlock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvreadlock.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadlock.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvreadlock.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvreadlock.c' object='tools/tools_tpm2-tpm2_nvreadlock.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvread.o: tools/tpm2_nvread.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvread.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvread.Tpo -c -o tools/tpm2-tpm2_nvread.o `test -f 'tools/tpm2_nvread.c' || echo '$(srcdir)/'`tools/tpm2_nvread.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvread.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvread.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvread.c' object='tools/tpm2-tpm2_nvread.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvreadlock.obj `if test -f 'tools/tpm2_nvreadlock.c'; then $(CYGPATH_W) 'tools/tpm2_nvreadlock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvreadlock.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvread.o `test -f 'tools/tpm2_nvread.c' || echo '$(srcdir)/'`tools/tpm2_nvread.c
 
-tools/tools_tpm2-tpm2_nvundefine.o: tools/tpm2_nvundefine.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvundefine.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvundefine.Tpo -c -o tools/tools_tpm2-tpm2_nvundefine.o `test -f 'tools/tpm2_nvundefine.c' || echo '$(srcdir)/'`tools/tpm2_nvundefine.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvundefine.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvundefine.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvundefine.c' object='tools/tools_tpm2-tpm2_nvundefine.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvread.obj: tools/tpm2_nvread.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvread.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvread.Tpo -c -o tools/tpm2-tpm2_nvread.obj `if test -f 'tools/tpm2_nvread.c'; then $(CYGPATH_W) 'tools/tpm2_nvread.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvread.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvread.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvread.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvread.c' object='tools/tpm2-tpm2_nvread.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvundefine.o `test -f 'tools/tpm2_nvundefine.c' || echo '$(srcdir)/'`tools/tpm2_nvundefine.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvread.obj `if test -f 'tools/tpm2_nvread.c'; then $(CYGPATH_W) 'tools/tpm2_nvread.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvread.c'; fi`
 
-tools/tools_tpm2-tpm2_nvundefine.obj: tools/tpm2_nvundefine.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvundefine.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvundefine.Tpo -c -o tools/tools_tpm2-tpm2_nvundefine.obj `if test -f 'tools/tpm2_nvundefine.c'; then $(CYGPATH_W) 'tools/tpm2_nvundefine.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvundefine.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvundefine.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvundefine.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvundefine.c' object='tools/tools_tpm2-tpm2_nvundefine.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvreadlock.o: tools/tpm2_nvreadlock.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvreadlock.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvreadlock.Tpo -c -o tools/tpm2-tpm2_nvreadlock.o `test -f 'tools/tpm2_nvreadlock.c' || echo '$(srcdir)/'`tools/tpm2_nvreadlock.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvreadlock.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvreadlock.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvreadlock.c' object='tools/tpm2-tpm2_nvreadlock.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvundefine.obj `if test -f 'tools/tpm2_nvundefine.c'; then $(CYGPATH_W) 'tools/tpm2_nvundefine.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvundefine.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvreadlock.o `test -f 'tools/tpm2_nvreadlock.c' || echo '$(srcdir)/'`tools/tpm2_nvreadlock.c
 
-tools/tools_tpm2-tpm2_nvwrite.o: tools/tpm2_nvwrite.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvwrite.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvwrite.Tpo -c -o tools/tools_tpm2-tpm2_nvwrite.o `test -f 'tools/tpm2_nvwrite.c' || echo '$(srcdir)/'`tools/tpm2_nvwrite.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvwrite.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvwrite.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvwrite.c' object='tools/tools_tpm2-tpm2_nvwrite.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvreadlock.obj: tools/tpm2_nvreadlock.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvreadlock.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvreadlock.Tpo -c -o tools/tpm2-tpm2_nvreadlock.obj `if test -f 'tools/tpm2_nvreadlock.c'; then $(CYGPATH_W) 'tools/tpm2_nvreadlock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvreadlock.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvreadlock.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvreadlock.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvreadlock.c' object='tools/tpm2-tpm2_nvreadlock.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvwrite.o `test -f 'tools/tpm2_nvwrite.c' || echo '$(srcdir)/'`tools/tpm2_nvwrite.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvreadlock.obj `if test -f 'tools/tpm2_nvreadlock.c'; then $(CYGPATH_W) 'tools/tpm2_nvreadlock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvreadlock.c'; fi`
 
-tools/tools_tpm2-tpm2_nvwrite.obj: tools/tpm2_nvwrite.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvwrite.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvwrite.Tpo -c -o tools/tools_tpm2-tpm2_nvwrite.obj `if test -f 'tools/tpm2_nvwrite.c'; then $(CYGPATH_W) 'tools/tpm2_nvwrite.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvwrite.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvwrite.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvwrite.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvwrite.c' object='tools/tools_tpm2-tpm2_nvwrite.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvundefine.o: tools/tpm2_nvundefine.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvundefine.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvundefine.Tpo -c -o tools/tpm2-tpm2_nvundefine.o `test -f 'tools/tpm2_nvundefine.c' || echo '$(srcdir)/'`tools/tpm2_nvundefine.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvundefine.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvundefine.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvundefine.c' object='tools/tpm2-tpm2_nvundefine.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvwrite.obj `if test -f 'tools/tpm2_nvwrite.c'; then $(CYGPATH_W) 'tools/tpm2_nvwrite.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvwrite.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvundefine.o `test -f 'tools/tpm2_nvundefine.c' || echo '$(srcdir)/'`tools/tpm2_nvundefine.c
 
-tools/tools_tpm2-tpm2_nvwritelock.o: tools/tpm2_nvwritelock.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvwritelock.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvwritelock.Tpo -c -o tools/tools_tpm2-tpm2_nvwritelock.o `test -f 'tools/tpm2_nvwritelock.c' || echo '$(srcdir)/'`tools/tpm2_nvwritelock.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvwritelock.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvwritelock.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvwritelock.c' object='tools/tools_tpm2-tpm2_nvwritelock.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvundefine.obj: tools/tpm2_nvundefine.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvundefine.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvundefine.Tpo -c -o tools/tpm2-tpm2_nvundefine.obj `if test -f 'tools/tpm2_nvundefine.c'; then $(CYGPATH_W) 'tools/tpm2_nvundefine.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvundefine.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvundefine.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvundefine.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvundefine.c' object='tools/tpm2-tpm2_nvundefine.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvwritelock.o `test -f 'tools/tpm2_nvwritelock.c' || echo '$(srcdir)/'`tools/tpm2_nvwritelock.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvundefine.obj `if test -f 'tools/tpm2_nvundefine.c'; then $(CYGPATH_W) 'tools/tpm2_nvundefine.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvundefine.c'; fi`
 
-tools/tools_tpm2-tpm2_nvwritelock.obj: tools/tpm2_nvwritelock.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvwritelock.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvwritelock.Tpo -c -o tools/tools_tpm2-tpm2_nvwritelock.obj `if test -f 'tools/tpm2_nvwritelock.c'; then $(CYGPATH_W) 'tools/tpm2_nvwritelock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvwritelock.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvwritelock.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvwritelock.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvwritelock.c' object='tools/tools_tpm2-tpm2_nvwritelock.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvwrite.o: tools/tpm2_nvwrite.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvwrite.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvwrite.Tpo -c -o tools/tpm2-tpm2_nvwrite.o `test -f 'tools/tpm2_nvwrite.c' || echo '$(srcdir)/'`tools/tpm2_nvwrite.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvwrite.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvwrite.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvwrite.c' object='tools/tpm2-tpm2_nvwrite.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvwritelock.obj `if test -f 'tools/tpm2_nvwritelock.c'; then $(CYGPATH_W) 'tools/tpm2_nvwritelock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvwritelock.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvwrite.o `test -f 'tools/tpm2_nvwrite.c' || echo '$(srcdir)/'`tools/tpm2_nvwrite.c
 
-tools/tools_tpm2-tpm2_nvsetbits.o: tools/tpm2_nvsetbits.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvsetbits.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvsetbits.Tpo -c -o tools/tools_tpm2-tpm2_nvsetbits.o `test -f 'tools/tpm2_nvsetbits.c' || echo '$(srcdir)/'`tools/tpm2_nvsetbits.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvsetbits.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvsetbits.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvsetbits.c' object='tools/tools_tpm2-tpm2_nvsetbits.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvwrite.obj: tools/tpm2_nvwrite.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvwrite.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvwrite.Tpo -c -o tools/tpm2-tpm2_nvwrite.obj `if test -f 'tools/tpm2_nvwrite.c'; then $(CYGPATH_W) 'tools/tpm2_nvwrite.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvwrite.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvwrite.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvwrite.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvwrite.c' object='tools/tpm2-tpm2_nvwrite.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvsetbits.o `test -f 'tools/tpm2_nvsetbits.c' || echo '$(srcdir)/'`tools/tpm2_nvsetbits.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvwrite.obj `if test -f 'tools/tpm2_nvwrite.c'; then $(CYGPATH_W) 'tools/tpm2_nvwrite.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvwrite.c'; fi`
 
-tools/tools_tpm2-tpm2_nvsetbits.obj: tools/tpm2_nvsetbits.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvsetbits.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvsetbits.Tpo -c -o tools/tools_tpm2-tpm2_nvsetbits.obj `if test -f 'tools/tpm2_nvsetbits.c'; then $(CYGPATH_W) 'tools/tpm2_nvsetbits.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvsetbits.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvsetbits.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvsetbits.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvsetbits.c' object='tools/tools_tpm2-tpm2_nvsetbits.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvwritelock.o: tools/tpm2_nvwritelock.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvwritelock.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvwritelock.Tpo -c -o tools/tpm2-tpm2_nvwritelock.o `test -f 'tools/tpm2_nvwritelock.c' || echo '$(srcdir)/'`tools/tpm2_nvwritelock.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvwritelock.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvwritelock.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvwritelock.c' object='tools/tpm2-tpm2_nvwritelock.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvsetbits.obj `if test -f 'tools/tpm2_nvsetbits.c'; then $(CYGPATH_W) 'tools/tpm2_nvsetbits.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvsetbits.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvwritelock.o `test -f 'tools/tpm2_nvwritelock.c' || echo '$(srcdir)/'`tools/tpm2_nvwritelock.c
 
-tools/tools_tpm2-tpm2_pcrallocate.o: tools/tpm2_pcrallocate.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_pcrallocate.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_pcrallocate.Tpo -c -o tools/tools_tpm2-tpm2_pcrallocate.o `test -f 'tools/tpm2_pcrallocate.c' || echo '$(srcdir)/'`tools/tpm2_pcrallocate.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_pcrallocate.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_pcrallocate.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrallocate.c' object='tools/tools_tpm2-tpm2_pcrallocate.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvwritelock.obj: tools/tpm2_nvwritelock.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvwritelock.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvwritelock.Tpo -c -o tools/tpm2-tpm2_nvwritelock.obj `if test -f 'tools/tpm2_nvwritelock.c'; then $(CYGPATH_W) 'tools/tpm2_nvwritelock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvwritelock.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvwritelock.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvwritelock.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvwritelock.c' object='tools/tpm2-tpm2_nvwritelock.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_pcrallocate.o `test -f 'tools/tpm2_pcrallocate.c' || echo '$(srcdir)/'`tools/tpm2_pcrallocate.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvwritelock.obj `if test -f 'tools/tpm2_nvwritelock.c'; then $(CYGPATH_W) 'tools/tpm2_nvwritelock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvwritelock.c'; fi`
 
-tools/tools_tpm2-tpm2_pcrallocate.obj: tools/tpm2_pcrallocate.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_pcrallocate.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_pcrallocate.Tpo -c -o tools/tools_tpm2-tpm2_pcrallocate.obj `if test -f 'tools/tpm2_pcrallocate.c'; then $(CYGPATH_W) 'tools/tpm2_pcrallocate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrallocate.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_pcrallocate.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_pcrallocate.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrallocate.c' object='tools/tools_tpm2-tpm2_pcrallocate.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvsetbits.o: tools/tpm2_nvsetbits.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvsetbits.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvsetbits.Tpo -c -o tools/tpm2-tpm2_nvsetbits.o `test -f 'tools/tpm2_nvsetbits.c' || echo '$(srcdir)/'`tools/tpm2_nvsetbits.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvsetbits.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvsetbits.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvsetbits.c' object='tools/tpm2-tpm2_nvsetbits.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_pcrallocate.obj `if test -f 'tools/tpm2_pcrallocate.c'; then $(CYGPATH_W) 'tools/tpm2_pcrallocate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrallocate.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvsetbits.o `test -f 'tools/tpm2_nvsetbits.c' || echo '$(srcdir)/'`tools/tpm2_nvsetbits.c
 
-tools/tools_tpm2-tpm2_pcrevent.o: tools/tpm2_pcrevent.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_pcrevent.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_pcrevent.Tpo -c -o tools/tools_tpm2-tpm2_pcrevent.o `test -f 'tools/tpm2_pcrevent.c' || echo '$(srcdir)/'`tools/tpm2_pcrevent.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_pcrevent.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_pcrevent.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrevent.c' object='tools/tools_tpm2-tpm2_pcrevent.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvsetbits.obj: tools/tpm2_nvsetbits.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvsetbits.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvsetbits.Tpo -c -o tools/tpm2-tpm2_nvsetbits.obj `if test -f 'tools/tpm2_nvsetbits.c'; then $(CYGPATH_W) 'tools/tpm2_nvsetbits.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvsetbits.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvsetbits.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvsetbits.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvsetbits.c' object='tools/tpm2-tpm2_nvsetbits.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_pcrevent.o `test -f 'tools/tpm2_pcrevent.c' || echo '$(srcdir)/'`tools/tpm2_pcrevent.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvsetbits.obj `if test -f 'tools/tpm2_nvsetbits.c'; then $(CYGPATH_W) 'tools/tpm2_nvsetbits.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvsetbits.c'; fi`
 
-tools/tools_tpm2-tpm2_pcrevent.obj: tools/tpm2_pcrevent.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_pcrevent.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_pcrevent.Tpo -c -o tools/tools_tpm2-tpm2_pcrevent.obj `if test -f 'tools/tpm2_pcrevent.c'; then $(CYGPATH_W) 'tools/tpm2_pcrevent.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrevent.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_pcrevent.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_pcrevent.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrevent.c' object='tools/tools_tpm2-tpm2_pcrevent.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_pcrallocate.o: tools/tpm2_pcrallocate.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_pcrallocate.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_pcrallocate.Tpo -c -o tools/tpm2-tpm2_pcrallocate.o `test -f 'tools/tpm2_pcrallocate.c' || echo '$(srcdir)/'`tools/tpm2_pcrallocate.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_pcrallocate.Tpo tools/$(DEPDIR)/tpm2-tpm2_pcrallocate.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrallocate.c' object='tools/tpm2-tpm2_pcrallocate.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_pcrevent.obj `if test -f 'tools/tpm2_pcrevent.c'; then $(CYGPATH_W) 'tools/tpm2_pcrevent.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrevent.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_pcrallocate.o `test -f 'tools/tpm2_pcrallocate.c' || echo '$(srcdir)/'`tools/tpm2_pcrallocate.c
 
-tools/tools_tpm2-tpm2_pcrextend.o: tools/tpm2_pcrextend.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_pcrextend.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_pcrextend.Tpo -c -o tools/tools_tpm2-tpm2_pcrextend.o `test -f 'tools/tpm2_pcrextend.c' || echo '$(srcdir)/'`tools/tpm2_pcrextend.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_pcrextend.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_pcrextend.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrextend.c' object='tools/tools_tpm2-tpm2_pcrextend.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_pcrallocate.obj: tools/tpm2_pcrallocate.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_pcrallocate.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_pcrallocate.Tpo -c -o tools/tpm2-tpm2_pcrallocate.obj `if test -f 'tools/tpm2_pcrallocate.c'; then $(CYGPATH_W) 'tools/tpm2_pcrallocate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrallocate.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_pcrallocate.Tpo tools/$(DEPDIR)/tpm2-tpm2_pcrallocate.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrallocate.c' object='tools/tpm2-tpm2_pcrallocate.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_pcrextend.o `test -f 'tools/tpm2_pcrextend.c' || echo '$(srcdir)/'`tools/tpm2_pcrextend.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_pcrallocate.obj `if test -f 'tools/tpm2_pcrallocate.c'; then $(CYGPATH_W) 'tools/tpm2_pcrallocate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrallocate.c'; fi`
 
-tools/tools_tpm2-tpm2_pcrextend.obj: tools/tpm2_pcrextend.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_pcrextend.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_pcrextend.Tpo -c -o tools/tools_tpm2-tpm2_pcrextend.obj `if test -f 'tools/tpm2_pcrextend.c'; then $(CYGPATH_W) 'tools/tpm2_pcrextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrextend.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_pcrextend.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_pcrextend.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrextend.c' object='tools/tools_tpm2-tpm2_pcrextend.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_pcrevent.o: tools/tpm2_pcrevent.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_pcrevent.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_pcrevent.Tpo -c -o tools/tpm2-tpm2_pcrevent.o `test -f 'tools/tpm2_pcrevent.c' || echo '$(srcdir)/'`tools/tpm2_pcrevent.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_pcrevent.Tpo tools/$(DEPDIR)/tpm2-tpm2_pcrevent.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrevent.c' object='tools/tpm2-tpm2_pcrevent.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_pcrextend.obj `if test -f 'tools/tpm2_pcrextend.c'; then $(CYGPATH_W) 'tools/tpm2_pcrextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrextend.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_pcrevent.o `test -f 'tools/tpm2_pcrevent.c' || echo '$(srcdir)/'`tools/tpm2_pcrevent.c
 
-tools/tools_tpm2-tpm2_pcrread.o: tools/tpm2_pcrread.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_pcrread.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_pcrread.Tpo -c -o tools/tools_tpm2-tpm2_pcrread.o `test -f 'tools/tpm2_pcrread.c' || echo '$(srcdir)/'`tools/tpm2_pcrread.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_pcrread.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_pcrread.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrread.c' object='tools/tools_tpm2-tpm2_pcrread.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_pcrevent.obj: tools/tpm2_pcrevent.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_pcrevent.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_pcrevent.Tpo -c -o tools/tpm2-tpm2_pcrevent.obj `if test -f 'tools/tpm2_pcrevent.c'; then $(CYGPATH_W) 'tools/tpm2_pcrevent.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrevent.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_pcrevent.Tpo tools/$(DEPDIR)/tpm2-tpm2_pcrevent.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrevent.c' object='tools/tpm2-tpm2_pcrevent.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_pcrread.o `test -f 'tools/tpm2_pcrread.c' || echo '$(srcdir)/'`tools/tpm2_pcrread.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_pcrevent.obj `if test -f 'tools/tpm2_pcrevent.c'; then $(CYGPATH_W) 'tools/tpm2_pcrevent.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrevent.c'; fi`
 
-tools/tools_tpm2-tpm2_pcrread.obj: tools/tpm2_pcrread.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_pcrread.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_pcrread.Tpo -c -o tools/tools_tpm2-tpm2_pcrread.obj `if test -f 'tools/tpm2_pcrread.c'; then $(CYGPATH_W) 'tools/tpm2_pcrread.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrread.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_pcrread.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_pcrread.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrread.c' object='tools/tools_tpm2-tpm2_pcrread.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_pcrextend.o: tools/tpm2_pcrextend.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_pcrextend.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_pcrextend.Tpo -c -o tools/tpm2-tpm2_pcrextend.o `test -f 'tools/tpm2_pcrextend.c' || echo '$(srcdir)/'`tools/tpm2_pcrextend.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_pcrextend.Tpo tools/$(DEPDIR)/tpm2-tpm2_pcrextend.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrextend.c' object='tools/tpm2-tpm2_pcrextend.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_pcrread.obj `if test -f 'tools/tpm2_pcrread.c'; then $(CYGPATH_W) 'tools/tpm2_pcrread.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrread.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_pcrextend.o `test -f 'tools/tpm2_pcrextend.c' || echo '$(srcdir)/'`tools/tpm2_pcrextend.c
 
-tools/tools_tpm2-tpm2_pcrreset.o: tools/tpm2_pcrreset.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_pcrreset.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_pcrreset.Tpo -c -o tools/tools_tpm2-tpm2_pcrreset.o `test -f 'tools/tpm2_pcrreset.c' || echo '$(srcdir)/'`tools/tpm2_pcrreset.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_pcrreset.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_pcrreset.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrreset.c' object='tools/tools_tpm2-tpm2_pcrreset.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_pcrextend.obj: tools/tpm2_pcrextend.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_pcrextend.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_pcrextend.Tpo -c -o tools/tpm2-tpm2_pcrextend.obj `if test -f 'tools/tpm2_pcrextend.c'; then $(CYGPATH_W) 'tools/tpm2_pcrextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrextend.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_pcrextend.Tpo tools/$(DEPDIR)/tpm2-tpm2_pcrextend.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrextend.c' object='tools/tpm2-tpm2_pcrextend.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_pcrreset.o `test -f 'tools/tpm2_pcrreset.c' || echo '$(srcdir)/'`tools/tpm2_pcrreset.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_pcrextend.obj `if test -f 'tools/tpm2_pcrextend.c'; then $(CYGPATH_W) 'tools/tpm2_pcrextend.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrextend.c'; fi`
 
-tools/tools_tpm2-tpm2_pcrreset.obj: tools/tpm2_pcrreset.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_pcrreset.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_pcrreset.Tpo -c -o tools/tools_tpm2-tpm2_pcrreset.obj `if test -f 'tools/tpm2_pcrreset.c'; then $(CYGPATH_W) 'tools/tpm2_pcrreset.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrreset.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_pcrreset.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_pcrreset.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrreset.c' object='tools/tools_tpm2-tpm2_pcrreset.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_pcrread.o: tools/tpm2_pcrread.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_pcrread.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_pcrread.Tpo -c -o tools/tpm2-tpm2_pcrread.o `test -f 'tools/tpm2_pcrread.c' || echo '$(srcdir)/'`tools/tpm2_pcrread.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_pcrread.Tpo tools/$(DEPDIR)/tpm2-tpm2_pcrread.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrread.c' object='tools/tpm2-tpm2_pcrread.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_pcrreset.obj `if test -f 'tools/tpm2_pcrreset.c'; then $(CYGPATH_W) 'tools/tpm2_pcrreset.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrreset.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_pcrread.o `test -f 'tools/tpm2_pcrread.c' || echo '$(srcdir)/'`tools/tpm2_pcrread.c
 
-tools/tools_tpm2-tpm2_policypcr.o: tools/tpm2_policypcr.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policypcr.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policypcr.Tpo -c -o tools/tools_tpm2-tpm2_policypcr.o `test -f 'tools/tpm2_policypcr.c' || echo '$(srcdir)/'`tools/tpm2_policypcr.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policypcr.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policypcr.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policypcr.c' object='tools/tools_tpm2-tpm2_policypcr.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_pcrread.obj: tools/tpm2_pcrread.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_pcrread.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_pcrread.Tpo -c -o tools/tpm2-tpm2_pcrread.obj `if test -f 'tools/tpm2_pcrread.c'; then $(CYGPATH_W) 'tools/tpm2_pcrread.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrread.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_pcrread.Tpo tools/$(DEPDIR)/tpm2-tpm2_pcrread.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrread.c' object='tools/tpm2-tpm2_pcrread.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policypcr.o `test -f 'tools/tpm2_policypcr.c' || echo '$(srcdir)/'`tools/tpm2_policypcr.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_pcrread.obj `if test -f 'tools/tpm2_pcrread.c'; then $(CYGPATH_W) 'tools/tpm2_pcrread.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrread.c'; fi`
 
-tools/tools_tpm2-tpm2_policypcr.obj: tools/tpm2_policypcr.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policypcr.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policypcr.Tpo -c -o tools/tools_tpm2-tpm2_policypcr.obj `if test -f 'tools/tpm2_policypcr.c'; then $(CYGPATH_W) 'tools/tpm2_policypcr.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policypcr.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policypcr.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policypcr.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policypcr.c' object='tools/tools_tpm2-tpm2_policypcr.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_pcrreset.o: tools/tpm2_pcrreset.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_pcrreset.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_pcrreset.Tpo -c -o tools/tpm2-tpm2_pcrreset.o `test -f 'tools/tpm2_pcrreset.c' || echo '$(srcdir)/'`tools/tpm2_pcrreset.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_pcrreset.Tpo tools/$(DEPDIR)/tpm2-tpm2_pcrreset.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrreset.c' object='tools/tpm2-tpm2_pcrreset.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policypcr.obj `if test -f 'tools/tpm2_policypcr.c'; then $(CYGPATH_W) 'tools/tpm2_policypcr.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policypcr.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_pcrreset.o `test -f 'tools/tpm2_pcrreset.c' || echo '$(srcdir)/'`tools/tpm2_pcrreset.c
 
-tools/tools_tpm2-tpm2_policyauthorize.o: tools/tpm2_policyauthorize.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyauthorize.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorize.Tpo -c -o tools/tools_tpm2-tpm2_policyauthorize.o `test -f 'tools/tpm2_policyauthorize.c' || echo '$(srcdir)/'`tools/tpm2_policyauthorize.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorize.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorize.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyauthorize.c' object='tools/tools_tpm2-tpm2_policyauthorize.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_pcrreset.obj: tools/tpm2_pcrreset.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_pcrreset.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_pcrreset.Tpo -c -o tools/tpm2-tpm2_pcrreset.obj `if test -f 'tools/tpm2_pcrreset.c'; then $(CYGPATH_W) 'tools/tpm2_pcrreset.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrreset.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_pcrreset.Tpo tools/$(DEPDIR)/tpm2-tpm2_pcrreset.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_pcrreset.c' object='tools/tpm2-tpm2_pcrreset.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyauthorize.o `test -f 'tools/tpm2_policyauthorize.c' || echo '$(srcdir)/'`tools/tpm2_policyauthorize.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_pcrreset.obj `if test -f 'tools/tpm2_pcrreset.c'; then $(CYGPATH_W) 'tools/tpm2_pcrreset.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_pcrreset.c'; fi`
 
-tools/tools_tpm2-tpm2_policyauthorize.obj: tools/tpm2_policyauthorize.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyauthorize.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorize.Tpo -c -o tools/tools_tpm2-tpm2_policyauthorize.obj `if test -f 'tools/tpm2_policyauthorize.c'; then $(CYGPATH_W) 'tools/tpm2_policyauthorize.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyauthorize.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorize.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorize.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyauthorize.c' object='tools/tools_tpm2-tpm2_policyauthorize.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policypcr.o: tools/tpm2_policypcr.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policypcr.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policypcr.Tpo -c -o tools/tpm2-tpm2_policypcr.o `test -f 'tools/tpm2_policypcr.c' || echo '$(srcdir)/'`tools/tpm2_policypcr.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policypcr.Tpo tools/$(DEPDIR)/tpm2-tpm2_policypcr.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policypcr.c' object='tools/tpm2-tpm2_policypcr.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyauthorize.obj `if test -f 'tools/tpm2_policyauthorize.c'; then $(CYGPATH_W) 'tools/tpm2_policyauthorize.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyauthorize.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policypcr.o `test -f 'tools/tpm2_policypcr.c' || echo '$(srcdir)/'`tools/tpm2_policypcr.c
 
-tools/tools_tpm2-tpm2_policyauthorizenv.o: tools/tpm2_policyauthorizenv.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyauthorizenv.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorizenv.Tpo -c -o tools/tools_tpm2-tpm2_policyauthorizenv.o `test -f 'tools/tpm2_policyauthorizenv.c' || echo '$(srcdir)/'`tools/tpm2_policyauthorizenv.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorizenv.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorizenv.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyauthorizenv.c' object='tools/tools_tpm2-tpm2_policyauthorizenv.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policypcr.obj: tools/tpm2_policypcr.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policypcr.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policypcr.Tpo -c -o tools/tpm2-tpm2_policypcr.obj `if test -f 'tools/tpm2_policypcr.c'; then $(CYGPATH_W) 'tools/tpm2_policypcr.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policypcr.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policypcr.Tpo tools/$(DEPDIR)/tpm2-tpm2_policypcr.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policypcr.c' object='tools/tpm2-tpm2_policypcr.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyauthorizenv.o `test -f 'tools/tpm2_policyauthorizenv.c' || echo '$(srcdir)/'`tools/tpm2_policyauthorizenv.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policypcr.obj `if test -f 'tools/tpm2_policypcr.c'; then $(CYGPATH_W) 'tools/tpm2_policypcr.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policypcr.c'; fi`
 
-tools/tools_tpm2-tpm2_policyauthorizenv.obj: tools/tpm2_policyauthorizenv.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyauthorizenv.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorizenv.Tpo -c -o tools/tools_tpm2-tpm2_policyauthorizenv.obj `if test -f 'tools/tpm2_policyauthorizenv.c'; then $(CYGPATH_W) 'tools/tpm2_policyauthorizenv.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyauthorizenv.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorizenv.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthorizenv.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyauthorizenv.c' object='tools/tools_tpm2-tpm2_policyauthorizenv.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyauthorize.o: tools/tpm2_policyauthorize.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyauthorize.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyauthorize.Tpo -c -o tools/tpm2-tpm2_policyauthorize.o `test -f 'tools/tpm2_policyauthorize.c' || echo '$(srcdir)/'`tools/tpm2_policyauthorize.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyauthorize.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyauthorize.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyauthorize.c' object='tools/tpm2-tpm2_policyauthorize.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyauthorizenv.obj `if test -f 'tools/tpm2_policyauthorizenv.c'; then $(CYGPATH_W) 'tools/tpm2_policyauthorizenv.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyauthorizenv.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyauthorize.o `test -f 'tools/tpm2_policyauthorize.c' || echo '$(srcdir)/'`tools/tpm2_policyauthorize.c
 
-tools/tools_tpm2-tpm2_policynv.o: tools/tpm2_policynv.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policynv.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policynv.Tpo -c -o tools/tools_tpm2-tpm2_policynv.o `test -f 'tools/tpm2_policynv.c' || echo '$(srcdir)/'`tools/tpm2_policynv.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policynv.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policynv.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policynv.c' object='tools/tools_tpm2-tpm2_policynv.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyauthorize.obj: tools/tpm2_policyauthorize.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyauthorize.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyauthorize.Tpo -c -o tools/tpm2-tpm2_policyauthorize.obj `if test -f 'tools/tpm2_policyauthorize.c'; then $(CYGPATH_W) 'tools/tpm2_policyauthorize.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyauthorize.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyauthorize.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyauthorize.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyauthorize.c' object='tools/tpm2-tpm2_policyauthorize.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policynv.o `test -f 'tools/tpm2_policynv.c' || echo '$(srcdir)/'`tools/tpm2_policynv.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyauthorize.obj `if test -f 'tools/tpm2_policyauthorize.c'; then $(CYGPATH_W) 'tools/tpm2_policyauthorize.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyauthorize.c'; fi`
 
-tools/tools_tpm2-tpm2_policynv.obj: tools/tpm2_policynv.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policynv.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policynv.Tpo -c -o tools/tools_tpm2-tpm2_policynv.obj `if test -f 'tools/tpm2_policynv.c'; then $(CYGPATH_W) 'tools/tpm2_policynv.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policynv.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policynv.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policynv.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policynv.c' object='tools/tools_tpm2-tpm2_policynv.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyauthorizenv.o: tools/tpm2_policyauthorizenv.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyauthorizenv.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyauthorizenv.Tpo -c -o tools/tpm2-tpm2_policyauthorizenv.o `test -f 'tools/tpm2_policyauthorizenv.c' || echo '$(srcdir)/'`tools/tpm2_policyauthorizenv.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyauthorizenv.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyauthorizenv.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyauthorizenv.c' object='tools/tpm2-tpm2_policyauthorizenv.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policynv.obj `if test -f 'tools/tpm2_policynv.c'; then $(CYGPATH_W) 'tools/tpm2_policynv.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policynv.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyauthorizenv.o `test -f 'tools/tpm2_policyauthorizenv.c' || echo '$(srcdir)/'`tools/tpm2_policyauthorizenv.c
 
-tools/tools_tpm2-tpm2_policycountertimer.o: tools/tpm2_policycountertimer.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policycountertimer.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policycountertimer.Tpo -c -o tools/tools_tpm2-tpm2_policycountertimer.o `test -f 'tools/tpm2_policycountertimer.c' || echo '$(srcdir)/'`tools/tpm2_policycountertimer.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policycountertimer.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policycountertimer.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policycountertimer.c' object='tools/tools_tpm2-tpm2_policycountertimer.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyauthorizenv.obj: tools/tpm2_policyauthorizenv.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyauthorizenv.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyauthorizenv.Tpo -c -o tools/tpm2-tpm2_policyauthorizenv.obj `if test -f 'tools/tpm2_policyauthorizenv.c'; then $(CYGPATH_W) 'tools/tpm2_policyauthorizenv.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyauthorizenv.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyauthorizenv.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyauthorizenv.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyauthorizenv.c' object='tools/tpm2-tpm2_policyauthorizenv.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policycountertimer.o `test -f 'tools/tpm2_policycountertimer.c' || echo '$(srcdir)/'`tools/tpm2_policycountertimer.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyauthorizenv.obj `if test -f 'tools/tpm2_policyauthorizenv.c'; then $(CYGPATH_W) 'tools/tpm2_policyauthorizenv.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyauthorizenv.c'; fi`
 
-tools/tools_tpm2-tpm2_policycountertimer.obj: tools/tpm2_policycountertimer.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policycountertimer.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policycountertimer.Tpo -c -o tools/tools_tpm2-tpm2_policycountertimer.obj `if test -f 'tools/tpm2_policycountertimer.c'; then $(CYGPATH_W) 'tools/tpm2_policycountertimer.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policycountertimer.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policycountertimer.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policycountertimer.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policycountertimer.c' object='tools/tools_tpm2-tpm2_policycountertimer.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policynv.o: tools/tpm2_policynv.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policynv.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policynv.Tpo -c -o tools/tpm2-tpm2_policynv.o `test -f 'tools/tpm2_policynv.c' || echo '$(srcdir)/'`tools/tpm2_policynv.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policynv.Tpo tools/$(DEPDIR)/tpm2-tpm2_policynv.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policynv.c' object='tools/tpm2-tpm2_policynv.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policycountertimer.obj `if test -f 'tools/tpm2_policycountertimer.c'; then $(CYGPATH_W) 'tools/tpm2_policycountertimer.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policycountertimer.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policynv.o `test -f 'tools/tpm2_policynv.c' || echo '$(srcdir)/'`tools/tpm2_policynv.c
 
-tools/tools_tpm2-tpm2_policyor.o: tools/tpm2_policyor.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyor.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyor.Tpo -c -o tools/tools_tpm2-tpm2_policyor.o `test -f 'tools/tpm2_policyor.c' || echo '$(srcdir)/'`tools/tpm2_policyor.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyor.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyor.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyor.c' object='tools/tools_tpm2-tpm2_policyor.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policynv.obj: tools/tpm2_policynv.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policynv.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policynv.Tpo -c -o tools/tpm2-tpm2_policynv.obj `if test -f 'tools/tpm2_policynv.c'; then $(CYGPATH_W) 'tools/tpm2_policynv.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policynv.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policynv.Tpo tools/$(DEPDIR)/tpm2-tpm2_policynv.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policynv.c' object='tools/tpm2-tpm2_policynv.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyor.o `test -f 'tools/tpm2_policyor.c' || echo '$(srcdir)/'`tools/tpm2_policyor.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policynv.obj `if test -f 'tools/tpm2_policynv.c'; then $(CYGPATH_W) 'tools/tpm2_policynv.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policynv.c'; fi`
 
-tools/tools_tpm2-tpm2_policyor.obj: tools/tpm2_policyor.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyor.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyor.Tpo -c -o tools/tools_tpm2-tpm2_policyor.obj `if test -f 'tools/tpm2_policyor.c'; then $(CYGPATH_W) 'tools/tpm2_policyor.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyor.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyor.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyor.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyor.c' object='tools/tools_tpm2-tpm2_policyor.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policycountertimer.o: tools/tpm2_policycountertimer.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policycountertimer.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policycountertimer.Tpo -c -o tools/tpm2-tpm2_policycountertimer.o `test -f 'tools/tpm2_policycountertimer.c' || echo '$(srcdir)/'`tools/tpm2_policycountertimer.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policycountertimer.Tpo tools/$(DEPDIR)/tpm2-tpm2_policycountertimer.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policycountertimer.c' object='tools/tpm2-tpm2_policycountertimer.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyor.obj `if test -f 'tools/tpm2_policyor.c'; then $(CYGPATH_W) 'tools/tpm2_policyor.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyor.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policycountertimer.o `test -f 'tools/tpm2_policycountertimer.c' || echo '$(srcdir)/'`tools/tpm2_policycountertimer.c
 
-tools/tools_tpm2-tpm2_policynamehash.o: tools/tpm2_policynamehash.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policynamehash.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policynamehash.Tpo -c -o tools/tools_tpm2-tpm2_policynamehash.o `test -f 'tools/tpm2_policynamehash.c' || echo '$(srcdir)/'`tools/tpm2_policynamehash.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policynamehash.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policynamehash.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policynamehash.c' object='tools/tools_tpm2-tpm2_policynamehash.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policycountertimer.obj: tools/tpm2_policycountertimer.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policycountertimer.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policycountertimer.Tpo -c -o tools/tpm2-tpm2_policycountertimer.obj `if test -f 'tools/tpm2_policycountertimer.c'; then $(CYGPATH_W) 'tools/tpm2_policycountertimer.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policycountertimer.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policycountertimer.Tpo tools/$(DEPDIR)/tpm2-tpm2_policycountertimer.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policycountertimer.c' object='tools/tpm2-tpm2_policycountertimer.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policynamehash.o `test -f 'tools/tpm2_policynamehash.c' || echo '$(srcdir)/'`tools/tpm2_policynamehash.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policycountertimer.obj `if test -f 'tools/tpm2_policycountertimer.c'; then $(CYGPATH_W) 'tools/tpm2_policycountertimer.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policycountertimer.c'; fi`
 
-tools/tools_tpm2-tpm2_policynamehash.obj: tools/tpm2_policynamehash.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policynamehash.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policynamehash.Tpo -c -o tools/tools_tpm2-tpm2_policynamehash.obj `if test -f 'tools/tpm2_policynamehash.c'; then $(CYGPATH_W) 'tools/tpm2_policynamehash.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policynamehash.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policynamehash.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policynamehash.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policynamehash.c' object='tools/tools_tpm2-tpm2_policynamehash.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyor.o: tools/tpm2_policyor.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyor.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyor.Tpo -c -o tools/tpm2-tpm2_policyor.o `test -f 'tools/tpm2_policyor.c' || echo '$(srcdir)/'`tools/tpm2_policyor.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyor.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyor.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyor.c' object='tools/tpm2-tpm2_policyor.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policynamehash.obj `if test -f 'tools/tpm2_policynamehash.c'; then $(CYGPATH_W) 'tools/tpm2_policynamehash.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policynamehash.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyor.o `test -f 'tools/tpm2_policyor.c' || echo '$(srcdir)/'`tools/tpm2_policyor.c
 
-tools/tools_tpm2-tpm2_policytemplate.o: tools/tpm2_policytemplate.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policytemplate.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policytemplate.Tpo -c -o tools/tools_tpm2-tpm2_policytemplate.o `test -f 'tools/tpm2_policytemplate.c' || echo '$(srcdir)/'`tools/tpm2_policytemplate.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policytemplate.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policytemplate.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policytemplate.c' object='tools/tools_tpm2-tpm2_policytemplate.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyor.obj: tools/tpm2_policyor.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyor.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyor.Tpo -c -o tools/tpm2-tpm2_policyor.obj `if test -f 'tools/tpm2_policyor.c'; then $(CYGPATH_W) 'tools/tpm2_policyor.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyor.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyor.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyor.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyor.c' object='tools/tpm2-tpm2_policyor.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policytemplate.o `test -f 'tools/tpm2_policytemplate.c' || echo '$(srcdir)/'`tools/tpm2_policytemplate.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyor.obj `if test -f 'tools/tpm2_policyor.c'; then $(CYGPATH_W) 'tools/tpm2_policyor.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyor.c'; fi`
 
-tools/tools_tpm2-tpm2_policytemplate.obj: tools/tpm2_policytemplate.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policytemplate.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policytemplate.Tpo -c -o tools/tools_tpm2-tpm2_policytemplate.obj `if test -f 'tools/tpm2_policytemplate.c'; then $(CYGPATH_W) 'tools/tpm2_policytemplate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policytemplate.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policytemplate.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policytemplate.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policytemplate.c' object='tools/tools_tpm2-tpm2_policytemplate.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policynamehash.o: tools/tpm2_policynamehash.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policynamehash.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policynamehash.Tpo -c -o tools/tpm2-tpm2_policynamehash.o `test -f 'tools/tpm2_policynamehash.c' || echo '$(srcdir)/'`tools/tpm2_policynamehash.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policynamehash.Tpo tools/$(DEPDIR)/tpm2-tpm2_policynamehash.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policynamehash.c' object='tools/tpm2-tpm2_policynamehash.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policytemplate.obj `if test -f 'tools/tpm2_policytemplate.c'; then $(CYGPATH_W) 'tools/tpm2_policytemplate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policytemplate.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policynamehash.o `test -f 'tools/tpm2_policynamehash.c' || echo '$(srcdir)/'`tools/tpm2_policynamehash.c
 
-tools/tools_tpm2-tpm2_policycphash.o: tools/tpm2_policycphash.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policycphash.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policycphash.Tpo -c -o tools/tools_tpm2-tpm2_policycphash.o `test -f 'tools/tpm2_policycphash.c' || echo '$(srcdir)/'`tools/tpm2_policycphash.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policycphash.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policycphash.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policycphash.c' object='tools/tools_tpm2-tpm2_policycphash.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policynamehash.obj: tools/tpm2_policynamehash.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policynamehash.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policynamehash.Tpo -c -o tools/tpm2-tpm2_policynamehash.obj `if test -f 'tools/tpm2_policynamehash.c'; then $(CYGPATH_W) 'tools/tpm2_policynamehash.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policynamehash.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policynamehash.Tpo tools/$(DEPDIR)/tpm2-tpm2_policynamehash.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policynamehash.c' object='tools/tpm2-tpm2_policynamehash.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policycphash.o `test -f 'tools/tpm2_policycphash.c' || echo '$(srcdir)/'`tools/tpm2_policycphash.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policynamehash.obj `if test -f 'tools/tpm2_policynamehash.c'; then $(CYGPATH_W) 'tools/tpm2_policynamehash.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policynamehash.c'; fi`
 
-tools/tools_tpm2-tpm2_policycphash.obj: tools/tpm2_policycphash.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policycphash.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policycphash.Tpo -c -o tools/tools_tpm2-tpm2_policycphash.obj `if test -f 'tools/tpm2_policycphash.c'; then $(CYGPATH_W) 'tools/tpm2_policycphash.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policycphash.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policycphash.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policycphash.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policycphash.c' object='tools/tools_tpm2-tpm2_policycphash.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policytemplate.o: tools/tpm2_policytemplate.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policytemplate.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policytemplate.Tpo -c -o tools/tpm2-tpm2_policytemplate.o `test -f 'tools/tpm2_policytemplate.c' || echo '$(srcdir)/'`tools/tpm2_policytemplate.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policytemplate.Tpo tools/$(DEPDIR)/tpm2-tpm2_policytemplate.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policytemplate.c' object='tools/tpm2-tpm2_policytemplate.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policycphash.obj `if test -f 'tools/tpm2_policycphash.c'; then $(CYGPATH_W) 'tools/tpm2_policycphash.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policycphash.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policytemplate.o `test -f 'tools/tpm2_policytemplate.c' || echo '$(srcdir)/'`tools/tpm2_policytemplate.c
 
-tools/tools_tpm2-tpm2_policypassword.o: tools/tpm2_policypassword.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policypassword.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policypassword.Tpo -c -o tools/tools_tpm2-tpm2_policypassword.o `test -f 'tools/tpm2_policypassword.c' || echo '$(srcdir)/'`tools/tpm2_policypassword.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policypassword.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policypassword.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policypassword.c' object='tools/tools_tpm2-tpm2_policypassword.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policytemplate.obj: tools/tpm2_policytemplate.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policytemplate.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policytemplate.Tpo -c -o tools/tpm2-tpm2_policytemplate.obj `if test -f 'tools/tpm2_policytemplate.c'; then $(CYGPATH_W) 'tools/tpm2_policytemplate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policytemplate.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policytemplate.Tpo tools/$(DEPDIR)/tpm2-tpm2_policytemplate.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policytemplate.c' object='tools/tpm2-tpm2_policytemplate.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policypassword.o `test -f 'tools/tpm2_policypassword.c' || echo '$(srcdir)/'`tools/tpm2_policypassword.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policytemplate.obj `if test -f 'tools/tpm2_policytemplate.c'; then $(CYGPATH_W) 'tools/tpm2_policytemplate.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policytemplate.c'; fi`
 
-tools/tools_tpm2-tpm2_policypassword.obj: tools/tpm2_policypassword.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policypassword.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policypassword.Tpo -c -o tools/tools_tpm2-tpm2_policypassword.obj `if test -f 'tools/tpm2_policypassword.c'; then $(CYGPATH_W) 'tools/tpm2_policypassword.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policypassword.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policypassword.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policypassword.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policypassword.c' object='tools/tools_tpm2-tpm2_policypassword.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policycphash.o: tools/tpm2_policycphash.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policycphash.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policycphash.Tpo -c -o tools/tpm2-tpm2_policycphash.o `test -f 'tools/tpm2_policycphash.c' || echo '$(srcdir)/'`tools/tpm2_policycphash.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policycphash.Tpo tools/$(DEPDIR)/tpm2-tpm2_policycphash.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policycphash.c' object='tools/tpm2-tpm2_policycphash.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policypassword.obj `if test -f 'tools/tpm2_policypassword.c'; then $(CYGPATH_W) 'tools/tpm2_policypassword.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policypassword.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policycphash.o `test -f 'tools/tpm2_policycphash.c' || echo '$(srcdir)/'`tools/tpm2_policycphash.c
 
-tools/tools_tpm2-tpm2_policysigned.o: tools/tpm2_policysigned.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policysigned.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policysigned.Tpo -c -o tools/tools_tpm2-tpm2_policysigned.o `test -f 'tools/tpm2_policysigned.c' || echo '$(srcdir)/'`tools/tpm2_policysigned.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policysigned.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policysigned.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policysigned.c' object='tools/tools_tpm2-tpm2_policysigned.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policycphash.obj: tools/tpm2_policycphash.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policycphash.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policycphash.Tpo -c -o tools/tpm2-tpm2_policycphash.obj `if test -f 'tools/tpm2_policycphash.c'; then $(CYGPATH_W) 'tools/tpm2_policycphash.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policycphash.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policycphash.Tpo tools/$(DEPDIR)/tpm2-tpm2_policycphash.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policycphash.c' object='tools/tpm2-tpm2_policycphash.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policysigned.o `test -f 'tools/tpm2_policysigned.c' || echo '$(srcdir)/'`tools/tpm2_policysigned.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policycphash.obj `if test -f 'tools/tpm2_policycphash.c'; then $(CYGPATH_W) 'tools/tpm2_policycphash.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policycphash.c'; fi`
 
-tools/tools_tpm2-tpm2_policysigned.obj: tools/tpm2_policysigned.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policysigned.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policysigned.Tpo -c -o tools/tools_tpm2-tpm2_policysigned.obj `if test -f 'tools/tpm2_policysigned.c'; then $(CYGPATH_W) 'tools/tpm2_policysigned.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policysigned.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policysigned.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policysigned.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policysigned.c' object='tools/tools_tpm2-tpm2_policysigned.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policypassword.o: tools/tpm2_policypassword.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policypassword.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policypassword.Tpo -c -o tools/tpm2-tpm2_policypassword.o `test -f 'tools/tpm2_policypassword.c' || echo '$(srcdir)/'`tools/tpm2_policypassword.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policypassword.Tpo tools/$(DEPDIR)/tpm2-tpm2_policypassword.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policypassword.c' object='tools/tpm2-tpm2_policypassword.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policysigned.obj `if test -f 'tools/tpm2_policysigned.c'; then $(CYGPATH_W) 'tools/tpm2_policysigned.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policysigned.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policypassword.o `test -f 'tools/tpm2_policypassword.c' || echo '$(srcdir)/'`tools/tpm2_policypassword.c
 
-tools/tools_tpm2-tpm2_policyticket.o: tools/tpm2_policyticket.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyticket.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyticket.Tpo -c -o tools/tools_tpm2-tpm2_policyticket.o `test -f 'tools/tpm2_policyticket.c' || echo '$(srcdir)/'`tools/tpm2_policyticket.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyticket.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyticket.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyticket.c' object='tools/tools_tpm2-tpm2_policyticket.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policypassword.obj: tools/tpm2_policypassword.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policypassword.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policypassword.Tpo -c -o tools/tpm2-tpm2_policypassword.obj `if test -f 'tools/tpm2_policypassword.c'; then $(CYGPATH_W) 'tools/tpm2_policypassword.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policypassword.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policypassword.Tpo tools/$(DEPDIR)/tpm2-tpm2_policypassword.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policypassword.c' object='tools/tpm2-tpm2_policypassword.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyticket.o `test -f 'tools/tpm2_policyticket.c' || echo '$(srcdir)/'`tools/tpm2_policyticket.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policypassword.obj `if test -f 'tools/tpm2_policypassword.c'; then $(CYGPATH_W) 'tools/tpm2_policypassword.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policypassword.c'; fi`
 
-tools/tools_tpm2-tpm2_policyticket.obj: tools/tpm2_policyticket.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyticket.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyticket.Tpo -c -o tools/tools_tpm2-tpm2_policyticket.obj `if test -f 'tools/tpm2_policyticket.c'; then $(CYGPATH_W) 'tools/tpm2_policyticket.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyticket.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyticket.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyticket.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyticket.c' object='tools/tools_tpm2-tpm2_policyticket.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policysigned.o: tools/tpm2_policysigned.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policysigned.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policysigned.Tpo -c -o tools/tpm2-tpm2_policysigned.o `test -f 'tools/tpm2_policysigned.c' || echo '$(srcdir)/'`tools/tpm2_policysigned.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policysigned.Tpo tools/$(DEPDIR)/tpm2-tpm2_policysigned.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policysigned.c' object='tools/tpm2-tpm2_policysigned.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyticket.obj `if test -f 'tools/tpm2_policyticket.c'; then $(CYGPATH_W) 'tools/tpm2_policyticket.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyticket.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policysigned.o `test -f 'tools/tpm2_policysigned.c' || echo '$(srcdir)/'`tools/tpm2_policysigned.c
 
-tools/tools_tpm2-tpm2_policyauthvalue.o: tools/tpm2_policyauthvalue.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyauthvalue.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthvalue.Tpo -c -o tools/tools_tpm2-tpm2_policyauthvalue.o `test -f 'tools/tpm2_policyauthvalue.c' || echo '$(srcdir)/'`tools/tpm2_policyauthvalue.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthvalue.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthvalue.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyauthvalue.c' object='tools/tools_tpm2-tpm2_policyauthvalue.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policysigned.obj: tools/tpm2_policysigned.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policysigned.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policysigned.Tpo -c -o tools/tpm2-tpm2_policysigned.obj `if test -f 'tools/tpm2_policysigned.c'; then $(CYGPATH_W) 'tools/tpm2_policysigned.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policysigned.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policysigned.Tpo tools/$(DEPDIR)/tpm2-tpm2_policysigned.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policysigned.c' object='tools/tpm2-tpm2_policysigned.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyauthvalue.o `test -f 'tools/tpm2_policyauthvalue.c' || echo '$(srcdir)/'`tools/tpm2_policyauthvalue.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policysigned.obj `if test -f 'tools/tpm2_policysigned.c'; then $(CYGPATH_W) 'tools/tpm2_policysigned.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policysigned.c'; fi`
 
-tools/tools_tpm2-tpm2_policyauthvalue.obj: tools/tpm2_policyauthvalue.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyauthvalue.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthvalue.Tpo -c -o tools/tools_tpm2-tpm2_policyauthvalue.obj `if test -f 'tools/tpm2_policyauthvalue.c'; then $(CYGPATH_W) 'tools/tpm2_policyauthvalue.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyauthvalue.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthvalue.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyauthvalue.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyauthvalue.c' object='tools/tools_tpm2-tpm2_policyauthvalue.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyticket.o: tools/tpm2_policyticket.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyticket.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyticket.Tpo -c -o tools/tpm2-tpm2_policyticket.o `test -f 'tools/tpm2_policyticket.c' || echo '$(srcdir)/'`tools/tpm2_policyticket.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyticket.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyticket.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyticket.c' object='tools/tpm2-tpm2_policyticket.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyauthvalue.obj `if test -f 'tools/tpm2_policyauthvalue.c'; then $(CYGPATH_W) 'tools/tpm2_policyauthvalue.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyauthvalue.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyticket.o `test -f 'tools/tpm2_policyticket.c' || echo '$(srcdir)/'`tools/tpm2_policyticket.c
 
-tools/tools_tpm2-tpm2_policysecret.o: tools/tpm2_policysecret.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policysecret.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policysecret.Tpo -c -o tools/tools_tpm2-tpm2_policysecret.o `test -f 'tools/tpm2_policysecret.c' || echo '$(srcdir)/'`tools/tpm2_policysecret.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policysecret.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policysecret.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policysecret.c' object='tools/tools_tpm2-tpm2_policysecret.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyticket.obj: tools/tpm2_policyticket.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyticket.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyticket.Tpo -c -o tools/tpm2-tpm2_policyticket.obj `if test -f 'tools/tpm2_policyticket.c'; then $(CYGPATH_W) 'tools/tpm2_policyticket.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyticket.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyticket.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyticket.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyticket.c' object='tools/tpm2-tpm2_policyticket.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policysecret.o `test -f 'tools/tpm2_policysecret.c' || echo '$(srcdir)/'`tools/tpm2_policysecret.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyticket.obj `if test -f 'tools/tpm2_policyticket.c'; then $(CYGPATH_W) 'tools/tpm2_policyticket.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyticket.c'; fi`
 
-tools/tools_tpm2-tpm2_policysecret.obj: tools/tpm2_policysecret.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policysecret.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policysecret.Tpo -c -o tools/tools_tpm2-tpm2_policysecret.obj `if test -f 'tools/tpm2_policysecret.c'; then $(CYGPATH_W) 'tools/tpm2_policysecret.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policysecret.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policysecret.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policysecret.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policysecret.c' object='tools/tools_tpm2-tpm2_policysecret.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyauthvalue.o: tools/tpm2_policyauthvalue.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyauthvalue.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyauthvalue.Tpo -c -o tools/tpm2-tpm2_policyauthvalue.o `test -f 'tools/tpm2_policyauthvalue.c' || echo '$(srcdir)/'`tools/tpm2_policyauthvalue.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyauthvalue.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyauthvalue.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyauthvalue.c' object='tools/tpm2-tpm2_policyauthvalue.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policysecret.obj `if test -f 'tools/tpm2_policysecret.c'; then $(CYGPATH_W) 'tools/tpm2_policysecret.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policysecret.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyauthvalue.o `test -f 'tools/tpm2_policyauthvalue.c' || echo '$(srcdir)/'`tools/tpm2_policyauthvalue.c
 
-tools/tools_tpm2-tpm2_policyrestart.o: tools/tpm2_policyrestart.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyrestart.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyrestart.Tpo -c -o tools/tools_tpm2-tpm2_policyrestart.o `test -f 'tools/tpm2_policyrestart.c' || echo '$(srcdir)/'`tools/tpm2_policyrestart.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyrestart.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyrestart.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyrestart.c' object='tools/tools_tpm2-tpm2_policyrestart.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyauthvalue.obj: tools/tpm2_policyauthvalue.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyauthvalue.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyauthvalue.Tpo -c -o tools/tpm2-tpm2_policyauthvalue.obj `if test -f 'tools/tpm2_policyauthvalue.c'; then $(CYGPATH_W) 'tools/tpm2_policyauthvalue.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyauthvalue.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyauthvalue.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyauthvalue.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyauthvalue.c' object='tools/tpm2-tpm2_policyauthvalue.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyrestart.o `test -f 'tools/tpm2_policyrestart.c' || echo '$(srcdir)/'`tools/tpm2_policyrestart.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyauthvalue.obj `if test -f 'tools/tpm2_policyauthvalue.c'; then $(CYGPATH_W) 'tools/tpm2_policyauthvalue.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyauthvalue.c'; fi`
 
-tools/tools_tpm2-tpm2_policyrestart.obj: tools/tpm2_policyrestart.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyrestart.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyrestart.Tpo -c -o tools/tools_tpm2-tpm2_policyrestart.obj `if test -f 'tools/tpm2_policyrestart.c'; then $(CYGPATH_W) 'tools/tpm2_policyrestart.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyrestart.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyrestart.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyrestart.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyrestart.c' object='tools/tools_tpm2-tpm2_policyrestart.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policysecret.o: tools/tpm2_policysecret.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policysecret.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policysecret.Tpo -c -o tools/tpm2-tpm2_policysecret.o `test -f 'tools/tpm2_policysecret.c' || echo '$(srcdir)/'`tools/tpm2_policysecret.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policysecret.Tpo tools/$(DEPDIR)/tpm2-tpm2_policysecret.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policysecret.c' object='tools/tpm2-tpm2_policysecret.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyrestart.obj `if test -f 'tools/tpm2_policyrestart.c'; then $(CYGPATH_W) 'tools/tpm2_policyrestart.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyrestart.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policysecret.o `test -f 'tools/tpm2_policysecret.c' || echo '$(srcdir)/'`tools/tpm2_policysecret.c
 
-tools/tools_tpm2-tpm2_policycommandcode.o: tools/tpm2_policycommandcode.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policycommandcode.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policycommandcode.Tpo -c -o tools/tools_tpm2-tpm2_policycommandcode.o `test -f 'tools/tpm2_policycommandcode.c' || echo '$(srcdir)/'`tools/tpm2_policycommandcode.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policycommandcode.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policycommandcode.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policycommandcode.c' object='tools/tools_tpm2-tpm2_policycommandcode.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policysecret.obj: tools/tpm2_policysecret.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policysecret.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policysecret.Tpo -c -o tools/tpm2-tpm2_policysecret.obj `if test -f 'tools/tpm2_policysecret.c'; then $(CYGPATH_W) 'tools/tpm2_policysecret.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policysecret.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policysecret.Tpo tools/$(DEPDIR)/tpm2-tpm2_policysecret.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policysecret.c' object='tools/tpm2-tpm2_policysecret.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policycommandcode.o `test -f 'tools/tpm2_policycommandcode.c' || echo '$(srcdir)/'`tools/tpm2_policycommandcode.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policysecret.obj `if test -f 'tools/tpm2_policysecret.c'; then $(CYGPATH_W) 'tools/tpm2_policysecret.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policysecret.c'; fi`
 
-tools/tools_tpm2-tpm2_policycommandcode.obj: tools/tpm2_policycommandcode.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policycommandcode.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policycommandcode.Tpo -c -o tools/tools_tpm2-tpm2_policycommandcode.obj `if test -f 'tools/tpm2_policycommandcode.c'; then $(CYGPATH_W) 'tools/tpm2_policycommandcode.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policycommandcode.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policycommandcode.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policycommandcode.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policycommandcode.c' object='tools/tools_tpm2-tpm2_policycommandcode.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyrestart.o: tools/tpm2_policyrestart.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyrestart.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyrestart.Tpo -c -o tools/tpm2-tpm2_policyrestart.o `test -f 'tools/tpm2_policyrestart.c' || echo '$(srcdir)/'`tools/tpm2_policyrestart.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyrestart.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyrestart.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyrestart.c' object='tools/tpm2-tpm2_policyrestart.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policycommandcode.obj `if test -f 'tools/tpm2_policycommandcode.c'; then $(CYGPATH_W) 'tools/tpm2_policycommandcode.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policycommandcode.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyrestart.o `test -f 'tools/tpm2_policyrestart.c' || echo '$(srcdir)/'`tools/tpm2_policyrestart.c
 
-tools/tools_tpm2-tpm2_policynvwritten.o: tools/tpm2_policynvwritten.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policynvwritten.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policynvwritten.Tpo -c -o tools/tools_tpm2-tpm2_policynvwritten.o `test -f 'tools/tpm2_policynvwritten.c' || echo '$(srcdir)/'`tools/tpm2_policynvwritten.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policynvwritten.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policynvwritten.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policynvwritten.c' object='tools/tools_tpm2-tpm2_policynvwritten.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyrestart.obj: tools/tpm2_policyrestart.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyrestart.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyrestart.Tpo -c -o tools/tpm2-tpm2_policyrestart.obj `if test -f 'tools/tpm2_policyrestart.c'; then $(CYGPATH_W) 'tools/tpm2_policyrestart.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyrestart.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyrestart.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyrestart.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyrestart.c' object='tools/tpm2-tpm2_policyrestart.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policynvwritten.o `test -f 'tools/tpm2_policynvwritten.c' || echo '$(srcdir)/'`tools/tpm2_policynvwritten.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyrestart.obj `if test -f 'tools/tpm2_policyrestart.c'; then $(CYGPATH_W) 'tools/tpm2_policyrestart.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyrestart.c'; fi`
 
-tools/tools_tpm2-tpm2_policynvwritten.obj: tools/tpm2_policynvwritten.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policynvwritten.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policynvwritten.Tpo -c -o tools/tools_tpm2-tpm2_policynvwritten.obj `if test -f 'tools/tpm2_policynvwritten.c'; then $(CYGPATH_W) 'tools/tpm2_policynvwritten.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policynvwritten.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policynvwritten.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policynvwritten.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policynvwritten.c' object='tools/tools_tpm2-tpm2_policynvwritten.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policycommandcode.o: tools/tpm2_policycommandcode.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policycommandcode.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policycommandcode.Tpo -c -o tools/tpm2-tpm2_policycommandcode.o `test -f 'tools/tpm2_policycommandcode.c' || echo '$(srcdir)/'`tools/tpm2_policycommandcode.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policycommandcode.Tpo tools/$(DEPDIR)/tpm2-tpm2_policycommandcode.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policycommandcode.c' object='tools/tpm2-tpm2_policycommandcode.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policynvwritten.obj `if test -f 'tools/tpm2_policynvwritten.c'; then $(CYGPATH_W) 'tools/tpm2_policynvwritten.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policynvwritten.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policycommandcode.o `test -f 'tools/tpm2_policycommandcode.c' || echo '$(srcdir)/'`tools/tpm2_policycommandcode.c
 
-tools/tools_tpm2-tpm2_policyduplicationselect.o: tools/tpm2_policyduplicationselect.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyduplicationselect.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyduplicationselect.Tpo -c -o tools/tools_tpm2-tpm2_policyduplicationselect.o `test -f 'tools/tpm2_policyduplicationselect.c' || echo '$(srcdir)/'`tools/tpm2_policyduplicationselect.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyduplicationselect.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyduplicationselect.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyduplicationselect.c' object='tools/tools_tpm2-tpm2_policyduplicationselect.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policycommandcode.obj: tools/tpm2_policycommandcode.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policycommandcode.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policycommandcode.Tpo -c -o tools/tpm2-tpm2_policycommandcode.obj `if test -f 'tools/tpm2_policycommandcode.c'; then $(CYGPATH_W) 'tools/tpm2_policycommandcode.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policycommandcode.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policycommandcode.Tpo tools/$(DEPDIR)/tpm2-tpm2_policycommandcode.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policycommandcode.c' object='tools/tpm2-tpm2_policycommandcode.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyduplicationselect.o `test -f 'tools/tpm2_policyduplicationselect.c' || echo '$(srcdir)/'`tools/tpm2_policyduplicationselect.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policycommandcode.obj `if test -f 'tools/tpm2_policycommandcode.c'; then $(CYGPATH_W) 'tools/tpm2_policycommandcode.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policycommandcode.c'; fi`
 
-tools/tools_tpm2-tpm2_policyduplicationselect.obj: tools/tpm2_policyduplicationselect.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policyduplicationselect.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policyduplicationselect.Tpo -c -o tools/tools_tpm2-tpm2_policyduplicationselect.obj `if test -f 'tools/tpm2_policyduplicationselect.c'; then $(CYGPATH_W) 'tools/tpm2_policyduplicationselect.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyduplicationselect.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policyduplicationselect.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policyduplicationselect.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyduplicationselect.c' object='tools/tools_tpm2-tpm2_policyduplicationselect.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policynvwritten.o: tools/tpm2_policynvwritten.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policynvwritten.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policynvwritten.Tpo -c -o tools/tpm2-tpm2_policynvwritten.o `test -f 'tools/tpm2_policynvwritten.c' || echo '$(srcdir)/'`tools/tpm2_policynvwritten.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policynvwritten.Tpo tools/$(DEPDIR)/tpm2-tpm2_policynvwritten.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policynvwritten.c' object='tools/tpm2-tpm2_policynvwritten.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policyduplicationselect.obj `if test -f 'tools/tpm2_policyduplicationselect.c'; then $(CYGPATH_W) 'tools/tpm2_policyduplicationselect.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyduplicationselect.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policynvwritten.o `test -f 'tools/tpm2_policynvwritten.c' || echo '$(srcdir)/'`tools/tpm2_policynvwritten.c
 
-tools/tools_tpm2-tpm2_policylocality.o: tools/tpm2_policylocality.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policylocality.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policylocality.Tpo -c -o tools/tools_tpm2-tpm2_policylocality.o `test -f 'tools/tpm2_policylocality.c' || echo '$(srcdir)/'`tools/tpm2_policylocality.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policylocality.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policylocality.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policylocality.c' object='tools/tools_tpm2-tpm2_policylocality.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policynvwritten.obj: tools/tpm2_policynvwritten.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policynvwritten.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policynvwritten.Tpo -c -o tools/tpm2-tpm2_policynvwritten.obj `if test -f 'tools/tpm2_policynvwritten.c'; then $(CYGPATH_W) 'tools/tpm2_policynvwritten.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policynvwritten.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policynvwritten.Tpo tools/$(DEPDIR)/tpm2-tpm2_policynvwritten.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policynvwritten.c' object='tools/tpm2-tpm2_policynvwritten.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policylocality.o `test -f 'tools/tpm2_policylocality.c' || echo '$(srcdir)/'`tools/tpm2_policylocality.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policynvwritten.obj `if test -f 'tools/tpm2_policynvwritten.c'; then $(CYGPATH_W) 'tools/tpm2_policynvwritten.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policynvwritten.c'; fi`
 
-tools/tools_tpm2-tpm2_policylocality.obj: tools/tpm2_policylocality.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_policylocality.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_policylocality.Tpo -c -o tools/tools_tpm2-tpm2_policylocality.obj `if test -f 'tools/tpm2_policylocality.c'; then $(CYGPATH_W) 'tools/tpm2_policylocality.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policylocality.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_policylocality.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_policylocality.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policylocality.c' object='tools/tools_tpm2-tpm2_policylocality.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyduplicationselect.o: tools/tpm2_policyduplicationselect.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyduplicationselect.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyduplicationselect.Tpo -c -o tools/tpm2-tpm2_policyduplicationselect.o `test -f 'tools/tpm2_policyduplicationselect.c' || echo '$(srcdir)/'`tools/tpm2_policyduplicationselect.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyduplicationselect.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyduplicationselect.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyduplicationselect.c' object='tools/tpm2-tpm2_policyduplicationselect.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_policylocality.obj `if test -f 'tools/tpm2_policylocality.c'; then $(CYGPATH_W) 'tools/tpm2_policylocality.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policylocality.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyduplicationselect.o `test -f 'tools/tpm2_policyduplicationselect.c' || echo '$(srcdir)/'`tools/tpm2_policyduplicationselect.c
 
-tools/tools_tpm2-tpm2_quote.o: tools/tpm2_quote.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_quote.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_quote.Tpo -c -o tools/tools_tpm2-tpm2_quote.o `test -f 'tools/tpm2_quote.c' || echo '$(srcdir)/'`tools/tpm2_quote.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_quote.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_quote.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_quote.c' object='tools/tools_tpm2-tpm2_quote.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policyduplicationselect.obj: tools/tpm2_policyduplicationselect.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policyduplicationselect.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policyduplicationselect.Tpo -c -o tools/tpm2-tpm2_policyduplicationselect.obj `if test -f 'tools/tpm2_policyduplicationselect.c'; then $(CYGPATH_W) 'tools/tpm2_policyduplicationselect.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyduplicationselect.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policyduplicationselect.Tpo tools/$(DEPDIR)/tpm2-tpm2_policyduplicationselect.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policyduplicationselect.c' object='tools/tpm2-tpm2_policyduplicationselect.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_quote.o `test -f 'tools/tpm2_quote.c' || echo '$(srcdir)/'`tools/tpm2_quote.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policyduplicationselect.obj `if test -f 'tools/tpm2_policyduplicationselect.c'; then $(CYGPATH_W) 'tools/tpm2_policyduplicationselect.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policyduplicationselect.c'; fi`
 
-tools/tools_tpm2-tpm2_quote.obj: tools/tpm2_quote.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_quote.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_quote.Tpo -c -o tools/tools_tpm2-tpm2_quote.obj `if test -f 'tools/tpm2_quote.c'; then $(CYGPATH_W) 'tools/tpm2_quote.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_quote.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_quote.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_quote.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_quote.c' object='tools/tools_tpm2-tpm2_quote.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policylocality.o: tools/tpm2_policylocality.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policylocality.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policylocality.Tpo -c -o tools/tpm2-tpm2_policylocality.o `test -f 'tools/tpm2_policylocality.c' || echo '$(srcdir)/'`tools/tpm2_policylocality.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policylocality.Tpo tools/$(DEPDIR)/tpm2-tpm2_policylocality.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policylocality.c' object='tools/tpm2-tpm2_policylocality.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_quote.obj `if test -f 'tools/tpm2_quote.c'; then $(CYGPATH_W) 'tools/tpm2_quote.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_quote.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policylocality.o `test -f 'tools/tpm2_policylocality.c' || echo '$(srcdir)/'`tools/tpm2_policylocality.c
 
-tools/tools_tpm2-tpm2_readclock.o: tools/tpm2_readclock.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_readclock.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_readclock.Tpo -c -o tools/tools_tpm2-tpm2_readclock.o `test -f 'tools/tpm2_readclock.c' || echo '$(srcdir)/'`tools/tpm2_readclock.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_readclock.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_readclock.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_readclock.c' object='tools/tools_tpm2-tpm2_readclock.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_policylocality.obj: tools/tpm2_policylocality.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_policylocality.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_policylocality.Tpo -c -o tools/tpm2-tpm2_policylocality.obj `if test -f 'tools/tpm2_policylocality.c'; then $(CYGPATH_W) 'tools/tpm2_policylocality.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policylocality.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_policylocality.Tpo tools/$(DEPDIR)/tpm2-tpm2_policylocality.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_policylocality.c' object='tools/tpm2-tpm2_policylocality.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_readclock.o `test -f 'tools/tpm2_readclock.c' || echo '$(srcdir)/'`tools/tpm2_readclock.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_policylocality.obj `if test -f 'tools/tpm2_policylocality.c'; then $(CYGPATH_W) 'tools/tpm2_policylocality.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_policylocality.c'; fi`
 
-tools/tools_tpm2-tpm2_readclock.obj: tools/tpm2_readclock.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_readclock.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_readclock.Tpo -c -o tools/tools_tpm2-tpm2_readclock.obj `if test -f 'tools/tpm2_readclock.c'; then $(CYGPATH_W) 'tools/tpm2_readclock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_readclock.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_readclock.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_readclock.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_readclock.c' object='tools/tools_tpm2-tpm2_readclock.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_quote.o: tools/tpm2_quote.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_quote.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_quote.Tpo -c -o tools/tpm2-tpm2_quote.o `test -f 'tools/tpm2_quote.c' || echo '$(srcdir)/'`tools/tpm2_quote.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_quote.Tpo tools/$(DEPDIR)/tpm2-tpm2_quote.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_quote.c' object='tools/tpm2-tpm2_quote.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_readclock.obj `if test -f 'tools/tpm2_readclock.c'; then $(CYGPATH_W) 'tools/tpm2_readclock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_readclock.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_quote.o `test -f 'tools/tpm2_quote.c' || echo '$(srcdir)/'`tools/tpm2_quote.c
 
-tools/tools_tpm2-tpm2_readpublic.o: tools/tpm2_readpublic.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_readpublic.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_readpublic.Tpo -c -o tools/tools_tpm2-tpm2_readpublic.o `test -f 'tools/tpm2_readpublic.c' || echo '$(srcdir)/'`tools/tpm2_readpublic.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_readpublic.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_readpublic.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_readpublic.c' object='tools/tools_tpm2-tpm2_readpublic.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_quote.obj: tools/tpm2_quote.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_quote.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_quote.Tpo -c -o tools/tpm2-tpm2_quote.obj `if test -f 'tools/tpm2_quote.c'; then $(CYGPATH_W) 'tools/tpm2_quote.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_quote.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_quote.Tpo tools/$(DEPDIR)/tpm2-tpm2_quote.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_quote.c' object='tools/tpm2-tpm2_quote.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_readpublic.o `test -f 'tools/tpm2_readpublic.c' || echo '$(srcdir)/'`tools/tpm2_readpublic.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_quote.obj `if test -f 'tools/tpm2_quote.c'; then $(CYGPATH_W) 'tools/tpm2_quote.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_quote.c'; fi`
 
-tools/tools_tpm2-tpm2_readpublic.obj: tools/tpm2_readpublic.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_readpublic.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_readpublic.Tpo -c -o tools/tools_tpm2-tpm2_readpublic.obj `if test -f 'tools/tpm2_readpublic.c'; then $(CYGPATH_W) 'tools/tpm2_readpublic.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_readpublic.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_readpublic.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_readpublic.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_readpublic.c' object='tools/tools_tpm2-tpm2_readpublic.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_readclock.o: tools/tpm2_readclock.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_readclock.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_readclock.Tpo -c -o tools/tpm2-tpm2_readclock.o `test -f 'tools/tpm2_readclock.c' || echo '$(srcdir)/'`tools/tpm2_readclock.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_readclock.Tpo tools/$(DEPDIR)/tpm2-tpm2_readclock.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_readclock.c' object='tools/tpm2-tpm2_readclock.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_readpublic.obj `if test -f 'tools/tpm2_readpublic.c'; then $(CYGPATH_W) 'tools/tpm2_readpublic.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_readpublic.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_readclock.o `test -f 'tools/tpm2_readclock.c' || echo '$(srcdir)/'`tools/tpm2_readclock.c
 
-tools/tools_tpm2-tpm2_rsadecrypt.o: tools/tpm2_rsadecrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_rsadecrypt.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_rsadecrypt.Tpo -c -o tools/tools_tpm2-tpm2_rsadecrypt.o `test -f 'tools/tpm2_rsadecrypt.c' || echo '$(srcdir)/'`tools/tpm2_rsadecrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_rsadecrypt.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_rsadecrypt.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_rsadecrypt.c' object='tools/tools_tpm2-tpm2_rsadecrypt.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_readclock.obj: tools/tpm2_readclock.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_readclock.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_readclock.Tpo -c -o tools/tpm2-tpm2_readclock.obj `if test -f 'tools/tpm2_readclock.c'; then $(CYGPATH_W) 'tools/tpm2_readclock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_readclock.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_readclock.Tpo tools/$(DEPDIR)/tpm2-tpm2_readclock.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_readclock.c' object='tools/tpm2-tpm2_readclock.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_rsadecrypt.o `test -f 'tools/tpm2_rsadecrypt.c' || echo '$(srcdir)/'`tools/tpm2_rsadecrypt.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_readclock.obj `if test -f 'tools/tpm2_readclock.c'; then $(CYGPATH_W) 'tools/tpm2_readclock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_readclock.c'; fi`
 
-tools/tools_tpm2-tpm2_rsadecrypt.obj: tools/tpm2_rsadecrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_rsadecrypt.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_rsadecrypt.Tpo -c -o tools/tools_tpm2-tpm2_rsadecrypt.obj `if test -f 'tools/tpm2_rsadecrypt.c'; then $(CYGPATH_W) 'tools/tpm2_rsadecrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_rsadecrypt.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_rsadecrypt.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_rsadecrypt.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_rsadecrypt.c' object='tools/tools_tpm2-tpm2_rsadecrypt.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_readpublic.o: tools/tpm2_readpublic.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_readpublic.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_readpublic.Tpo -c -o tools/tpm2-tpm2_readpublic.o `test -f 'tools/tpm2_readpublic.c' || echo '$(srcdir)/'`tools/tpm2_readpublic.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_readpublic.Tpo tools/$(DEPDIR)/tpm2-tpm2_readpublic.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_readpublic.c' object='tools/tpm2-tpm2_readpublic.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_rsadecrypt.obj `if test -f 'tools/tpm2_rsadecrypt.c'; then $(CYGPATH_W) 'tools/tpm2_rsadecrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_rsadecrypt.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_readpublic.o `test -f 'tools/tpm2_readpublic.c' || echo '$(srcdir)/'`tools/tpm2_readpublic.c
 
-tools/tools_tpm2-tpm2_rsaencrypt.o: tools/tpm2_rsaencrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_rsaencrypt.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_rsaencrypt.Tpo -c -o tools/tools_tpm2-tpm2_rsaencrypt.o `test -f 'tools/tpm2_rsaencrypt.c' || echo '$(srcdir)/'`tools/tpm2_rsaencrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_rsaencrypt.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_rsaencrypt.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_rsaencrypt.c' object='tools/tools_tpm2-tpm2_rsaencrypt.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_readpublic.obj: tools/tpm2_readpublic.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_readpublic.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_readpublic.Tpo -c -o tools/tpm2-tpm2_readpublic.obj `if test -f 'tools/tpm2_readpublic.c'; then $(CYGPATH_W) 'tools/tpm2_readpublic.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_readpublic.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_readpublic.Tpo tools/$(DEPDIR)/tpm2-tpm2_readpublic.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_readpublic.c' object='tools/tpm2-tpm2_readpublic.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_rsaencrypt.o `test -f 'tools/tpm2_rsaencrypt.c' || echo '$(srcdir)/'`tools/tpm2_rsaencrypt.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_readpublic.obj `if test -f 'tools/tpm2_readpublic.c'; then $(CYGPATH_W) 'tools/tpm2_readpublic.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_readpublic.c'; fi`
 
-tools/tools_tpm2-tpm2_rsaencrypt.obj: tools/tpm2_rsaencrypt.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_rsaencrypt.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_rsaencrypt.Tpo -c -o tools/tools_tpm2-tpm2_rsaencrypt.obj `if test -f 'tools/tpm2_rsaencrypt.c'; then $(CYGPATH_W) 'tools/tpm2_rsaencrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_rsaencrypt.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_rsaencrypt.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_rsaencrypt.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_rsaencrypt.c' object='tools/tools_tpm2-tpm2_rsaencrypt.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_rsadecrypt.o: tools/tpm2_rsadecrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_rsadecrypt.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_rsadecrypt.Tpo -c -o tools/tpm2-tpm2_rsadecrypt.o `test -f 'tools/tpm2_rsadecrypt.c' || echo '$(srcdir)/'`tools/tpm2_rsadecrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_rsadecrypt.Tpo tools/$(DEPDIR)/tpm2-tpm2_rsadecrypt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_rsadecrypt.c' object='tools/tpm2-tpm2_rsadecrypt.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_rsaencrypt.obj `if test -f 'tools/tpm2_rsaencrypt.c'; then $(CYGPATH_W) 'tools/tpm2_rsaencrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_rsaencrypt.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_rsadecrypt.o `test -f 'tools/tpm2_rsadecrypt.c' || echo '$(srcdir)/'`tools/tpm2_rsadecrypt.c
 
-tools/tools_tpm2-tpm2_send.o: tools/tpm2_send.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_send.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_send.Tpo -c -o tools/tools_tpm2-tpm2_send.o `test -f 'tools/tpm2_send.c' || echo '$(srcdir)/'`tools/tpm2_send.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_send.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_send.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_send.c' object='tools/tools_tpm2-tpm2_send.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_rsadecrypt.obj: tools/tpm2_rsadecrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_rsadecrypt.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_rsadecrypt.Tpo -c -o tools/tpm2-tpm2_rsadecrypt.obj `if test -f 'tools/tpm2_rsadecrypt.c'; then $(CYGPATH_W) 'tools/tpm2_rsadecrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_rsadecrypt.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_rsadecrypt.Tpo tools/$(DEPDIR)/tpm2-tpm2_rsadecrypt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_rsadecrypt.c' object='tools/tpm2-tpm2_rsadecrypt.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_send.o `test -f 'tools/tpm2_send.c' || echo '$(srcdir)/'`tools/tpm2_send.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_rsadecrypt.obj `if test -f 'tools/tpm2_rsadecrypt.c'; then $(CYGPATH_W) 'tools/tpm2_rsadecrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_rsadecrypt.c'; fi`
 
-tools/tools_tpm2-tpm2_send.obj: tools/tpm2_send.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_send.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_send.Tpo -c -o tools/tools_tpm2-tpm2_send.obj `if test -f 'tools/tpm2_send.c'; then $(CYGPATH_W) 'tools/tpm2_send.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_send.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_send.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_send.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_send.c' object='tools/tools_tpm2-tpm2_send.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_rsaencrypt.o: tools/tpm2_rsaencrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_rsaencrypt.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_rsaencrypt.Tpo -c -o tools/tpm2-tpm2_rsaencrypt.o `test -f 'tools/tpm2_rsaencrypt.c' || echo '$(srcdir)/'`tools/tpm2_rsaencrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_rsaencrypt.Tpo tools/$(DEPDIR)/tpm2-tpm2_rsaencrypt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_rsaencrypt.c' object='tools/tpm2-tpm2_rsaencrypt.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_send.obj `if test -f 'tools/tpm2_send.c'; then $(CYGPATH_W) 'tools/tpm2_send.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_send.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_rsaencrypt.o `test -f 'tools/tpm2_rsaencrypt.c' || echo '$(srcdir)/'`tools/tpm2_rsaencrypt.c
 
-tools/tools_tpm2-tpm2_selftest.o: tools/tpm2_selftest.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_selftest.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_selftest.Tpo -c -o tools/tools_tpm2-tpm2_selftest.o `test -f 'tools/tpm2_selftest.c' || echo '$(srcdir)/'`tools/tpm2_selftest.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_selftest.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_selftest.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_selftest.c' object='tools/tools_tpm2-tpm2_selftest.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_rsaencrypt.obj: tools/tpm2_rsaencrypt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_rsaencrypt.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_rsaencrypt.Tpo -c -o tools/tpm2-tpm2_rsaencrypt.obj `if test -f 'tools/tpm2_rsaencrypt.c'; then $(CYGPATH_W) 'tools/tpm2_rsaencrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_rsaencrypt.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_rsaencrypt.Tpo tools/$(DEPDIR)/tpm2-tpm2_rsaencrypt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_rsaencrypt.c' object='tools/tpm2-tpm2_rsaencrypt.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_selftest.o `test -f 'tools/tpm2_selftest.c' || echo '$(srcdir)/'`tools/tpm2_selftest.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_rsaencrypt.obj `if test -f 'tools/tpm2_rsaencrypt.c'; then $(CYGPATH_W) 'tools/tpm2_rsaencrypt.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_rsaencrypt.c'; fi`
 
-tools/tools_tpm2-tpm2_selftest.obj: tools/tpm2_selftest.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_selftest.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_selftest.Tpo -c -o tools/tools_tpm2-tpm2_selftest.obj `if test -f 'tools/tpm2_selftest.c'; then $(CYGPATH_W) 'tools/tpm2_selftest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_selftest.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_selftest.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_selftest.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_selftest.c' object='tools/tools_tpm2-tpm2_selftest.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_send.o: tools/tpm2_send.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_send.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_send.Tpo -c -o tools/tpm2-tpm2_send.o `test -f 'tools/tpm2_send.c' || echo '$(srcdir)/'`tools/tpm2_send.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_send.Tpo tools/$(DEPDIR)/tpm2-tpm2_send.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_send.c' object='tools/tpm2-tpm2_send.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_selftest.obj `if test -f 'tools/tpm2_selftest.c'; then $(CYGPATH_W) 'tools/tpm2_selftest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_selftest.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_send.o `test -f 'tools/tpm2_send.c' || echo '$(srcdir)/'`tools/tpm2_send.c
 
-tools/tools_tpm2-tpm2_setclock.o: tools/tpm2_setclock.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_setclock.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_setclock.Tpo -c -o tools/tools_tpm2-tpm2_setclock.o `test -f 'tools/tpm2_setclock.c' || echo '$(srcdir)/'`tools/tpm2_setclock.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_setclock.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_setclock.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_setclock.c' object='tools/tools_tpm2-tpm2_setclock.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_send.obj: tools/tpm2_send.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_send.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_send.Tpo -c -o tools/tpm2-tpm2_send.obj `if test -f 'tools/tpm2_send.c'; then $(CYGPATH_W) 'tools/tpm2_send.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_send.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_send.Tpo tools/$(DEPDIR)/tpm2-tpm2_send.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_send.c' object='tools/tpm2-tpm2_send.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_setclock.o `test -f 'tools/tpm2_setclock.c' || echo '$(srcdir)/'`tools/tpm2_setclock.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_send.obj `if test -f 'tools/tpm2_send.c'; then $(CYGPATH_W) 'tools/tpm2_send.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_send.c'; fi`
 
-tools/tools_tpm2-tpm2_setclock.obj: tools/tpm2_setclock.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_setclock.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_setclock.Tpo -c -o tools/tools_tpm2-tpm2_setclock.obj `if test -f 'tools/tpm2_setclock.c'; then $(CYGPATH_W) 'tools/tpm2_setclock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_setclock.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_setclock.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_setclock.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_setclock.c' object='tools/tools_tpm2-tpm2_setclock.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_selftest.o: tools/tpm2_selftest.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_selftest.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_selftest.Tpo -c -o tools/tpm2-tpm2_selftest.o `test -f 'tools/tpm2_selftest.c' || echo '$(srcdir)/'`tools/tpm2_selftest.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_selftest.Tpo tools/$(DEPDIR)/tpm2-tpm2_selftest.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_selftest.c' object='tools/tpm2-tpm2_selftest.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_setclock.obj `if test -f 'tools/tpm2_setclock.c'; then $(CYGPATH_W) 'tools/tpm2_setclock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_setclock.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_selftest.o `test -f 'tools/tpm2_selftest.c' || echo '$(srcdir)/'`tools/tpm2_selftest.c
 
-tools/tools_tpm2-tpm2_shutdown.o: tools/tpm2_shutdown.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_shutdown.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_shutdown.Tpo -c -o tools/tools_tpm2-tpm2_shutdown.o `test -f 'tools/tpm2_shutdown.c' || echo '$(srcdir)/'`tools/tpm2_shutdown.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_shutdown.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_shutdown.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_shutdown.c' object='tools/tools_tpm2-tpm2_shutdown.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_selftest.obj: tools/tpm2_selftest.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_selftest.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_selftest.Tpo -c -o tools/tpm2-tpm2_selftest.obj `if test -f 'tools/tpm2_selftest.c'; then $(CYGPATH_W) 'tools/tpm2_selftest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_selftest.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_selftest.Tpo tools/$(DEPDIR)/tpm2-tpm2_selftest.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_selftest.c' object='tools/tpm2-tpm2_selftest.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_shutdown.o `test -f 'tools/tpm2_shutdown.c' || echo '$(srcdir)/'`tools/tpm2_shutdown.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_selftest.obj `if test -f 'tools/tpm2_selftest.c'; then $(CYGPATH_W) 'tools/tpm2_selftest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_selftest.c'; fi`
 
-tools/tools_tpm2-tpm2_shutdown.obj: tools/tpm2_shutdown.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_shutdown.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_shutdown.Tpo -c -o tools/tools_tpm2-tpm2_shutdown.obj `if test -f 'tools/tpm2_shutdown.c'; then $(CYGPATH_W) 'tools/tpm2_shutdown.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_shutdown.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_shutdown.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_shutdown.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_shutdown.c' object='tools/tools_tpm2-tpm2_shutdown.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_setclock.o: tools/tpm2_setclock.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_setclock.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_setclock.Tpo -c -o tools/tpm2-tpm2_setclock.o `test -f 'tools/tpm2_setclock.c' || echo '$(srcdir)/'`tools/tpm2_setclock.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_setclock.Tpo tools/$(DEPDIR)/tpm2-tpm2_setclock.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_setclock.c' object='tools/tpm2-tpm2_setclock.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_shutdown.obj `if test -f 'tools/tpm2_shutdown.c'; then $(CYGPATH_W) 'tools/tpm2_shutdown.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_shutdown.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_setclock.o `test -f 'tools/tpm2_setclock.c' || echo '$(srcdir)/'`tools/tpm2_setclock.c
 
-tools/tools_tpm2-tpm2_sign.o: tools/tpm2_sign.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_sign.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_sign.Tpo -c -o tools/tools_tpm2-tpm2_sign.o `test -f 'tools/tpm2_sign.c' || echo '$(srcdir)/'`tools/tpm2_sign.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_sign.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_sign.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_sign.c' object='tools/tools_tpm2-tpm2_sign.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_setclock.obj: tools/tpm2_setclock.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_setclock.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_setclock.Tpo -c -o tools/tpm2-tpm2_setclock.obj `if test -f 'tools/tpm2_setclock.c'; then $(CYGPATH_W) 'tools/tpm2_setclock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_setclock.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_setclock.Tpo tools/$(DEPDIR)/tpm2-tpm2_setclock.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_setclock.c' object='tools/tpm2-tpm2_setclock.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_sign.o `test -f 'tools/tpm2_sign.c' || echo '$(srcdir)/'`tools/tpm2_sign.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_setclock.obj `if test -f 'tools/tpm2_setclock.c'; then $(CYGPATH_W) 'tools/tpm2_setclock.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_setclock.c'; fi`
 
-tools/tools_tpm2-tpm2_sign.obj: tools/tpm2_sign.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_sign.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_sign.Tpo -c -o tools/tools_tpm2-tpm2_sign.obj `if test -f 'tools/tpm2_sign.c'; then $(CYGPATH_W) 'tools/tpm2_sign.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_sign.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_sign.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_sign.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_sign.c' object='tools/tools_tpm2-tpm2_sign.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_shutdown.o: tools/tpm2_shutdown.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_shutdown.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_shutdown.Tpo -c -o tools/tpm2-tpm2_shutdown.o `test -f 'tools/tpm2_shutdown.c' || echo '$(srcdir)/'`tools/tpm2_shutdown.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_shutdown.Tpo tools/$(DEPDIR)/tpm2-tpm2_shutdown.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_shutdown.c' object='tools/tpm2-tpm2_shutdown.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_sign.obj `if test -f 'tools/tpm2_sign.c'; then $(CYGPATH_W) 'tools/tpm2_sign.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_sign.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_shutdown.o `test -f 'tools/tpm2_shutdown.c' || echo '$(srcdir)/'`tools/tpm2_shutdown.c
 
-tools/tools_tpm2-tpm2_certifycreation.o: tools/tpm2_certifycreation.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_certifycreation.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_certifycreation.Tpo -c -o tools/tools_tpm2-tpm2_certifycreation.o `test -f 'tools/tpm2_certifycreation.c' || echo '$(srcdir)/'`tools/tpm2_certifycreation.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_certifycreation.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_certifycreation.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_certifycreation.c' object='tools/tools_tpm2-tpm2_certifycreation.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_shutdown.obj: tools/tpm2_shutdown.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_shutdown.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_shutdown.Tpo -c -o tools/tpm2-tpm2_shutdown.obj `if test -f 'tools/tpm2_shutdown.c'; then $(CYGPATH_W) 'tools/tpm2_shutdown.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_shutdown.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_shutdown.Tpo tools/$(DEPDIR)/tpm2-tpm2_shutdown.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_shutdown.c' object='tools/tpm2-tpm2_shutdown.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_certifycreation.o `test -f 'tools/tpm2_certifycreation.c' || echo '$(srcdir)/'`tools/tpm2_certifycreation.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_shutdown.obj `if test -f 'tools/tpm2_shutdown.c'; then $(CYGPATH_W) 'tools/tpm2_shutdown.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_shutdown.c'; fi`
 
-tools/tools_tpm2-tpm2_certifycreation.obj: tools/tpm2_certifycreation.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_certifycreation.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_certifycreation.Tpo -c -o tools/tools_tpm2-tpm2_certifycreation.obj `if test -f 'tools/tpm2_certifycreation.c'; then $(CYGPATH_W) 'tools/tpm2_certifycreation.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_certifycreation.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_certifycreation.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_certifycreation.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_certifycreation.c' object='tools/tools_tpm2-tpm2_certifycreation.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_sign.o: tools/tpm2_sign.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_sign.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_sign.Tpo -c -o tools/tpm2-tpm2_sign.o `test -f 'tools/tpm2_sign.c' || echo '$(srcdir)/'`tools/tpm2_sign.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_sign.Tpo tools/$(DEPDIR)/tpm2-tpm2_sign.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_sign.c' object='tools/tpm2-tpm2_sign.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_certifycreation.obj `if test -f 'tools/tpm2_certifycreation.c'; then $(CYGPATH_W) 'tools/tpm2_certifycreation.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_certifycreation.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_sign.o `test -f 'tools/tpm2_sign.c' || echo '$(srcdir)/'`tools/tpm2_sign.c
 
-tools/tools_tpm2-tpm2_nvcertify.o: tools/tpm2_nvcertify.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvcertify.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvcertify.Tpo -c -o tools/tools_tpm2-tpm2_nvcertify.o `test -f 'tools/tpm2_nvcertify.c' || echo '$(srcdir)/'`tools/tpm2_nvcertify.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvcertify.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvcertify.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvcertify.c' object='tools/tools_tpm2-tpm2_nvcertify.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_sign.obj: tools/tpm2_sign.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_sign.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_sign.Tpo -c -o tools/tpm2-tpm2_sign.obj `if test -f 'tools/tpm2_sign.c'; then $(CYGPATH_W) 'tools/tpm2_sign.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_sign.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_sign.Tpo tools/$(DEPDIR)/tpm2-tpm2_sign.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_sign.c' object='tools/tpm2-tpm2_sign.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvcertify.o `test -f 'tools/tpm2_nvcertify.c' || echo '$(srcdir)/'`tools/tpm2_nvcertify.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_sign.obj `if test -f 'tools/tpm2_sign.c'; then $(CYGPATH_W) 'tools/tpm2_sign.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_sign.c'; fi`
 
-tools/tools_tpm2-tpm2_nvcertify.obj: tools/tpm2_nvcertify.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_nvcertify.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_nvcertify.Tpo -c -o tools/tools_tpm2-tpm2_nvcertify.obj `if test -f 'tools/tpm2_nvcertify.c'; then $(CYGPATH_W) 'tools/tpm2_nvcertify.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvcertify.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_nvcertify.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_nvcertify.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvcertify.c' object='tools/tools_tpm2-tpm2_nvcertify.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_certifycreation.o: tools/tpm2_certifycreation.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_certifycreation.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_certifycreation.Tpo -c -o tools/tpm2-tpm2_certifycreation.o `test -f 'tools/tpm2_certifycreation.c' || echo '$(srcdir)/'`tools/tpm2_certifycreation.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_certifycreation.Tpo tools/$(DEPDIR)/tpm2-tpm2_certifycreation.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_certifycreation.c' object='tools/tpm2-tpm2_certifycreation.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_nvcertify.obj `if test -f 'tools/tpm2_nvcertify.c'; then $(CYGPATH_W) 'tools/tpm2_nvcertify.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvcertify.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_certifycreation.o `test -f 'tools/tpm2_certifycreation.c' || echo '$(srcdir)/'`tools/tpm2_certifycreation.c
 
-tools/tools_tpm2-tpm2_startauthsession.o: tools/tpm2_startauthsession.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_startauthsession.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_startauthsession.Tpo -c -o tools/tools_tpm2-tpm2_startauthsession.o `test -f 'tools/tpm2_startauthsession.c' || echo '$(srcdir)/'`tools/tpm2_startauthsession.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_startauthsession.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_startauthsession.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_startauthsession.c' object='tools/tools_tpm2-tpm2_startauthsession.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_certifycreation.obj: tools/tpm2_certifycreation.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_certifycreation.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_certifycreation.Tpo -c -o tools/tpm2-tpm2_certifycreation.obj `if test -f 'tools/tpm2_certifycreation.c'; then $(CYGPATH_W) 'tools/tpm2_certifycreation.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_certifycreation.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_certifycreation.Tpo tools/$(DEPDIR)/tpm2-tpm2_certifycreation.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_certifycreation.c' object='tools/tpm2-tpm2_certifycreation.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_startauthsession.o `test -f 'tools/tpm2_startauthsession.c' || echo '$(srcdir)/'`tools/tpm2_startauthsession.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_certifycreation.obj `if test -f 'tools/tpm2_certifycreation.c'; then $(CYGPATH_W) 'tools/tpm2_certifycreation.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_certifycreation.c'; fi`
 
-tools/tools_tpm2-tpm2_startauthsession.obj: tools/tpm2_startauthsession.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_startauthsession.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_startauthsession.Tpo -c -o tools/tools_tpm2-tpm2_startauthsession.obj `if test -f 'tools/tpm2_startauthsession.c'; then $(CYGPATH_W) 'tools/tpm2_startauthsession.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_startauthsession.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_startauthsession.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_startauthsession.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_startauthsession.c' object='tools/tools_tpm2-tpm2_startauthsession.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvcertify.o: tools/tpm2_nvcertify.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvcertify.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvcertify.Tpo -c -o tools/tpm2-tpm2_nvcertify.o `test -f 'tools/tpm2_nvcertify.c' || echo '$(srcdir)/'`tools/tpm2_nvcertify.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvcertify.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvcertify.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvcertify.c' object='tools/tpm2-tpm2_nvcertify.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_startauthsession.obj `if test -f 'tools/tpm2_startauthsession.c'; then $(CYGPATH_W) 'tools/tpm2_startauthsession.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_startauthsession.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvcertify.o `test -f 'tools/tpm2_nvcertify.c' || echo '$(srcdir)/'`tools/tpm2_nvcertify.c
 
-tools/tools_tpm2-tpm2_startup.o: tools/tpm2_startup.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_startup.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_startup.Tpo -c -o tools/tools_tpm2-tpm2_startup.o `test -f 'tools/tpm2_startup.c' || echo '$(srcdir)/'`tools/tpm2_startup.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_startup.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_startup.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_startup.c' object='tools/tools_tpm2-tpm2_startup.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_nvcertify.obj: tools/tpm2_nvcertify.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_nvcertify.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_nvcertify.Tpo -c -o tools/tpm2-tpm2_nvcertify.obj `if test -f 'tools/tpm2_nvcertify.c'; then $(CYGPATH_W) 'tools/tpm2_nvcertify.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvcertify.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_nvcertify.Tpo tools/$(DEPDIR)/tpm2-tpm2_nvcertify.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_nvcertify.c' object='tools/tpm2-tpm2_nvcertify.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_startup.o `test -f 'tools/tpm2_startup.c' || echo '$(srcdir)/'`tools/tpm2_startup.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_nvcertify.obj `if test -f 'tools/tpm2_nvcertify.c'; then $(CYGPATH_W) 'tools/tpm2_nvcertify.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_nvcertify.c'; fi`
 
-tools/tools_tpm2-tpm2_startup.obj: tools/tpm2_startup.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_startup.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_startup.Tpo -c -o tools/tools_tpm2-tpm2_startup.obj `if test -f 'tools/tpm2_startup.c'; then $(CYGPATH_W) 'tools/tpm2_startup.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_startup.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_startup.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_startup.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_startup.c' object='tools/tools_tpm2-tpm2_startup.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_startauthsession.o: tools/tpm2_startauthsession.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_startauthsession.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_startauthsession.Tpo -c -o tools/tpm2-tpm2_startauthsession.o `test -f 'tools/tpm2_startauthsession.c' || echo '$(srcdir)/'`tools/tpm2_startauthsession.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_startauthsession.Tpo tools/$(DEPDIR)/tpm2-tpm2_startauthsession.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_startauthsession.c' object='tools/tpm2-tpm2_startauthsession.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_startup.obj `if test -f 'tools/tpm2_startup.c'; then $(CYGPATH_W) 'tools/tpm2_startup.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_startup.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_startauthsession.o `test -f 'tools/tpm2_startauthsession.c' || echo '$(srcdir)/'`tools/tpm2_startauthsession.c
 
-tools/tools_tpm2-tpm2_stirrandom.o: tools/tpm2_stirrandom.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_stirrandom.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_stirrandom.Tpo -c -o tools/tools_tpm2-tpm2_stirrandom.o `test -f 'tools/tpm2_stirrandom.c' || echo '$(srcdir)/'`tools/tpm2_stirrandom.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_stirrandom.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_stirrandom.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_stirrandom.c' object='tools/tools_tpm2-tpm2_stirrandom.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_startauthsession.obj: tools/tpm2_startauthsession.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_startauthsession.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_startauthsession.Tpo -c -o tools/tpm2-tpm2_startauthsession.obj `if test -f 'tools/tpm2_startauthsession.c'; then $(CYGPATH_W) 'tools/tpm2_startauthsession.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_startauthsession.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_startauthsession.Tpo tools/$(DEPDIR)/tpm2-tpm2_startauthsession.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_startauthsession.c' object='tools/tpm2-tpm2_startauthsession.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_stirrandom.o `test -f 'tools/tpm2_stirrandom.c' || echo '$(srcdir)/'`tools/tpm2_stirrandom.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_startauthsession.obj `if test -f 'tools/tpm2_startauthsession.c'; then $(CYGPATH_W) 'tools/tpm2_startauthsession.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_startauthsession.c'; fi`
 
-tools/tools_tpm2-tpm2_stirrandom.obj: tools/tpm2_stirrandom.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_stirrandom.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_stirrandom.Tpo -c -o tools/tools_tpm2-tpm2_stirrandom.obj `if test -f 'tools/tpm2_stirrandom.c'; then $(CYGPATH_W) 'tools/tpm2_stirrandom.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_stirrandom.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_stirrandom.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_stirrandom.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_stirrandom.c' object='tools/tools_tpm2-tpm2_stirrandom.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_startup.o: tools/tpm2_startup.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_startup.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_startup.Tpo -c -o tools/tpm2-tpm2_startup.o `test -f 'tools/tpm2_startup.c' || echo '$(srcdir)/'`tools/tpm2_startup.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_startup.Tpo tools/$(DEPDIR)/tpm2-tpm2_startup.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_startup.c' object='tools/tpm2-tpm2_startup.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_stirrandom.obj `if test -f 'tools/tpm2_stirrandom.c'; then $(CYGPATH_W) 'tools/tpm2_stirrandom.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_stirrandom.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_startup.o `test -f 'tools/tpm2_startup.c' || echo '$(srcdir)/'`tools/tpm2_startup.c
 
-tools/tools_tpm2-tpm2_testparms.o: tools/tpm2_testparms.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_testparms.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_testparms.Tpo -c -o tools/tools_tpm2-tpm2_testparms.o `test -f 'tools/tpm2_testparms.c' || echo '$(srcdir)/'`tools/tpm2_testparms.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_testparms.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_testparms.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_testparms.c' object='tools/tools_tpm2-tpm2_testparms.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_startup.obj: tools/tpm2_startup.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_startup.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_startup.Tpo -c -o tools/tpm2-tpm2_startup.obj `if test -f 'tools/tpm2_startup.c'; then $(CYGPATH_W) 'tools/tpm2_startup.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_startup.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_startup.Tpo tools/$(DEPDIR)/tpm2-tpm2_startup.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_startup.c' object='tools/tpm2-tpm2_startup.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_testparms.o `test -f 'tools/tpm2_testparms.c' || echo '$(srcdir)/'`tools/tpm2_testparms.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_startup.obj `if test -f 'tools/tpm2_startup.c'; then $(CYGPATH_W) 'tools/tpm2_startup.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_startup.c'; fi`
 
-tools/tools_tpm2-tpm2_testparms.obj: tools/tpm2_testparms.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_testparms.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_testparms.Tpo -c -o tools/tools_tpm2-tpm2_testparms.obj `if test -f 'tools/tpm2_testparms.c'; then $(CYGPATH_W) 'tools/tpm2_testparms.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_testparms.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_testparms.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_testparms.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_testparms.c' object='tools/tools_tpm2-tpm2_testparms.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_stirrandom.o: tools/tpm2_stirrandom.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_stirrandom.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_stirrandom.Tpo -c -o tools/tpm2-tpm2_stirrandom.o `test -f 'tools/tpm2_stirrandom.c' || echo '$(srcdir)/'`tools/tpm2_stirrandom.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_stirrandom.Tpo tools/$(DEPDIR)/tpm2-tpm2_stirrandom.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_stirrandom.c' object='tools/tpm2-tpm2_stirrandom.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_testparms.obj `if test -f 'tools/tpm2_testparms.c'; then $(CYGPATH_W) 'tools/tpm2_testparms.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_testparms.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_stirrandom.o `test -f 'tools/tpm2_stirrandom.c' || echo '$(srcdir)/'`tools/tpm2_stirrandom.c
 
-tools/tools_tpm2-tpm2_unseal.o: tools/tpm2_unseal.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_unseal.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_unseal.Tpo -c -o tools/tools_tpm2-tpm2_unseal.o `test -f 'tools/tpm2_unseal.c' || echo '$(srcdir)/'`tools/tpm2_unseal.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_unseal.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_unseal.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_unseal.c' object='tools/tools_tpm2-tpm2_unseal.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_stirrandom.obj: tools/tpm2_stirrandom.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_stirrandom.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_stirrandom.Tpo -c -o tools/tpm2-tpm2_stirrandom.obj `if test -f 'tools/tpm2_stirrandom.c'; then $(CYGPATH_W) 'tools/tpm2_stirrandom.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_stirrandom.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_stirrandom.Tpo tools/$(DEPDIR)/tpm2-tpm2_stirrandom.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_stirrandom.c' object='tools/tpm2-tpm2_stirrandom.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_unseal.o `test -f 'tools/tpm2_unseal.c' || echo '$(srcdir)/'`tools/tpm2_unseal.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_stirrandom.obj `if test -f 'tools/tpm2_stirrandom.c'; then $(CYGPATH_W) 'tools/tpm2_stirrandom.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_stirrandom.c'; fi`
 
-tools/tools_tpm2-tpm2_unseal.obj: tools/tpm2_unseal.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_unseal.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_unseal.Tpo -c -o tools/tools_tpm2-tpm2_unseal.obj `if test -f 'tools/tpm2_unseal.c'; then $(CYGPATH_W) 'tools/tpm2_unseal.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_unseal.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_unseal.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_unseal.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_unseal.c' object='tools/tools_tpm2-tpm2_unseal.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_testparms.o: tools/tpm2_testparms.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_testparms.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_testparms.Tpo -c -o tools/tpm2-tpm2_testparms.o `test -f 'tools/tpm2_testparms.c' || echo '$(srcdir)/'`tools/tpm2_testparms.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_testparms.Tpo tools/$(DEPDIR)/tpm2-tpm2_testparms.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_testparms.c' object='tools/tpm2-tpm2_testparms.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_unseal.obj `if test -f 'tools/tpm2_unseal.c'; then $(CYGPATH_W) 'tools/tpm2_unseal.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_unseal.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_testparms.o `test -f 'tools/tpm2_testparms.c' || echo '$(srcdir)/'`tools/tpm2_testparms.c
 
-tools/tools_tpm2-tpm2_verifysignature.o: tools/tpm2_verifysignature.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_verifysignature.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_verifysignature.Tpo -c -o tools/tools_tpm2-tpm2_verifysignature.o `test -f 'tools/tpm2_verifysignature.c' || echo '$(srcdir)/'`tools/tpm2_verifysignature.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_verifysignature.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_verifysignature.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_verifysignature.c' object='tools/tools_tpm2-tpm2_verifysignature.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_testparms.obj: tools/tpm2_testparms.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_testparms.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_testparms.Tpo -c -o tools/tpm2-tpm2_testparms.obj `if test -f 'tools/tpm2_testparms.c'; then $(CYGPATH_W) 'tools/tpm2_testparms.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_testparms.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_testparms.Tpo tools/$(DEPDIR)/tpm2-tpm2_testparms.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_testparms.c' object='tools/tpm2-tpm2_testparms.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_verifysignature.o `test -f 'tools/tpm2_verifysignature.c' || echo '$(srcdir)/'`tools/tpm2_verifysignature.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_testparms.obj `if test -f 'tools/tpm2_testparms.c'; then $(CYGPATH_W) 'tools/tpm2_testparms.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_testparms.c'; fi`
 
-tools/tools_tpm2-tpm2_verifysignature.obj: tools/tpm2_verifysignature.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_verifysignature.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_verifysignature.Tpo -c -o tools/tools_tpm2-tpm2_verifysignature.obj `if test -f 'tools/tpm2_verifysignature.c'; then $(CYGPATH_W) 'tools/tpm2_verifysignature.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_verifysignature.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_verifysignature.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_verifysignature.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_verifysignature.c' object='tools/tools_tpm2-tpm2_verifysignature.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_unseal.o: tools/tpm2_unseal.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_unseal.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_unseal.Tpo -c -o tools/tpm2-tpm2_unseal.o `test -f 'tools/tpm2_unseal.c' || echo '$(srcdir)/'`tools/tpm2_unseal.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_unseal.Tpo tools/$(DEPDIR)/tpm2-tpm2_unseal.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_unseal.c' object='tools/tpm2-tpm2_unseal.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_verifysignature.obj `if test -f 'tools/tpm2_verifysignature.c'; then $(CYGPATH_W) 'tools/tpm2_verifysignature.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_verifysignature.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_unseal.o `test -f 'tools/tpm2_unseal.c' || echo '$(srcdir)/'`tools/tpm2_unseal.c
 
-tools/tools_tpm2-tpm2_setcommandauditstatus.o: tools/tpm2_setcommandauditstatus.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_setcommandauditstatus.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_setcommandauditstatus.Tpo -c -o tools/tools_tpm2-tpm2_setcommandauditstatus.o `test -f 'tools/tpm2_setcommandauditstatus.c' || echo '$(srcdir)/'`tools/tpm2_setcommandauditstatus.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_setcommandauditstatus.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_setcommandauditstatus.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_setcommandauditstatus.c' object='tools/tools_tpm2-tpm2_setcommandauditstatus.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_unseal.obj: tools/tpm2_unseal.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_unseal.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_unseal.Tpo -c -o tools/tpm2-tpm2_unseal.obj `if test -f 'tools/tpm2_unseal.c'; then $(CYGPATH_W) 'tools/tpm2_unseal.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_unseal.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_unseal.Tpo tools/$(DEPDIR)/tpm2-tpm2_unseal.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_unseal.c' object='tools/tpm2-tpm2_unseal.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_setcommandauditstatus.o `test -f 'tools/tpm2_setcommandauditstatus.c' || echo '$(srcdir)/'`tools/tpm2_setcommandauditstatus.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_unseal.obj `if test -f 'tools/tpm2_unseal.c'; then $(CYGPATH_W) 'tools/tpm2_unseal.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_unseal.c'; fi`
 
-tools/tools_tpm2-tpm2_setcommandauditstatus.obj: tools/tpm2_setcommandauditstatus.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_setcommandauditstatus.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_setcommandauditstatus.Tpo -c -o tools/tools_tpm2-tpm2_setcommandauditstatus.obj `if test -f 'tools/tpm2_setcommandauditstatus.c'; then $(CYGPATH_W) 'tools/tpm2_setcommandauditstatus.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_setcommandauditstatus.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_setcommandauditstatus.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_setcommandauditstatus.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_setcommandauditstatus.c' object='tools/tools_tpm2-tpm2_setcommandauditstatus.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_verifysignature.o: tools/tpm2_verifysignature.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_verifysignature.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_verifysignature.Tpo -c -o tools/tpm2-tpm2_verifysignature.o `test -f 'tools/tpm2_verifysignature.c' || echo '$(srcdir)/'`tools/tpm2_verifysignature.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_verifysignature.Tpo tools/$(DEPDIR)/tpm2-tpm2_verifysignature.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_verifysignature.c' object='tools/tpm2-tpm2_verifysignature.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_setcommandauditstatus.obj `if test -f 'tools/tpm2_setcommandauditstatus.c'; then $(CYGPATH_W) 'tools/tpm2_setcommandauditstatus.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_setcommandauditstatus.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_verifysignature.o `test -f 'tools/tpm2_verifysignature.c' || echo '$(srcdir)/'`tools/tpm2_verifysignature.c
 
-tools/tools_tpm2-tpm2_getcommandauditdigest.o: tools/tpm2_getcommandauditdigest.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_getcommandauditdigest.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_getcommandauditdigest.Tpo -c -o tools/tools_tpm2-tpm2_getcommandauditdigest.o `test -f 'tools/tpm2_getcommandauditdigest.c' || echo '$(srcdir)/'`tools/tpm2_getcommandauditdigest.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_getcommandauditdigest.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_getcommandauditdigest.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getcommandauditdigest.c' object='tools/tools_tpm2-tpm2_getcommandauditdigest.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_verifysignature.obj: tools/tpm2_verifysignature.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_verifysignature.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_verifysignature.Tpo -c -o tools/tpm2-tpm2_verifysignature.obj `if test -f 'tools/tpm2_verifysignature.c'; then $(CYGPATH_W) 'tools/tpm2_verifysignature.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_verifysignature.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_verifysignature.Tpo tools/$(DEPDIR)/tpm2-tpm2_verifysignature.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_verifysignature.c' object='tools/tpm2-tpm2_verifysignature.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_getcommandauditdigest.o `test -f 'tools/tpm2_getcommandauditdigest.c' || echo '$(srcdir)/'`tools/tpm2_getcommandauditdigest.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_verifysignature.obj `if test -f 'tools/tpm2_verifysignature.c'; then $(CYGPATH_W) 'tools/tpm2_verifysignature.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_verifysignature.c'; fi`
 
-tools/tools_tpm2-tpm2_getcommandauditdigest.obj: tools/tpm2_getcommandauditdigest.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_getcommandauditdigest.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_getcommandauditdigest.Tpo -c -o tools/tools_tpm2-tpm2_getcommandauditdigest.obj `if test -f 'tools/tpm2_getcommandauditdigest.c'; then $(CYGPATH_W) 'tools/tpm2_getcommandauditdigest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getcommandauditdigest.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_getcommandauditdigest.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_getcommandauditdigest.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getcommandauditdigest.c' object='tools/tools_tpm2-tpm2_getcommandauditdigest.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_setcommandauditstatus.o: tools/tpm2_setcommandauditstatus.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_setcommandauditstatus.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_setcommandauditstatus.Tpo -c -o tools/tpm2-tpm2_setcommandauditstatus.o `test -f 'tools/tpm2_setcommandauditstatus.c' || echo '$(srcdir)/'`tools/tpm2_setcommandauditstatus.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_setcommandauditstatus.Tpo tools/$(DEPDIR)/tpm2-tpm2_setcommandauditstatus.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_setcommandauditstatus.c' object='tools/tpm2-tpm2_setcommandauditstatus.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_getcommandauditdigest.obj `if test -f 'tools/tpm2_getcommandauditdigest.c'; then $(CYGPATH_W) 'tools/tpm2_getcommandauditdigest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getcommandauditdigest.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_setcommandauditstatus.o `test -f 'tools/tpm2_setcommandauditstatus.c' || echo '$(srcdir)/'`tools/tpm2_setcommandauditstatus.c
 
-tools/tools_tpm2-tpm2_getsessionauditdigest.o: tools/tpm2_getsessionauditdigest.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_getsessionauditdigest.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_getsessionauditdigest.Tpo -c -o tools/tools_tpm2-tpm2_getsessionauditdigest.o `test -f 'tools/tpm2_getsessionauditdigest.c' || echo '$(srcdir)/'`tools/tpm2_getsessionauditdigest.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_getsessionauditdigest.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_getsessionauditdigest.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getsessionauditdigest.c' object='tools/tools_tpm2-tpm2_getsessionauditdigest.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_setcommandauditstatus.obj: tools/tpm2_setcommandauditstatus.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_setcommandauditstatus.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_setcommandauditstatus.Tpo -c -o tools/tpm2-tpm2_setcommandauditstatus.obj `if test -f 'tools/tpm2_setcommandauditstatus.c'; then $(CYGPATH_W) 'tools/tpm2_setcommandauditstatus.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_setcommandauditstatus.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_setcommandauditstatus.Tpo tools/$(DEPDIR)/tpm2-tpm2_setcommandauditstatus.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_setcommandauditstatus.c' object='tools/tpm2-tpm2_setcommandauditstatus.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_getsessionauditdigest.o `test -f 'tools/tpm2_getsessionauditdigest.c' || echo '$(srcdir)/'`tools/tpm2_getsessionauditdigest.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_setcommandauditstatus.obj `if test -f 'tools/tpm2_setcommandauditstatus.c'; then $(CYGPATH_W) 'tools/tpm2_setcommandauditstatus.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_setcommandauditstatus.c'; fi`
 
-tools/tools_tpm2-tpm2_getsessionauditdigest.obj: tools/tpm2_getsessionauditdigest.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_getsessionauditdigest.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_getsessionauditdigest.Tpo -c -o tools/tools_tpm2-tpm2_getsessionauditdigest.obj `if test -f 'tools/tpm2_getsessionauditdigest.c'; then $(CYGPATH_W) 'tools/tpm2_getsessionauditdigest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getsessionauditdigest.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_getsessionauditdigest.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_getsessionauditdigest.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getsessionauditdigest.c' object='tools/tools_tpm2-tpm2_getsessionauditdigest.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_getcommandauditdigest.o: tools/tpm2_getcommandauditdigest.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_getcommandauditdigest.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_getcommandauditdigest.Tpo -c -o tools/tpm2-tpm2_getcommandauditdigest.o `test -f 'tools/tpm2_getcommandauditdigest.c' || echo '$(srcdir)/'`tools/tpm2_getcommandauditdigest.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_getcommandauditdigest.Tpo tools/$(DEPDIR)/tpm2-tpm2_getcommandauditdigest.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getcommandauditdigest.c' object='tools/tpm2-tpm2_getcommandauditdigest.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_getsessionauditdigest.obj `if test -f 'tools/tpm2_getsessionauditdigest.c'; then $(CYGPATH_W) 'tools/tpm2_getsessionauditdigest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getsessionauditdigest.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_getcommandauditdigest.o `test -f 'tools/tpm2_getcommandauditdigest.c' || echo '$(srcdir)/'`tools/tpm2_getcommandauditdigest.c
 
-tools/tools_tpm2-tpm2_geteccparameters.o: tools/tpm2_geteccparameters.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_geteccparameters.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_geteccparameters.Tpo -c -o tools/tools_tpm2-tpm2_geteccparameters.o `test -f 'tools/tpm2_geteccparameters.c' || echo '$(srcdir)/'`tools/tpm2_geteccparameters.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_geteccparameters.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_geteccparameters.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_geteccparameters.c' object='tools/tools_tpm2-tpm2_geteccparameters.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_getcommandauditdigest.obj: tools/tpm2_getcommandauditdigest.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_getcommandauditdigest.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_getcommandauditdigest.Tpo -c -o tools/tpm2-tpm2_getcommandauditdigest.obj `if test -f 'tools/tpm2_getcommandauditdigest.c'; then $(CYGPATH_W) 'tools/tpm2_getcommandauditdigest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getcommandauditdigest.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_getcommandauditdigest.Tpo tools/$(DEPDIR)/tpm2-tpm2_getcommandauditdigest.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getcommandauditdigest.c' object='tools/tpm2-tpm2_getcommandauditdigest.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_geteccparameters.o `test -f 'tools/tpm2_geteccparameters.c' || echo '$(srcdir)/'`tools/tpm2_geteccparameters.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_getcommandauditdigest.obj `if test -f 'tools/tpm2_getcommandauditdigest.c'; then $(CYGPATH_W) 'tools/tpm2_getcommandauditdigest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getcommandauditdigest.c'; fi`
 
-tools/tools_tpm2-tpm2_geteccparameters.obj: tools/tpm2_geteccparameters.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_geteccparameters.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_geteccparameters.Tpo -c -o tools/tools_tpm2-tpm2_geteccparameters.obj `if test -f 'tools/tpm2_geteccparameters.c'; then $(CYGPATH_W) 'tools/tpm2_geteccparameters.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_geteccparameters.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_geteccparameters.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_geteccparameters.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_geteccparameters.c' object='tools/tools_tpm2-tpm2_geteccparameters.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_getsessionauditdigest.o: tools/tpm2_getsessionauditdigest.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_getsessionauditdigest.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_getsessionauditdigest.Tpo -c -o tools/tpm2-tpm2_getsessionauditdigest.o `test -f 'tools/tpm2_getsessionauditdigest.c' || echo '$(srcdir)/'`tools/tpm2_getsessionauditdigest.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_getsessionauditdigest.Tpo tools/$(DEPDIR)/tpm2-tpm2_getsessionauditdigest.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getsessionauditdigest.c' object='tools/tpm2-tpm2_getsessionauditdigest.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_geteccparameters.obj `if test -f 'tools/tpm2_geteccparameters.c'; then $(CYGPATH_W) 'tools/tpm2_geteccparameters.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_geteccparameters.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_getsessionauditdigest.o `test -f 'tools/tpm2_getsessionauditdigest.c' || echo '$(srcdir)/'`tools/tpm2_getsessionauditdigest.c
 
-tools/tools_tpm2-tpm2_ecephemeral.o: tools/tpm2_ecephemeral.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_ecephemeral.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_ecephemeral.Tpo -c -o tools/tools_tpm2-tpm2_ecephemeral.o `test -f 'tools/tpm2_ecephemeral.c' || echo '$(srcdir)/'`tools/tpm2_ecephemeral.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_ecephemeral.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_ecephemeral.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_ecephemeral.c' object='tools/tools_tpm2-tpm2_ecephemeral.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_getsessionauditdigest.obj: tools/tpm2_getsessionauditdigest.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_getsessionauditdigest.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_getsessionauditdigest.Tpo -c -o tools/tpm2-tpm2_getsessionauditdigest.obj `if test -f 'tools/tpm2_getsessionauditdigest.c'; then $(CYGPATH_W) 'tools/tpm2_getsessionauditdigest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getsessionauditdigest.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_getsessionauditdigest.Tpo tools/$(DEPDIR)/tpm2-tpm2_getsessionauditdigest.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getsessionauditdigest.c' object='tools/tpm2-tpm2_getsessionauditdigest.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_ecephemeral.o `test -f 'tools/tpm2_ecephemeral.c' || echo '$(srcdir)/'`tools/tpm2_ecephemeral.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_getsessionauditdigest.obj `if test -f 'tools/tpm2_getsessionauditdigest.c'; then $(CYGPATH_W) 'tools/tpm2_getsessionauditdigest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getsessionauditdigest.c'; fi`
 
-tools/tools_tpm2-tpm2_ecephemeral.obj: tools/tpm2_ecephemeral.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_ecephemeral.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_ecephemeral.Tpo -c -o tools/tools_tpm2-tpm2_ecephemeral.obj `if test -f 'tools/tpm2_ecephemeral.c'; then $(CYGPATH_W) 'tools/tpm2_ecephemeral.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_ecephemeral.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_ecephemeral.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_ecephemeral.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_ecephemeral.c' object='tools/tools_tpm2-tpm2_ecephemeral.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_geteccparameters.o: tools/tpm2_geteccparameters.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_geteccparameters.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_geteccparameters.Tpo -c -o tools/tpm2-tpm2_geteccparameters.o `test -f 'tools/tpm2_geteccparameters.c' || echo '$(srcdir)/'`tools/tpm2_geteccparameters.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_geteccparameters.Tpo tools/$(DEPDIR)/tpm2-tpm2_geteccparameters.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_geteccparameters.c' object='tools/tpm2-tpm2_geteccparameters.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_ecephemeral.obj `if test -f 'tools/tpm2_ecephemeral.c'; then $(CYGPATH_W) 'tools/tpm2_ecephemeral.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_ecephemeral.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_geteccparameters.o `test -f 'tools/tpm2_geteccparameters.c' || echo '$(srcdir)/'`tools/tpm2_geteccparameters.c
 
-tools/tools_tpm2-tpm2_commit.o: tools/tpm2_commit.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_commit.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_commit.Tpo -c -o tools/tools_tpm2-tpm2_commit.o `test -f 'tools/tpm2_commit.c' || echo '$(srcdir)/'`tools/tpm2_commit.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_commit.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_commit.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_commit.c' object='tools/tools_tpm2-tpm2_commit.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_geteccparameters.obj: tools/tpm2_geteccparameters.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_geteccparameters.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_geteccparameters.Tpo -c -o tools/tpm2-tpm2_geteccparameters.obj `if test -f 'tools/tpm2_geteccparameters.c'; then $(CYGPATH_W) 'tools/tpm2_geteccparameters.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_geteccparameters.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_geteccparameters.Tpo tools/$(DEPDIR)/tpm2-tpm2_geteccparameters.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_geteccparameters.c' object='tools/tpm2-tpm2_geteccparameters.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_commit.o `test -f 'tools/tpm2_commit.c' || echo '$(srcdir)/'`tools/tpm2_commit.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_geteccparameters.obj `if test -f 'tools/tpm2_geteccparameters.c'; then $(CYGPATH_W) 'tools/tpm2_geteccparameters.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_geteccparameters.c'; fi`
 
-tools/tools_tpm2-tpm2_commit.obj: tools/tpm2_commit.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_commit.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_commit.Tpo -c -o tools/tools_tpm2-tpm2_commit.obj `if test -f 'tools/tpm2_commit.c'; then $(CYGPATH_W) 'tools/tpm2_commit.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_commit.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_commit.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_commit.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_commit.c' object='tools/tools_tpm2-tpm2_commit.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_ecephemeral.o: tools/tpm2_ecephemeral.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_ecephemeral.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_ecephemeral.Tpo -c -o tools/tpm2-tpm2_ecephemeral.o `test -f 'tools/tpm2_ecephemeral.c' || echo '$(srcdir)/'`tools/tpm2_ecephemeral.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_ecephemeral.Tpo tools/$(DEPDIR)/tpm2-tpm2_ecephemeral.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_ecephemeral.c' object='tools/tpm2-tpm2_ecephemeral.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_commit.obj `if test -f 'tools/tpm2_commit.c'; then $(CYGPATH_W) 'tools/tpm2_commit.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_commit.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_ecephemeral.o `test -f 'tools/tpm2_ecephemeral.c' || echo '$(srcdir)/'`tools/tpm2_ecephemeral.c
 
-tools/tools_tpm2-tpm2_ecdhkeygen.o: tools/tpm2_ecdhkeygen.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_ecdhkeygen.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhkeygen.Tpo -c -o tools/tools_tpm2-tpm2_ecdhkeygen.o `test -f 'tools/tpm2_ecdhkeygen.c' || echo '$(srcdir)/'`tools/tpm2_ecdhkeygen.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhkeygen.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhkeygen.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_ecdhkeygen.c' object='tools/tools_tpm2-tpm2_ecdhkeygen.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_ecephemeral.obj: tools/tpm2_ecephemeral.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_ecephemeral.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_ecephemeral.Tpo -c -o tools/tpm2-tpm2_ecephemeral.obj `if test -f 'tools/tpm2_ecephemeral.c'; then $(CYGPATH_W) 'tools/tpm2_ecephemeral.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_ecephemeral.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_ecephemeral.Tpo tools/$(DEPDIR)/tpm2-tpm2_ecephemeral.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_ecephemeral.c' object='tools/tpm2-tpm2_ecephemeral.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_ecdhkeygen.o `test -f 'tools/tpm2_ecdhkeygen.c' || echo '$(srcdir)/'`tools/tpm2_ecdhkeygen.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_ecephemeral.obj `if test -f 'tools/tpm2_ecephemeral.c'; then $(CYGPATH_W) 'tools/tpm2_ecephemeral.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_ecephemeral.c'; fi`
 
-tools/tools_tpm2-tpm2_ecdhkeygen.obj: tools/tpm2_ecdhkeygen.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_ecdhkeygen.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhkeygen.Tpo -c -o tools/tools_tpm2-tpm2_ecdhkeygen.obj `if test -f 'tools/tpm2_ecdhkeygen.c'; then $(CYGPATH_W) 'tools/tpm2_ecdhkeygen.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_ecdhkeygen.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhkeygen.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhkeygen.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_ecdhkeygen.c' object='tools/tools_tpm2-tpm2_ecdhkeygen.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_commit.o: tools/tpm2_commit.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_commit.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_commit.Tpo -c -o tools/tpm2-tpm2_commit.o `test -f 'tools/tpm2_commit.c' || echo '$(srcdir)/'`tools/tpm2_commit.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_commit.Tpo tools/$(DEPDIR)/tpm2-tpm2_commit.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_commit.c' object='tools/tpm2-tpm2_commit.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_ecdhkeygen.obj `if test -f 'tools/tpm2_ecdhkeygen.c'; then $(CYGPATH_W) 'tools/tpm2_ecdhkeygen.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_ecdhkeygen.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_commit.o `test -f 'tools/tpm2_commit.c' || echo '$(srcdir)/'`tools/tpm2_commit.c
 
-tools/tools_tpm2-tpm2_ecdhzgen.o: tools/tpm2_ecdhzgen.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_ecdhzgen.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhzgen.Tpo -c -o tools/tools_tpm2-tpm2_ecdhzgen.o `test -f 'tools/tpm2_ecdhzgen.c' || echo '$(srcdir)/'`tools/tpm2_ecdhzgen.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhzgen.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhzgen.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_ecdhzgen.c' object='tools/tools_tpm2-tpm2_ecdhzgen.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_commit.obj: tools/tpm2_commit.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_commit.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_commit.Tpo -c -o tools/tpm2-tpm2_commit.obj `if test -f 'tools/tpm2_commit.c'; then $(CYGPATH_W) 'tools/tpm2_commit.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_commit.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_commit.Tpo tools/$(DEPDIR)/tpm2-tpm2_commit.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_commit.c' object='tools/tpm2-tpm2_commit.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_ecdhzgen.o `test -f 'tools/tpm2_ecdhzgen.c' || echo '$(srcdir)/'`tools/tpm2_ecdhzgen.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_commit.obj `if test -f 'tools/tpm2_commit.c'; then $(CYGPATH_W) 'tools/tpm2_commit.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_commit.c'; fi`
 
-tools/tools_tpm2-tpm2_ecdhzgen.obj: tools/tpm2_ecdhzgen.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_ecdhzgen.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhzgen.Tpo -c -o tools/tools_tpm2-tpm2_ecdhzgen.obj `if test -f 'tools/tpm2_ecdhzgen.c'; then $(CYGPATH_W) 'tools/tpm2_ecdhzgen.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_ecdhzgen.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhzgen.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_ecdhzgen.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_ecdhzgen.c' object='tools/tools_tpm2-tpm2_ecdhzgen.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_ecdhkeygen.o: tools/tpm2_ecdhkeygen.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_ecdhkeygen.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_ecdhkeygen.Tpo -c -o tools/tpm2-tpm2_ecdhkeygen.o `test -f 'tools/tpm2_ecdhkeygen.c' || echo '$(srcdir)/'`tools/tpm2_ecdhkeygen.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_ecdhkeygen.Tpo tools/$(DEPDIR)/tpm2-tpm2_ecdhkeygen.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_ecdhkeygen.c' object='tools/tpm2-tpm2_ecdhkeygen.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_ecdhzgen.obj `if test -f 'tools/tpm2_ecdhzgen.c'; then $(CYGPATH_W) 'tools/tpm2_ecdhzgen.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_ecdhzgen.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_ecdhkeygen.o `test -f 'tools/tpm2_ecdhkeygen.c' || echo '$(srcdir)/'`tools/tpm2_ecdhkeygen.c
 
-tools/tools_tpm2-tpm2_zgen2phase.o: tools/tpm2_zgen2phase.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_zgen2phase.o -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_zgen2phase.Tpo -c -o tools/tools_tpm2-tpm2_zgen2phase.o `test -f 'tools/tpm2_zgen2phase.c' || echo '$(srcdir)/'`tools/tpm2_zgen2phase.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_zgen2phase.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_zgen2phase.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_zgen2phase.c' object='tools/tools_tpm2-tpm2_zgen2phase.o' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_ecdhkeygen.obj: tools/tpm2_ecdhkeygen.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_ecdhkeygen.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_ecdhkeygen.Tpo -c -o tools/tpm2-tpm2_ecdhkeygen.obj `if test -f 'tools/tpm2_ecdhkeygen.c'; then $(CYGPATH_W) 'tools/tpm2_ecdhkeygen.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_ecdhkeygen.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_ecdhkeygen.Tpo tools/$(DEPDIR)/tpm2-tpm2_ecdhkeygen.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_ecdhkeygen.c' object='tools/tpm2-tpm2_ecdhkeygen.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_zgen2phase.o `test -f 'tools/tpm2_zgen2phase.c' || echo '$(srcdir)/'`tools/tpm2_zgen2phase.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_ecdhkeygen.obj `if test -f 'tools/tpm2_ecdhkeygen.c'; then $(CYGPATH_W) 'tools/tpm2_ecdhkeygen.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_ecdhkeygen.c'; fi`
 
-tools/tools_tpm2-tpm2_zgen2phase.obj: tools/tpm2_zgen2phase.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tools_tpm2-tpm2_zgen2phase.obj -MD -MP -MF tools/$(DEPDIR)/tools_tpm2-tpm2_zgen2phase.Tpo -c -o tools/tools_tpm2-tpm2_zgen2phase.obj `if test -f 'tools/tpm2_zgen2phase.c'; then $(CYGPATH_W) 'tools/tpm2_zgen2phase.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_zgen2phase.c'; fi`
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tools_tpm2-tpm2_zgen2phase.Tpo tools/$(DEPDIR)/tools_tpm2-tpm2_zgen2phase.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_zgen2phase.c' object='tools/tools_tpm2-tpm2_zgen2phase.obj' libtool=no @AMDEPBACKSLASH@
+tools/tpm2-tpm2_ecdhzgen.o: tools/tpm2_ecdhzgen.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_ecdhzgen.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_ecdhzgen.Tpo -c -o tools/tpm2-tpm2_ecdhzgen.o `test -f 'tools/tpm2_ecdhzgen.c' || echo '$(srcdir)/'`tools/tpm2_ecdhzgen.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_ecdhzgen.Tpo tools/$(DEPDIR)/tpm2-tpm2_ecdhzgen.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_ecdhzgen.c' object='tools/tpm2-tpm2_ecdhzgen.o' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tools_tpm2-tpm2_zgen2phase.obj `if test -f 'tools/tpm2_zgen2phase.c'; then $(CYGPATH_W) 'tools/tpm2_zgen2phase.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_zgen2phase.c'; fi`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_ecdhzgen.o `test -f 'tools/tpm2_ecdhzgen.c' || echo '$(srcdir)/'`tools/tpm2_ecdhzgen.c
+
+tools/tpm2-tpm2_ecdhzgen.obj: tools/tpm2_ecdhzgen.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_ecdhzgen.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_ecdhzgen.Tpo -c -o tools/tpm2-tpm2_ecdhzgen.obj `if test -f 'tools/tpm2_ecdhzgen.c'; then $(CYGPATH_W) 'tools/tpm2_ecdhzgen.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_ecdhzgen.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_ecdhzgen.Tpo tools/$(DEPDIR)/tpm2-tpm2_ecdhzgen.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_ecdhzgen.c' object='tools/tpm2-tpm2_ecdhzgen.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_ecdhzgen.obj `if test -f 'tools/tpm2_ecdhzgen.c'; then $(CYGPATH_W) 'tools/tpm2_ecdhzgen.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_ecdhzgen.c'; fi`
+
+tools/tpm2-tpm2_zgen2phase.o: tools/tpm2_zgen2phase.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_zgen2phase.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_zgen2phase.Tpo -c -o tools/tpm2-tpm2_zgen2phase.o `test -f 'tools/tpm2_zgen2phase.c' || echo '$(srcdir)/'`tools/tpm2_zgen2phase.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_zgen2phase.Tpo tools/$(DEPDIR)/tpm2-tpm2_zgen2phase.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_zgen2phase.c' object='tools/tpm2-tpm2_zgen2phase.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_zgen2phase.o `test -f 'tools/tpm2_zgen2phase.c' || echo '$(srcdir)/'`tools/tpm2_zgen2phase.c
+
+tools/tpm2-tpm2_zgen2phase.obj: tools/tpm2_zgen2phase.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_zgen2phase.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_zgen2phase.Tpo -c -o tools/tpm2-tpm2_zgen2phase.obj `if test -f 'tools/tpm2_zgen2phase.c'; then $(CYGPATH_W) 'tools/tpm2_zgen2phase.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_zgen2phase.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_zgen2phase.Tpo tools/$(DEPDIR)/tpm2-tpm2_zgen2phase.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_zgen2phase.c' object='tools/tpm2-tpm2_zgen2phase.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_zgen2phase.obj `if test -f 'tools/tpm2_zgen2phase.c'; then $(CYGPATH_W) 'tools/tpm2_zgen2phase.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_zgen2phase.c'; fi`
+
+tools/tpm2-tpm2_sessionconfig.o: tools/tpm2_sessionconfig.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_sessionconfig.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_sessionconfig.Tpo -c -o tools/tpm2-tpm2_sessionconfig.o `test -f 'tools/tpm2_sessionconfig.c' || echo '$(srcdir)/'`tools/tpm2_sessionconfig.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_sessionconfig.Tpo tools/$(DEPDIR)/tpm2-tpm2_sessionconfig.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_sessionconfig.c' object='tools/tpm2-tpm2_sessionconfig.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_sessionconfig.o `test -f 'tools/tpm2_sessionconfig.c' || echo '$(srcdir)/'`tools/tpm2_sessionconfig.c
+
+tools/tpm2-tpm2_sessionconfig.obj: tools/tpm2_sessionconfig.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_sessionconfig.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_sessionconfig.Tpo -c -o tools/tpm2-tpm2_sessionconfig.obj `if test -f 'tools/tpm2_sessionconfig.c'; then $(CYGPATH_W) 'tools/tpm2_sessionconfig.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_sessionconfig.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_sessionconfig.Tpo tools/$(DEPDIR)/tpm2-tpm2_sessionconfig.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_sessionconfig.c' object='tools/tpm2-tpm2_sessionconfig.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_sessionconfig.obj `if test -f 'tools/tpm2_sessionconfig.c'; then $(CYGPATH_W) 'tools/tpm2_sessionconfig.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_sessionconfig.c'; fi`
+
+tools/tpm2-tpm2_getpolicydigest.o: tools/tpm2_getpolicydigest.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_getpolicydigest.o -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_getpolicydigest.Tpo -c -o tools/tpm2-tpm2_getpolicydigest.o `test -f 'tools/tpm2_getpolicydigest.c' || echo '$(srcdir)/'`tools/tpm2_getpolicydigest.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_getpolicydigest.Tpo tools/$(DEPDIR)/tpm2-tpm2_getpolicydigest.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getpolicydigest.c' object='tools/tpm2-tpm2_getpolicydigest.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_getpolicydigest.o `test -f 'tools/tpm2_getpolicydigest.c' || echo '$(srcdir)/'`tools/tpm2_getpolicydigest.c
+
+tools/tpm2-tpm2_getpolicydigest.obj: tools/tpm2_getpolicydigest.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -MT tools/tpm2-tpm2_getpolicydigest.obj -MD -MP -MF tools/$(DEPDIR)/tpm2-tpm2_getpolicydigest.Tpo -c -o tools/tpm2-tpm2_getpolicydigest.obj `if test -f 'tools/tpm2_getpolicydigest.c'; then $(CYGPATH_W) 'tools/tpm2_getpolicydigest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getpolicydigest.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tools/$(DEPDIR)/tpm2-tpm2_getpolicydigest.Tpo tools/$(DEPDIR)/tpm2-tpm2_getpolicydigest.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='tools/tpm2_getpolicydigest.c' object='tools/tpm2-tpm2_getpolicydigest.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(tools_tpm2_CFLAGS) $(CFLAGS) -c -o tools/tpm2-tpm2_getpolicydigest.obj `if test -f 'tools/tpm2_getpolicydigest.c'; then $(CYGPATH_W) 'tools/tpm2_getpolicydigest.c'; else $(CYGPATH_W) '$(srcdir)/tools/tpm2_getpolicydigest.c'; fi`
 
 mostlyclean-libtool:
 	-rm -f *.lo
@@ -5176,7 +5513,7 @@
 	fi;								\
 	$$success || exit 1
 
-check-TESTS:
+check-TESTS: $(check_PROGRAMS) $(check_SCRIPTS)
 	@list='$(RECHECK_LOGS)';           test -z "$$list" || rm -f $$list
 	@list='$(RECHECK_LOGS:.log=.trs)'; test -z "$$list" || rm -f $$list
 	@test -z "$(TEST_SUITE_LOG)" || rm -f $(TEST_SUITE_LOG)
@@ -5186,7 +5523,7 @@
 	log_list=`echo $$log_list`; trs_list=`echo $$trs_list`; \
 	$(MAKE) $(AM_MAKEFLAGS) $(TEST_SUITE_LOG) TEST_LOGS="$$log_list"; \
 	exit $$?;
-recheck: all $(check_PROGRAMS)
+recheck: all $(check_PROGRAMS) $(check_SCRIPTS)
 	@test -z "$(TEST_SUITE_LOG)" || rm -f $(TEST_SUITE_LOG)
 	@set +e; $(am__set_TESTS_bases); \
 	bases=`for i in $$bases; do echo $$i; done \
@@ -5302,6 +5639,13 @@
 	--log-file $$b.log --trs-file $$b.trs \
 	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
 	"$$tst" $(AM_TESTS_FD_REDIRECT)
+test/unit/test_object.log: test/unit/test_object$(EXEEXT)
+	@p='test/unit/test_object$(EXEEXT)'; \
+	b='test/unit/test_object'; \
+	$(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \
+	--log-file $$b.log --trs-file $$b.trs \
+	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
+	"$$tst" $(AM_TESTS_FD_REDIRECT)
 .sh.log:
 	@p='$<'; \
 	$(am__set_b); \
@@ -5317,7 +5661,10 @@
 @am__EXEEXT_TRUE@	$(am__common_driver_flags) $(AM_SH_LOG_DRIVER_FLAGS) $(SH_LOG_DRIVER_FLAGS) -- $(SH_LOG_COMPILE) \
 @am__EXEEXT_TRUE@	"$$tst" $(AM_TESTS_FD_REDIRECT)
 
-distdir: $(DISTFILES)
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
+
+distdir-am: $(DISTFILES)
 	$(am__remove_distdir)
 	test -d "$(distdir)" || mkdir "$(distdir)"
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/.^$$\\*/\\\\&/g'`; \
@@ -5484,10 +5831,10 @@
 	       $(distcleancheck_listfiles) ; \
 	       exit 1; } >&2
 check-am: all-am
-	$(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS)
+	$(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS) $(check_SCRIPTS)
 	$(MAKE) $(AM_MAKEFLAGS) check-TESTS
 check: check-am
-all-am: Makefile $(LIBRARIES) $(PROGRAMS) $(MANS) $(DATA)
+all-am: Makefile $(PROGRAMS) $(LIBRARIES) $(MANS) $(DATA)
 installdirs:
 	for dir in "$(DESTDIR)$(bindir)" "$(DESTDIR)$(man1dir)" "$(DESTDIR)$(bashcompdir)"; do \
 	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
@@ -5545,7 +5892,189 @@
 
 distclean: distclean-am
 	-rm -f $(am__CONFIG_DISTCLEAN_FILES)
-	-rm -rf lib/$(DEPDIR) test/unit/$(DEPDIR) tools/$(DEPDIR) tools/fapi/$(DEPDIR) tools/misc/$(DEPDIR)
+		-rm -f lib/$(DEPDIR)/libcommon_a-files.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-log.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-object.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-pcr.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tool_rc.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_alg_util.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_attr_util.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_auth_util.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_capability.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_cc_util.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_convert.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_ctx_mgmt.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_errata.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_eventlog.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_eventlog_yaml.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_hash.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_hierarchy.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_identity_util.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_kdfa.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_kdfe.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_openssl.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_options.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_policy.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_session.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_tool_output.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_util.Po
+	-rm -f test/unit/$(DEPDIR)/test_cc_util-test_cc_util.Po
+	-rm -f test/unit/$(DEPDIR)/test_files-test_files.Po
+	-rm -f test/unit/$(DEPDIR)/test_object-test_object.Po
+	-rm -f test/unit/$(DEPDIR)/test_options-test_options.Po
+	-rm -f test/unit/$(DEPDIR)/test_pcr-test_pcr.Po
+	-rm -f test/unit/$(DEPDIR)/test_string_bytes-test_string_bytes.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_alg_util-test_tpm2_alg_util.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_attr_util-test_tpm2_attr_util.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_auth_util-test_tpm2_auth_util.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_errata-test_tpm2_errata.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_eventlog-test_tpm2_eventlog.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_header-test_tpm2_header.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_policy-test_tpm2_policy.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_session-test_tpm2_session.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_util-test_tpm2_util.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_activatecredential.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_certify.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_certifycreation.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_changeauth.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_changeeps.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_changepps.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_clear.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_clearcontrol.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_clockrateadjust.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_commit.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_create.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_createak.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_createek.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_createpolicy.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_createprimary.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_dictionarylockout.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_duplicate.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_ecdhkeygen.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_ecdhzgen.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_ecephemeral.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_encryptdecrypt.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_evictcontrol.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_flushcontext.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_getcap.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_getcommandauditdigest.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_geteccparameters.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_getekcertificate.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_getpolicydigest.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_getrandom.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_getsessionauditdigest.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_gettestresult.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_gettime.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_hash.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_hierarchycontrol.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_hmac.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_import.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_incrementalselftest.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_load.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_loadexternal.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_makecredential.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvcertify.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvdefine.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvextend.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvincrement.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvread.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvreadlock.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvreadpublic.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvsetbits.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvundefine.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvwrite.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvwritelock.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_pcrallocate.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_pcrevent.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_pcrextend.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_pcrread.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_pcrreset.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyauthorize.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyauthorizenv.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyauthvalue.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policycommandcode.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policycountertimer.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policycphash.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyduplicationselect.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policylocality.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policynamehash.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policynv.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policynvwritten.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyor.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policypassword.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policypcr.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyrestart.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policysecret.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policysigned.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policytemplate.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyticket.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_quote.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_readclock.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_readpublic.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_rsadecrypt.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_rsaencrypt.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_selftest.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_send.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_sessionconfig.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_setclock.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_setcommandauditstatus.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_setprimarypolicy.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_shutdown.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_sign.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_startauthsession.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_startup.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_stirrandom.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_testparms.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_tool.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_unseal.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_verifysignature.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_zgen2phase.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_authorizepolicy.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_changeauth.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_createkey.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_createnv.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_createseal.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_decrypt.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_delete.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_encrypt.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_exportkey.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_exportpolicy.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_getappdata.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_getcertificate.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_getdescription.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_getinfo.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_getplatformcertificates.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_getrandom.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_gettpm2object.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_gettpmblobs.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_import.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_list.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_nvextend.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_nvincrement.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_nvread.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_nvsetbits.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_nvwrite.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_pcrextend.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_pcrread.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_provision.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_quote.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_setappdata.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_setcertificate.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_setdescription.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_sign.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_template.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_unseal.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_verifyquote.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_verifysignature.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_writeauthorizenv.Po
+	-rm -f tools/misc/$(DEPDIR)/tpm2-tpm2_certifyX509certutil.Po
+	-rm -f tools/misc/$(DEPDIR)/tpm2-tpm2_checkquote.Po
+	-rm -f tools/misc/$(DEPDIR)/tpm2-tpm2_encodeobject.Po
+	-rm -f tools/misc/$(DEPDIR)/tpm2-tpm2_eventlog.Po
+	-rm -f tools/misc/$(DEPDIR)/tpm2-tpm2_print.Po
+	-rm -f tools/misc/$(DEPDIR)/tpm2-tpm2_rc_decode.Po
 	-rm -f Makefile
 distclean-am: clean-am distclean-compile distclean-generic \
 	distclean-hdr distclean-libtool distclean-local distclean-tags
@@ -5595,7 +6124,189 @@
 maintainer-clean: maintainer-clean-am
 	-rm -f $(am__CONFIG_DISTCLEAN_FILES)
 	-rm -rf $(top_srcdir)/autom4te.cache
-	-rm -rf lib/$(DEPDIR) test/unit/$(DEPDIR) tools/$(DEPDIR) tools/fapi/$(DEPDIR) tools/misc/$(DEPDIR)
+		-rm -f lib/$(DEPDIR)/libcommon_a-files.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-log.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-object.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-pcr.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tool_rc.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_alg_util.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_attr_util.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_auth_util.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_capability.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_cc_util.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_convert.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_ctx_mgmt.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_errata.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_eventlog.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_eventlog_yaml.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_hash.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_hierarchy.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_identity_util.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_kdfa.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_kdfe.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_openssl.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_options.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_policy.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_session.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_tool_output.Po
+	-rm -f lib/$(DEPDIR)/libcommon_a-tpm2_util.Po
+	-rm -f test/unit/$(DEPDIR)/test_cc_util-test_cc_util.Po
+	-rm -f test/unit/$(DEPDIR)/test_files-test_files.Po
+	-rm -f test/unit/$(DEPDIR)/test_object-test_object.Po
+	-rm -f test/unit/$(DEPDIR)/test_options-test_options.Po
+	-rm -f test/unit/$(DEPDIR)/test_pcr-test_pcr.Po
+	-rm -f test/unit/$(DEPDIR)/test_string_bytes-test_string_bytes.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_alg_util-test_tpm2_alg_util.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_attr_util-test_tpm2_attr_util.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_auth_util-test_tpm2_auth_util.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_errata-test_tpm2_errata.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_eventlog-test_tpm2_eventlog.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_eventlog_yaml-test_tpm2_eventlog_yaml.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_header-test_tpm2_header.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_policy-test_tpm2_policy.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_session-test_tpm2_session.Po
+	-rm -f test/unit/$(DEPDIR)/test_tpm2_util-test_tpm2_util.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_activatecredential.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_certify.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_certifycreation.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_changeauth.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_changeeps.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_changepps.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_clear.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_clearcontrol.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_clockrateadjust.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_commit.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_create.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_createak.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_createek.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_createpolicy.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_createprimary.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_dictionarylockout.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_duplicate.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_ecdhkeygen.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_ecdhzgen.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_ecephemeral.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_encryptdecrypt.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_evictcontrol.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_flushcontext.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_getcap.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_getcommandauditdigest.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_geteccparameters.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_getekcertificate.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_getpolicydigest.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_getrandom.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_getsessionauditdigest.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_gettestresult.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_gettime.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_hash.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_hierarchycontrol.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_hmac.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_import.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_incrementalselftest.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_load.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_loadexternal.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_makecredential.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvcertify.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvdefine.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvextend.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvincrement.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvread.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvreadlock.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvreadpublic.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvsetbits.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvundefine.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvwrite.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_nvwritelock.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_pcrallocate.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_pcrevent.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_pcrextend.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_pcrread.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_pcrreset.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyauthorize.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyauthorizenv.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyauthvalue.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policycommandcode.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policycountertimer.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policycphash.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyduplicationselect.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policylocality.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policynamehash.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policynv.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policynvwritten.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyor.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policypassword.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policypcr.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyrestart.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policysecret.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policysigned.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policytemplate.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_policyticket.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_quote.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_readclock.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_readpublic.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_rsadecrypt.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_rsaencrypt.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_selftest.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_send.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_sessionconfig.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_setclock.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_setcommandauditstatus.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_setprimarypolicy.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_shutdown.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_sign.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_startauthsession.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_startup.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_stirrandom.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_testparms.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_tool.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_unseal.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_verifysignature.Po
+	-rm -f tools/$(DEPDIR)/tpm2-tpm2_zgen2phase.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_authorizepolicy.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_changeauth.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_createkey.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_createnv.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_createseal.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_decrypt.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_delete.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_encrypt.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_exportkey.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_exportpolicy.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_getappdata.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_getcertificate.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_getdescription.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_getinfo.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_getplatformcertificates.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_getrandom.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_gettpm2object.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_gettpmblobs.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_import.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_list.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_nvextend.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_nvincrement.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_nvread.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_nvsetbits.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_nvwrite.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_pcrextend.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_pcrread.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_provision.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_quote.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_setappdata.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_setcertificate.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_setdescription.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_sign.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_template.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_unseal.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_verifyquote.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_verifysignature.Po
+	-rm -f tools/fapi/$(DEPDIR)/tss2-tss2_writeauthorizenv.Po
+	-rm -f tools/misc/$(DEPDIR)/tpm2-tpm2_certifyX509certutil.Po
+	-rm -f tools/misc/$(DEPDIR)/tpm2-tpm2_checkquote.Po
+	-rm -f tools/misc/$(DEPDIR)/tpm2-tpm2_encodeobject.Po
+	-rm -f tools/misc/$(DEPDIR)/tpm2-tpm2_eventlog.Po
+	-rm -f tools/misc/$(DEPDIR)/tpm2-tpm2_print.Po
+	-rm -f tools/misc/$(DEPDIR)/tpm2-tpm2_rc_decode.Po
 	-rm -f Makefile
 maintainer-clean-am: distclean-am maintainer-clean-generic
 
@@ -5621,13 +6332,13 @@
 .MAKE: check-am install-am install-data-am install-exec-am \
 	install-strip uninstall-am
 
-.PHONY: CTAGS GTAGS TAGS all all-am am--refresh check check-TESTS \
-	check-am clean clean-binPROGRAMS clean-checkPROGRAMS \
-	clean-cscope clean-generic clean-libtool clean-local \
-	clean-noinstLIBRARIES cscope cscopelist-am ctags ctags-am dist \
-	dist-all dist-bzip2 dist-gzip dist-hook dist-lzip dist-shar \
-	dist-tarZ dist-xz dist-zip distcheck distclean \
-	distclean-compile distclean-generic distclean-hdr \
+.PHONY: CTAGS GTAGS TAGS all all-am am--depfiles am--refresh check \
+	check-TESTS check-am clean clean-binPROGRAMS \
+	clean-checkPROGRAMS clean-cscope clean-generic clean-libtool \
+	clean-local clean-noinstLIBRARIES cscope cscopelist-am ctags \
+	ctags-am dist dist-all dist-bzip2 dist-gzip dist-hook \
+	dist-lzip dist-shar dist-tarZ dist-xz dist-zip distcheck \
+	distclean distclean-compile distclean-generic distclean-hdr \
 	distclean-libtool distclean-local distclean-tags \
 	distcleancheck distdir distuninstallcheck dvi dvi-am html \
 	html-am info info-am install install-am install-binPROGRAMS \
@@ -5647,6 +6358,106 @@
 .PRECIOUS: Makefile
 
 
+# Code coverage
+#
+# Optional:
+#  - CODE_COVERAGE_DIRECTORY: Top-level directory for code coverage reporting.
+#    Multiple directories may be specified, separated by whitespace.
+#    (Default: $(top_builddir))
+#  - CODE_COVERAGE_OUTPUT_FILE: Filename and path for the .info file generated
+#    by lcov for code coverage. (Default:
+#    $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info)
+#  - CODE_COVERAGE_OUTPUT_DIRECTORY: Directory for generated code coverage
+#    reports to be created. (Default:
+#    $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage)
+#  - CODE_COVERAGE_BRANCH_COVERAGE: Set to 1 to enforce branch coverage,
+#    set to 0 to disable it and leave empty to stay with the default.
+#    (Default: empty)
+#  - CODE_COVERAGE_LCOV_SHOPTS_DEFAULT: Extra options shared between both lcov
+#    instances. (Default: based on )
+#  - CODE_COVERAGE_LCOV_SHOPTS: Extra options to shared between both lcov
+#    instances. (Default: )
+#  - CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH: --gcov-tool pathtogcov
+#  - CODE_COVERAGE_LCOV_OPTIONS_DEFAULT: Extra options to pass to the
+#    collecting lcov instance. (Default: )
+#  - CODE_COVERAGE_LCOV_OPTIONS: Extra options to pass to the collecting lcov
+#    instance. (Default: )
+#  - CODE_COVERAGE_LCOV_RMOPTS_DEFAULT: Extra options to pass to the filtering
+#    lcov instance. (Default: empty)
+#  - CODE_COVERAGE_LCOV_RMOPTS: Extra options to pass to the filtering lcov
+#    instance. (Default: )
+#  - CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT: Extra options to pass to the
+#    genhtml instance. (Default: based on )
+#  - CODE_COVERAGE_GENHTML_OPTIONS: Extra options to pass to the genhtml
+#    instance. (Default: )
+#  - CODE_COVERAGE_IGNORE_PATTERN: Extra glob pattern of files to ignore
+#
+# The generated report will be titled using the $(PACKAGE_NAME) and
+# $(PACKAGE_VERSION). In order to add the current git hash to the title,
+# use the git-version-gen script, available online.
+# Optional variables
+# run only on top dir
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@ ifeq ($(abs_builddir), $(abs_top_builddir))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_DIRECTORY ?= $(top_builddir)
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_OUTPUT_FILE ?= $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_OUTPUT_DIRECTORY ?= $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage
+
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_BRANCH_COVERAGE ?=
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_LCOV_SHOPTS_DEFAULT ?= $(if $(CODE_COVERAGE_BRANCH_COVERAGE),--rc lcov_branch_coverage=$(CODE_COVERAGE_BRANCH_COVERAGE))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_LCOV_SHOPTS ?= $(CODE_COVERAGE_LCOV_SHOPTS_DEFAULT)
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH ?= --gcov-tool "$(GCOV)"
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_LCOV_OPTIONS_DEFAULT ?= $(CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH)
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_LCOV_OPTIONS ?= $(CODE_COVERAGE_LCOV_OPTIONS_DEFAULT)
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_LCOV_RMOPTS_DEFAULT ?=
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_LCOV_RMOPTS ?= $(CODE_COVERAGE_LCOV_RMOPTS_DEFAULT)
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT ?=$(if $(CODE_COVERAGE_BRANCH_COVERAGE),--rc genhtml_branch_coverage=$(CODE_COVERAGE_BRANCH_COVERAGE))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_GENHTML_OPTIONS ?= $(CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT)
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@CODE_COVERAGE_IGNORE_PATTERN ?=
+
+# Use recursive makes in order to ignore errors during check
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@check-code-coverage:
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@	-$(AM_V_at)$(MAKE) $(AM_MAKEFLAGS) -k check
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@	$(AM_V_at)$(MAKE) $(AM_MAKEFLAGS) code-coverage-capture
+
+# Capture code coverage data
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code-coverage-capture: code-coverage-capture-hook
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@	$(code_coverage_v_lcov_cap)$(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --capture --output-file "$(CODE_COVERAGE_OUTPUT_FILE).tmp" --test-name "$(call code_coverage_sanitize,$(PACKAGE_NAME)-$(PACKAGE_VERSION))" --no-checksum --compat-libtool $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_OPTIONS)
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@	$(code_coverage_v_lcov_ign)$(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --remove "$(CODE_COVERAGE_OUTPUT_FILE).tmp" "/tmp/*" $(CODE_COVERAGE_IGNORE_PATTERN) --output-file "$(CODE_COVERAGE_OUTPUT_FILE)" $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_RMOPTS)
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@	-@rm -f "$(CODE_COVERAGE_OUTPUT_FILE).tmp"
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@	$(code_coverage_v_genhtml)LANG=C $(GENHTML) $(code_coverage_quiet) $(addprefix --prefix ,$(CODE_COVERAGE_DIRECTORY)) --output-directory "$(CODE_COVERAGE_OUTPUT_DIRECTORY)" --title "$(PACKAGE_NAME)-$(PACKAGE_VERSION) Code Coverage" --legend --show-details "$(CODE_COVERAGE_OUTPUT_FILE)" $(CODE_COVERAGE_GENHTML_OPTIONS)
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@	@echo "file://$(abs_builddir)/$(CODE_COVERAGE_OUTPUT_DIRECTORY)/index.html"
+
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code-coverage-clean:
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@	-$(LCOV) --directory $(top_builddir) -z
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@	-rm -rf "$(CODE_COVERAGE_OUTPUT_FILE)" "$(CODE_COVERAGE_OUTPUT_FILE).tmp" "$(CODE_COVERAGE_OUTPUT_DIRECTORY)"
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@	-find . $ -name "*.gcda" -o -name "*.gcno" -o -name "*.gcov" $ -delete
+
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code-coverage-dist-clean:
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@ else # ifneq ($(abs_builddir), $(abs_top_builddir))
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@check-code-coverage:
+
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code-coverage-capture: code-coverage-capture-hook
+
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code-coverage-clean:
+
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@code-coverage-dist-clean:
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_TRUE@ endif # ifeq ($(abs_builddir), $(abs_top_builddir))
+# Use recursive makes in order to ignore errors during check
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_FALSE@check-code-coverage:
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_FALSE@	@echo "Need to reconfigure with --enable-code-coverage"
+# Capture code coverage data
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_FALSE@code-coverage-capture: code-coverage-capture-hook
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_FALSE@	@echo "Need to reconfigure with --enable-code-coverage"
+
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_FALSE@code-coverage-clean:
+
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@@CODE_COVERAGE_ENABLED_FALSE@code-coverage-dist-clean:
+
+# Hook rule executed before code-coverage-capture, overridable by the user
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@code-coverage-capture-hook:
+
+@AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@.PHONY: check-code-coverage code-coverage-capture code-coverage-dist-clean code-coverage-clean code-coverage-capture-hook
+
 # ax_code_coverage
 @AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@clean-local: code-coverage-clean
 @AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE@distclean-local: code-coverage-dist-clean
@@ -5695,6 +6506,8 @@
 	    -e '/\nv attributes\/d' \
 	    -e '/\pcr bank specifiers\/r $(top_srcdir)/man/common/pcr.md' \
 	    -e '/\pcr bank specifiers\/d' \
+	    -e '/\PCR output file format specifiers\/r $(top_srcdir)/man/common/pcrs_format.md' \
+	    -e '/\PCR output file format specifiers\/d' \
 	    -e '/\pubkey options\/r $(top_srcdir)/man/common/pubkey.md' \
 	    -e '/\pubkey options\/d' \
 	    -e '/\signature format specifiers\/r $(top_srcdir)/man/common/signature.md' \

_service:tar_scm:tpm2-tools-5.4.tar.gz/VERSION Added

_service:tar_scm:tpm2-tools-5.0.tar.gz/aclocal.m4 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/aclocal.m4 Changed

@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.15.1 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.1 -*- Autoconf -*-
 
-# Copyright (C) 1996-2017 Free Software Foundation, Inc.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.
 
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -20,7 +20,7 @@
 If you have problems, you may need to regenerate the build system entirely.
 To do so, use the procedure documented by the package, typically 'autoreconf'.))
 
-# Copyright (C) 2002-2017 Free Software Foundation, Inc.
+# Copyright (C) 2002-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -32,10 +32,10 @@
 # generated from the m4 files accompanying Automake X.Y.
 # (This private macro should not be called outside this file.)
 AC_DEFUN(AM_AUTOMAKE_VERSION,
-am__api_version='1.15'
+am__api_version='1.16'
 dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to
 dnl require some minimum version.  Point them to the right macro.
-m4_if($1, 1.15.1, ,
+m4_if($1, 1.16.1, ,
       AC_FATAL(Do not call $0, use AM_INIT_AUTOMAKE($1).))dnl
 )
 
@@ -51,14 +51,14 @@
 # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced.
 # This function is AC_REQUIREd by AM_INIT_AUTOMAKE.
 AC_DEFUN(AM_SET_CURRENT_AUTOMAKE_VERSION,
-AM_AUTOMAKE_VERSION(1.15.1)dnl
+AM_AUTOMAKE_VERSION(1.16.1)dnl
 m4_ifndef(AC_AUTOCONF_VERSION,
   m4_copy(m4_PACKAGE_VERSION, AC_AUTOCONF_VERSION))dnl
 _AM_AUTOCONF_VERSION(m4_defn(AC_AUTOCONF_VERSION)))
 
 # AM_AUX_DIR_EXPAND                                         -*- Autoconf -*-
 
-# Copyright (C) 2001-2017 Free Software Foundation, Inc.
+# Copyright (C) 2001-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -110,7 +110,7 @@
 
 # AM_CONDITIONAL                                            -*- Autoconf -*-
 
-# Copyright (C) 1997-2017 Free Software Foundation, Inc.
+# Copyright (C) 1997-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -141,7 +141,7 @@
 Usually this means the macro was only invoked conditionally.)
 fi))
 
-# Copyright (C) 1999-2017 Free Software Foundation, Inc.
+# Copyright (C) 1999-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -332,13 +332,12 @@
 
 # Generate code to set up dependency tracking.              -*- Autoconf -*-
 
-# Copyright (C) 1999-2017 Free Software Foundation, Inc.
+# Copyright (C) 1999-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
 # with or without modifications, as long as this notice is preserved.
 
-
 # _AM_OUTPUT_DEPENDENCY_COMMANDS
 # ------------------------------
 AC_DEFUN(_AM_OUTPUT_DEPENDENCY_COMMANDS,
@@ -346,49 +345,41 @@
   # Older Autoconf quotes --file arguments for eval, but not when files
   # are listed without --file.  Let's play safe and only enable the eval
   # if we detect the quoting.
-  case $CONFIG_FILES in
-  *\'*) eval set x "$CONFIG_FILES" ;;
-  *)   set x $CONFIG_FILES ;;
-  esac
+  # TODO: see whether this extra hack can be removed once we start
+  # requiring Autoconf 2.70 or later.
+  AS_CASE($CONFIG_FILES,
+          *\'*, eval set x "$CONFIG_FILES",
+          *, set x $CONFIG_FILES)
   shift
-  for mf
+  # Used to flag and report bootstrapping failures.
+  am_rc=0
+  for am_mf
   do
     # Strip MF so we end up with the name of the file.
-    mf=`echo "$mf" | sed -e 's/:.*$//'`
-    # Check whether this is an Automake generated Makefile or not.
-    # We used to match only the files named 'Makefile.in', but
-    # some people rename them; so instead we look at the file content.
-    # Grep'ing the first line is not enough: some people post-process
-    # each Makefile.in and add a new line on top of each file to say so.
-    # Grep'ing the whole file is not good either: AIX grep has a line
+    am_mf=`AS_ECHO("$am_mf") | sed -e 's/:.*$//'`
+    # Check whether this is an Automake generated Makefile which includes
+    # dependency-tracking related rules and includes.
+    # Grep'ing the whole file directly is not great: AIX grep has a line
     # limit of 2048, but all sed's we know have understand at least 4000.
-    if sed -n 's,^#.*generated by automake.*,X,p' "$mf" | grep X >/dev/null 2>&1; then
-      dirpart=`AS_DIRNAME("$mf")`
-    else
-      continue
-    fi
-    # Extract the definition of DEPDIR, am__include, and am__quote
-    # from the Makefile without running 'make'.
-    DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`
-    test -z "$DEPDIR" && continue
-    am__include=`sed -n 's/^am__include = //p' < "$mf"`
-    test -z "$am__include" && continue
-    am__quote=`sed -n 's/^am__quote = //p' < "$mf"`
-    # Find all dependency output files, they are included files with
-    # $(DEPDIR) in their names.  We invoke sed twice because it is the
-    # simplest approach to changing $(DEPDIR) to its actual value in the
-    # expansion.
-    for file in `sed -n "
-      s/^$am__include $am__quote$.*(DEPDIR).*$$am__quote"'$/\1/p' <"$mf" | \
-	 sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g'`; do
-      # Make sure the directory exists.
-      test -f "$dirpart/$file" && continue
-      fdir=`AS_DIRNAME("$file")`
-      AS_MKDIR_P($dirpart/$fdir)
-      # echo "creating $dirpart/$file"
-      echo '# dummy' > "$dirpart/$file"
-    done
+    sed -n 's,^am--depfiles:.*,X,p' "$am_mf" | grep X >/dev/null 2>&1 \
+      || continue
+    am_dirpart=`AS_DIRNAME("$am_mf")`
+    am_filepart=`AS_BASENAME("$am_mf")`
+    AM_RUN_LOG(cd "$am_dirpart" \
+      && sed -e '/# am--include-marker/d' "$am_filepart" \
+        | $MAKE -f - am--depfiles) || am_rc=$?
   done
+  if test $am_rc -ne 0; then
+    AC_MSG_FAILURE(Something went wrong bootstrapping makefile fragments
+    for automatic dependency tracking.  Try re-running configure with the
+    '--disable-dependency-tracking' option to at least be able to build
+    the package (albeit without support for automatic dependency tracking).)
+  fi
+  AS_UNSET(am_dirpart)
+  AS_UNSET(am_filepart)
+  AS_UNSET(am_mf)
+  AS_UNSET(am_rc)
+  rm -f conftest-deps.mk
 }
 )# _AM_OUTPUT_DEPENDENCY_COMMANDS
 
@@ -397,18 +388,17 @@
 # -----------------------------
 # This macro should only be invoked once -- use via AC_REQUIRE.
 #
-# This code is only required when automatic dependency tracking
-# is enabled.  FIXME.  This creates each '.P' file that we will
-# need in order to bootstrap the dependency handling code.
+# This code is only required when automatic dependency tracking is enabled.
+# This creates each '.Po' and '.Plo' makefile fragment that we'll need in
+# order to bootstrap the dependency handling code.
 AC_DEFUN(AM_OUTPUT_DEPENDENCY_COMMANDS,
 AC_CONFIG_COMMANDS(depfiles,
      test x"$AMDEP_TRUE" != x"" || _AM_OUTPUT_DEPENDENCY_COMMANDS,
-     AMDEP_TRUE="$AMDEP_TRUE" ac_aux_dir="$ac_aux_dir")
-)
+     AMDEP_TRUE="$AMDEP_TRUE" MAKE="${MAKE-make}"))
 
 # Do all the work for Automake.                             -*- Autoconf -*-
 
-# Copyright (C) 1996-2017 Free Software Foundation, Inc.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -495,8 +485,8 @@
 AC_REQUIRE(AC_PROG_MKDIR_P)dnl
 # For better backward compatibility.  To be removed once Automake 1.9.x
 # dies out for good.  For more background, see:
-# <http://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
-# <http://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
+# <https://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
+# <https://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
 AC_SUBST(mkdir_p, '$(MKDIR_P)')
 # We need awk for the "check" target (and possibly the TAP driver).  The
 # system "awk" is bad on some platforms.
@@ -563,7 +553,7 @@
 Aborting the configuration process, to ensure you take notice of the issue.
 
 You can download and install GNU coreutils to get an 'rm' implementation
-that behaves properly: <http://www.gnu.org/software/coreutils/>.
+that behaves properly: <https://www.gnu.org/software/coreutils/>.
 
 If you want to complete the configuration process using your problematic
 'rm' anyway, export the environment variable ACCEPT_INFERIOR_RM_PROGRAM
@@ -605,7 +595,7 @@
 done
 echo "timestamp for $_am_arg" >`AS_DIRNAME("$_am_arg")`/stamp-h$_am_stamp_count)
 
-# Copyright (C) 2001-2017 Free Software Foundation, Inc.
+# Copyright (C) 2001-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -626,7 +616,7 @@
 fi
 AC_SUBST(install_sh))
 
-# Copyright (C) 2003-2017 Free Software Foundation, Inc.
+# Copyright (C) 2003-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -647,7 +637,7 @@
 
 # Check to see how 'make' treats includes.	            -*- Autoconf -*-
 
-# Copyright (C) 2001-2017 Free Software Foundation, Inc.
+# Copyright (C) 2001-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -655,49 +645,42 @@
 
 # AM_MAKE_INCLUDE()
 # -----------------
-# Check to see how make treats includes.
+# Check whether make has an 'include' directive that can support all
+# the idioms we need for our automatic dependency tracking code.
 AC_DEFUN(AM_MAKE_INCLUDE,
-am_make=${MAKE-make}
-cat > confinc << 'END'
+AC_MSG_CHECKING(whether ${MAKE-make} supports the include directive)
+cat > confinc.mk << 'END'
 am__doit:
-	@echo this is the am__doit target
+	@echo this is the am__doit target >confinc.out
 .PHONY: am__doit
 END
-# If we don't find an include directive, just comment out the code.
-AC_MSG_CHECKING(for style of include used by $am_make)
 am__include="#"
 am__quote=
-_am_result=none
-# First try GNU make style include.
-echo "include confinc" > confmf
-# Ignore all kinds of additional output from 'make'.
-case `$am_make -s -f confmf 2> /dev/null` in #(
-*the\ am__doit\ target*)
-  am__include=include
-  am__quote=
-  _am_result=GNU
-  ;;
-esac
-# Now try BSD make style include.
-if test "$am__include" = "#"; then
-   echo '.include "confinc"' > confmf
-   case `$am_make -s -f confmf 2> /dev/null` in #(
-   *the\ am__doit\ target*)
-     am__include=.include
-     am__quote="\""
-     _am_result=BSD
-     ;;
-   esac
-fi
-AC_SUBST(am__include)
-AC_SUBST(am__quote)
-AC_MSG_RESULT($_am_result)
-rm -f confinc confmf
-)
+# BSD make does it like this.
+echo '.include "confinc.mk" # ignored' > confmf.BSD
+# Other make implementations (GNU, Solaris 10, AIX) do it like this.
+echo 'include confinc.mk # ignored' > confmf.GNU
+_am_result=no
+for s in GNU BSD; do
+  AM_RUN_LOG(${MAKE-make} -f confmf.$s && cat confinc.out)
+  AS_CASE($?:`cat confinc.out 2>/dev/null`,
+      '0:this is the am__doit target',
+      AS_CASE($s,
+          BSD, am__include='.include' am__quote='"',
+          am__include='include' am__quote=''))
+  if test "$am__include" != "#"; then
+    _am_result="yes ($s style)"
+    break
+  fi
+done
+rm -f confinc.* confmf.*
+AC_MSG_RESULT(${_am_result})
+AC_SUBST(am__include))
+AC_SUBST(am__quote))
 
 # Fake the existence of programs that GNU maintainers use.  -*- Autoconf -*-
 
-# Copyright (C) 1997-2017 Free Software Foundation, Inc.
+# Copyright (C) 1997-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -736,7 +719,7 @@
 
 # Helper functions for option handling.                     -*- Autoconf -*-
 
-# Copyright (C) 2001-2017 Free Software Foundation, Inc.
+# Copyright (C) 2001-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -765,7 +748,7 @@
 AC_DEFUN(_AM_IF_OPTION,
 m4_ifset(_AM_MANGLE_OPTION($1), $2, $3))
 
-# Copyright (C) 1999-2017 Free Software Foundation, Inc.
+# Copyright (C) 1999-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -812,7 +795,245 @@
 # For backward compatibility.
 AC_DEFUN_ONCE(AM_PROG_CC_C_O, AC_REQUIRE(AC_PROG_CC))
 
-# Copyright (C) 2001-2017 Free Software Foundation, Inc.
+# Copyright (C) 1999-2018 Free Software Foundation, Inc.
+#
+# This file is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+
+# AM_PATH_PYTHON(MINIMUM-VERSION, ACTION-IF-FOUND, ACTION-IF-NOT-FOUND)
+# ---------------------------------------------------------------------------
+# Adds support for distributing Python modules and packages.  To
+# install modules, copy them to $(pythondir), using the python_PYTHON
+# automake variable.  To install a package with the same name as the
+# automake package, install to $(pkgpythondir), or use the
+# pkgpython_PYTHON automake variable.
+#
+# The variables $(pyexecdir) and $(pkgpyexecdir) are provided as
+# locations to install python extension modules (shared libraries).
+# Another macro is required to find the appropriate flags to compile
+# extension modules.
+#
+# If your package is configured with a different prefix to python,
+# users will have to add the install directory to the PYTHONPATH
+# environment variable, or create a .pth file (see the python
+# documentation for details).
+#
+# If the MINIMUM-VERSION argument is passed, AM_PATH_PYTHON will
+# cause an error if the version of python installed on the system
+# doesn't meet the requirement.  MINIMUM-VERSION should consist of
+# numbers and dots only.
+AC_DEFUN(AM_PATH_PYTHON,
+ 
+  dnl Find a Python interpreter.  Python versions prior to 2.0 are not
+  dnl supported. (2.0 was released on October 16, 2000).
+  m4_define_default(_AM_PYTHON_INTERPRETER_LIST,
+python python2 python3 dnl
+ python3.9 python3.8 python3.7 python3.6 python3.5 python3.4 python3.3 dnl
+ python3.2 python3.1 python3.0 dnl
+ python2.7 python2.6 python2.5 python2.4 python2.3 python2.2 python2.1 dnl
+ python2.0)
+
+  AC_ARG_VAR(PYTHON, the Python interpreter)
+
+  m4_if($1,,
+    dnl No version check is needed.
+    # Find any Python interpreter.
+    if test -z "$PYTHON"; then
+      AC_PATH_PROGS(PYTHON, _AM_PYTHON_INTERPRETER_LIST, :)
+    fi
+    am_display_PYTHON=python
+  , 
+    dnl A version check is needed.
+    if test -n "$PYTHON"; then
+      # If the user set $PYTHON, use it and don't search something else.
+      AC_MSG_CHECKING(whether $PYTHON version is >= $1)
+      AM_PYTHON_CHECK_VERSION($PYTHON, $1,
+			      AC_MSG_RESULT(yes),
+			      AC_MSG_RESULT(no)
+			       AC_MSG_ERROR(Python interpreter is too old))
+      am_display_PYTHON=$PYTHON
+    else
+      # Otherwise, try each interpreter until we find one that satisfies
+      # VERSION.
+      AC_CACHE_CHECK(for a Python interpreter with version >= $1,
+	am_cv_pathless_PYTHON,
+	for am_cv_pathless_PYTHON in _AM_PYTHON_INTERPRETER_LIST none; do
+	  test "$am_cv_pathless_PYTHON" = none && break
+	  AM_PYTHON_CHECK_VERSION($am_cv_pathless_PYTHON, $1, break)
+	done)
+      # Set $PYTHON to the absolute path of $am_cv_pathless_PYTHON.
+      if test "$am_cv_pathless_PYTHON" = none; then
+	PYTHON=:
+      else
+        AC_PATH_PROG(PYTHON, $am_cv_pathless_PYTHON)
+      fi
+      am_display_PYTHON=$am_cv_pathless_PYTHON
+    fi
+  )
+
+  if test "$PYTHON" = :; then
+  dnl Run any user-specified action, or abort.
+    m4_default($3, AC_MSG_ERROR(no suitable Python interpreter found))
+  else
+
+  dnl Query Python for its version number.  Getting :3 seems to be
+  dnl the best way to do this; it's what "site.py" does in the standard
+  dnl library.
+
+  AC_CACHE_CHECK(for $am_display_PYTHON version, am_cv_python_version,
+    am_cv_python_version=`$PYTHON -c "import sys; sys.stdout.write(sys.version:3)"`)
+  AC_SUBST(PYTHON_VERSION, $am_cv_python_version)
+
+  dnl Use the values of $prefix and $exec_prefix for the corresponding
+  dnl values of PYTHON_PREFIX and PYTHON_EXEC_PREFIX.  These are made
+  dnl distinct variables so they can be overridden if need be.  However,
+  dnl general consensus is that you shouldn't need this ability.
+
+  AC_SUBST(PYTHON_PREFIX, '${prefix}')
+  AC_SUBST(PYTHON_EXEC_PREFIX, '${exec_prefix}')
+
+  dnl At times (like when building shared libraries) you may want
+  dnl to know which OS platform Python thinks this is.
+
+  AC_CACHE_CHECK(for $am_display_PYTHON platform, am_cv_python_platform,
+    am_cv_python_platform=`$PYTHON -c "import sys; sys.stdout.write(sys.platform)"`)
+  AC_SUBST(PYTHON_PLATFORM, $am_cv_python_platform)
+
+  # Just factor out some code duplication.
+  am_python_setup_sysconfig="\
+import sys
+# Prefer sysconfig over distutils.sysconfig, for better compatibility
+# with python 3.x.  See automake bug#10227.
+try:
+    import sysconfig
+except ImportError:
+    can_use_sysconfig = 0
+else:
+    can_use_sysconfig = 1
+# Can't use sysconfig in CPython 2.7, since it's broken in virtualenvs:
+# <https://github.com/pypa/virtualenv/issues/118>
+try:
+    from platform import python_implementation
+    if python_implementation() == 'CPython' and sys.version:3 == '2.7':
+        can_use_sysconfig = 0
+except ImportError:
+    pass"
+
+  dnl Set up 4 directories:
+
+  dnl pythondir -- where to install python scripts.  This is the
+  dnl   site-packages directory, not the python standard library
+  dnl   directory like in previous automake betas.  This behavior
+  dnl   is more consistent with lispdir.m4 for example.
+  dnl Query distutils for this directory.
+  AC_CACHE_CHECK(for $am_display_PYTHON script directory,
+    am_cv_python_pythondir,
+    if test "x$prefix" = xNONE
+     then
+       am_py_prefix=$ac_default_prefix
+     else
+       am_py_prefix=$prefix
+     fi
+     am_cv_python_pythondir=`$PYTHON -c "
+$am_python_setup_sysconfig
+if can_use_sysconfig:
+    sitedir = sysconfig.get_path('purelib', vars={'base':'$am_py_prefix'})
+else:
+    from distutils import sysconfig
+    sitedir = sysconfig.get_python_lib(0, 0, prefix='$am_py_prefix')
+sys.stdout.write(sitedir)"`
+     case $am_cv_python_pythondir in
+     $am_py_prefix*)
+       am__strip_prefix=`echo "$am_py_prefix" | sed 's|.|.|g'`
+       am_cv_python_pythondir=`echo "$am_cv_python_pythondir" | sed "s,^$am__strip_prefix,$PYTHON_PREFIX,"`
+       ;;
+     *)
+       case $am_py_prefix in
+         /usr|/System*) ;;
+         *)
+	  am_cv_python_pythondir=$PYTHON_PREFIX/lib/python$PYTHON_VERSION/site-packages
+	  ;;
+       esac
+       ;;
+     esac
+    )
+  AC_SUBST(pythondir, $am_cv_python_pythondir)
+
+  dnl pkgpythondir -- $PACKAGE directory under pythondir.  Was
+  dnl   PYTHON_SITE_PACKAGE in previous betas, but this naming is
+  dnl   more consistent with the rest of automake.
+
+  AC_SUBST(pkgpythondir, \${pythondir}/$PACKAGE)
+
+  dnl pyexecdir -- directory for installing python extension modules
+  dnl   (shared libraries)
+  dnl Query distutils for this directory.
+  AC_CACHE_CHECK(for $am_display_PYTHON extension module directory,
+    am_cv_python_pyexecdir,
+    if test "x$exec_prefix" = xNONE
+     then
+       am_py_exec_prefix=$am_py_prefix
+     else
+       am_py_exec_prefix=$exec_prefix
+     fi
+     am_cv_python_pyexecdir=`$PYTHON -c "
+$am_python_setup_sysconfig
+if can_use_sysconfig:
+    sitedir = sysconfig.get_path('platlib', vars={'platbase':'$am_py_prefix'})
+else:
+    from distutils import sysconfig
+    sitedir = sysconfig.get_python_lib(1, 0, prefix='$am_py_prefix')
+sys.stdout.write(sitedir)"`
+     case $am_cv_python_pyexecdir in
+     $am_py_exec_prefix*)
+       am__strip_prefix=`echo "$am_py_exec_prefix" | sed 's|.|.|g'`
+       am_cv_python_pyexecdir=`echo "$am_cv_python_pyexecdir" | sed "s,^$am__strip_prefix,$PYTHON_EXEC_PREFIX,"`
+       ;;
+     *)
+       case $am_py_exec_prefix in
+         /usr|/System*) ;;
+         *)
+	   am_cv_python_pyexecdir=$PYTHON_EXEC_PREFIX/lib/python$PYTHON_VERSION/site-packages
+	   ;;
+       esac
+       ;;
+     esac
+    )
+  AC_SUBST(pyexecdir, $am_cv_python_pyexecdir)
+
+  dnl pkgpyexecdir -- $(pyexecdir)/$(PACKAGE)
+
+  AC_SUBST(pkgpyexecdir, \${pyexecdir}/$PACKAGE)
+
+  dnl Run any user-specified action.
+  $2
+  fi
+
+)
+
+
+# AM_PYTHON_CHECK_VERSION(PROG, VERSION, ACTION-IF-TRUE, ACTION-IF-FALSE)
+# ---------------------------------------------------------------------------
+# Run ACTION-IF-TRUE if the Python interpreter PROG has version >= VERSION.
+# Run ACTION-IF-FALSE otherwise.
+# This test uses sys.hexversion instead of the string equivalent (first
+# word of sys.version), in order to cope with versions such as 2.2c1.
+# This supports Python 2.0 or higher. (2.0 was released on October 16, 2000).
+AC_DEFUN(AM_PYTHON_CHECK_VERSION,
+ prog="import sys
+# split strings by '.' and convert to numeric.  Append some zeros
+# because we need at least 4 digits for the hex conversion.
+# map returns an iterator in Python 3.0 and a list in 2.x
+minver = list(map(int, '$2'.split('.'))) + 0, 0, 0
+minverhex = 0
+# xrange is not present in Python 3.0 and range returns an iterator
+for i in list(range(0, 4)): minverhex = (minverhex << 8) + minveri
+sys.exit(sys.hexversion < minverhex)"
+  AS_IF(AM_RUN_LOG($1 -c "$prog"), $3, $4))
+
+# Copyright (C) 2001-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -831,7 +1052,7 @@
 
 # Check to make sure that the build environment is sane.    -*- Autoconf -*-
 
-# Copyright (C) 1996-2017 Free Software Foundation, Inc.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -912,7 +1133,7 @@
 rm -f conftest.file
 )
 
-# Copyright (C) 2009-2017 Free Software Foundation, Inc.
+# Copyright (C) 2009-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -972,7 +1193,7 @@
 _AM_SUBST_NOTMAKE(AM_BACKSLASH)dnl
 )
 
-# Copyright (C) 2001-2017 Free Software Foundation, Inc.
+# Copyright (C) 2001-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1000,7 +1221,7 @@
 INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s"
 AC_SUBST(INSTALL_STRIP_PROGRAM))
 
-# Copyright (C) 2006-2017 Free Software Foundation, Inc.
+# Copyright (C) 2006-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1019,7 +1240,7 @@
 
 # Check how to create a tarball.                            -*- Autoconf -*-
 
-# Copyright (C) 2004-2017 Free Software Foundation, Inc.
+# Copyright (C) 2004-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1157,6 +1378,7 @@
 m4_include(m4/ax_am_macros_static.m4)
 m4_include(m4/ax_check_compile_flag.m4)
 m4_include(m4/ax_check_enable_debug.m4)
+m4_include(m4/ax_check_gnu_make.m4)
 m4_include(m4/ax_check_link_flag.m4)
 m4_include(m4/ax_code_coverage.m4)
 m4_include(m4/ax_file_escapes.m4)

_service:tar_scm:tpm2-tools-5.0.tar.gz/aminclude_static.am -> _service:tar_scm:tpm2-tools-5.4.tar.gz/aminclude_static.am Changed

@@ -1,4 +1,126 @@
 
 # aminclude_static.am generated automatically by Autoconf
-# from AX_AM_MACROS_STATIC on Mon Nov 16 11:15:23 MST 2020
+# from AX_AM_MACROS_STATIC on Mon Dec  5 10:02:13 CST 2022
 
+
+# Code coverage
+#
+# Optional:
+#  - CODE_COVERAGE_DIRECTORY: Top-level directory for code coverage reporting.
+#    Multiple directories may be specified, separated by whitespace.
+#    (Default: $(top_builddir))
+#  - CODE_COVERAGE_OUTPUT_FILE: Filename and path for the .info file generated
+#    by lcov for code coverage. (Default:
+#    $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info)
+#  - CODE_COVERAGE_OUTPUT_DIRECTORY: Directory for generated code coverage
+#    reports to be created. (Default:
+#    $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage)
+#  - CODE_COVERAGE_BRANCH_COVERAGE: Set to 1 to enforce branch coverage,
+#    set to 0 to disable it and leave empty to stay with the default.
+#    (Default: empty)
+#  - CODE_COVERAGE_LCOV_SHOPTS_DEFAULT: Extra options shared between both lcov
+#    instances. (Default: based on )
+#  - CODE_COVERAGE_LCOV_SHOPTS: Extra options to shared between both lcov
+#    instances. (Default: )
+#  - CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH: --gcov-tool pathtogcov
+#  - CODE_COVERAGE_LCOV_OPTIONS_DEFAULT: Extra options to pass to the
+#    collecting lcov instance. (Default: )
+#  - CODE_COVERAGE_LCOV_OPTIONS: Extra options to pass to the collecting lcov
+#    instance. (Default: )
+#  - CODE_COVERAGE_LCOV_RMOPTS_DEFAULT: Extra options to pass to the filtering
+#    lcov instance. (Default: empty)
+#  - CODE_COVERAGE_LCOV_RMOPTS: Extra options to pass to the filtering lcov
+#    instance. (Default: )
+#  - CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT: Extra options to pass to the
+#    genhtml instance. (Default: based on )
+#  - CODE_COVERAGE_GENHTML_OPTIONS: Extra options to pass to the genhtml
+#    instance. (Default: )
+#  - CODE_COVERAGE_IGNORE_PATTERN: Extra glob pattern of files to ignore
+#
+# The generated report will be titled using the $(PACKAGE_NAME) and
+# $(PACKAGE_VERSION). In order to add the current git hash to the title,
+# use the git-version-gen script, available online.
+# Optional variables
+# run only on top dir
+if CODE_COVERAGE_ENABLED
+ ifeq ($(abs_builddir), $(abs_top_builddir))
+CODE_COVERAGE_DIRECTORY ?= $(top_builddir)
+CODE_COVERAGE_OUTPUT_FILE ?= $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info
+CODE_COVERAGE_OUTPUT_DIRECTORY ?= $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage
+
+CODE_COVERAGE_BRANCH_COVERAGE ?=
+CODE_COVERAGE_LCOV_SHOPTS_DEFAULT ?= $(if $(CODE_COVERAGE_BRANCH_COVERAGE),--rc lcov_branch_coverage=$(CODE_COVERAGE_BRANCH_COVERAGE))
+CODE_COVERAGE_LCOV_SHOPTS ?= $(CODE_COVERAGE_LCOV_SHOPTS_DEFAULT)
+CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH ?= --gcov-tool "$(GCOV)"
+CODE_COVERAGE_LCOV_OPTIONS_DEFAULT ?= $(CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH)
+CODE_COVERAGE_LCOV_OPTIONS ?= $(CODE_COVERAGE_LCOV_OPTIONS_DEFAULT)
+CODE_COVERAGE_LCOV_RMOPTS_DEFAULT ?=
+CODE_COVERAGE_LCOV_RMOPTS ?= $(CODE_COVERAGE_LCOV_RMOPTS_DEFAULT)
+CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT ?=$(if $(CODE_COVERAGE_BRANCH_COVERAGE),--rc genhtml_branch_coverage=$(CODE_COVERAGE_BRANCH_COVERAGE))
+CODE_COVERAGE_GENHTML_OPTIONS ?= $(CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT)
+CODE_COVERAGE_IGNORE_PATTERN ?=
+
+GITIGNOREFILES = $(GITIGNOREFILES) $(CODE_COVERAGE_OUTPUT_FILE) $(CODE_COVERAGE_OUTPUT_DIRECTORY)
+code_coverage_v_lcov_cap = $(code_coverage_v_lcov_cap_$(V))
+code_coverage_v_lcov_cap_ = $(code_coverage_v_lcov_cap_$(AM_DEFAULT_VERBOSITY))
+code_coverage_v_lcov_cap_0 = @echo "  LCOV   --capture" $(CODE_COVERAGE_OUTPUT_FILE);
+code_coverage_v_lcov_ign = $(code_coverage_v_lcov_ign_$(V))
+code_coverage_v_lcov_ign_ = $(code_coverage_v_lcov_ign_$(AM_DEFAULT_VERBOSITY))
+code_coverage_v_lcov_ign_0 = @echo "  LCOV   --remove /tmp/*" $(CODE_COVERAGE_IGNORE_PATTERN);
+code_coverage_v_genhtml = $(code_coverage_v_genhtml_$(V))
+code_coverage_v_genhtml_ = $(code_coverage_v_genhtml_$(AM_DEFAULT_VERBOSITY))
+code_coverage_v_genhtml_0 = @echo "  GEN   " "$(CODE_COVERAGE_OUTPUT_DIRECTORY)";
+code_coverage_quiet = $(code_coverage_quiet_$(V))
+code_coverage_quiet_ = $(code_coverage_quiet_$(AM_DEFAULT_VERBOSITY))
+code_coverage_quiet_0 = --quiet
+
+# sanitizes the test-name: replaces with underscores: dashes and dots
+code_coverage_sanitize = $(subst -,_,$(subst .,_,$(1)))
+
+# Use recursive makes in order to ignore errors during check
+check-code-coverage:
+	-$(AM_V_at)$(MAKE) $(AM_MAKEFLAGS) -k check
+	$(AM_V_at)$(MAKE) $(AM_MAKEFLAGS) code-coverage-capture
+
+# Capture code coverage data
+code-coverage-capture: code-coverage-capture-hook
+	$(code_coverage_v_lcov_cap)$(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --capture --output-file "$(CODE_COVERAGE_OUTPUT_FILE).tmp" --test-name "$(call code_coverage_sanitize,$(PACKAGE_NAME)-$(PACKAGE_VERSION))" --no-checksum --compat-libtool $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_OPTIONS)
+	$(code_coverage_v_lcov_ign)$(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --remove "$(CODE_COVERAGE_OUTPUT_FILE).tmp" "/tmp/*" $(CODE_COVERAGE_IGNORE_PATTERN) --output-file "$(CODE_COVERAGE_OUTPUT_FILE)" $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_RMOPTS)
+	-@rm -f "$(CODE_COVERAGE_OUTPUT_FILE).tmp"
+	$(code_coverage_v_genhtml)LANG=C $(GENHTML) $(code_coverage_quiet) $(addprefix --prefix ,$(CODE_COVERAGE_DIRECTORY)) --output-directory "$(CODE_COVERAGE_OUTPUT_DIRECTORY)" --title "$(PACKAGE_NAME)-$(PACKAGE_VERSION) Code Coverage" --legend --show-details "$(CODE_COVERAGE_OUTPUT_FILE)" $(CODE_COVERAGE_GENHTML_OPTIONS)
+	@echo "file://$(abs_builddir)/$(CODE_COVERAGE_OUTPUT_DIRECTORY)/index.html"
+
+code-coverage-clean:
+	-$(LCOV) --directory $(top_builddir) -z
+	-rm -rf "$(CODE_COVERAGE_OUTPUT_FILE)" "$(CODE_COVERAGE_OUTPUT_FILE).tmp" "$(CODE_COVERAGE_OUTPUT_DIRECTORY)"
+	-find . $ -name "*.gcda" -o -name "*.gcno" -o -name "*.gcov" $ -delete
+
+code-coverage-dist-clean:
+
+AM_DISTCHECK_CONFIGURE_FLAGS = $(AM_DISTCHECK_CONFIGURE_FLAGS) --disable-code-coverage
+ else # ifneq ($(abs_builddir), $(abs_top_builddir))
+check-code-coverage:
+
+code-coverage-capture: code-coverage-capture-hook
+
+code-coverage-clean:
+
+code-coverage-dist-clean:
+ endif # ifeq ($(abs_builddir), $(abs_top_builddir))
+else #! CODE_COVERAGE_ENABLED
+# Use recursive makes in order to ignore errors during check
+check-code-coverage:
+	@echo "Need to reconfigure with --enable-code-coverage"
+# Capture code coverage data
+code-coverage-capture: code-coverage-capture-hook
+	@echo "Need to reconfigure with --enable-code-coverage"
+
+code-coverage-clean:
+
+code-coverage-dist-clean:
+
+endif #CODE_COVERAGE_ENABLED
+# Hook rule executed before code-coverage-capture, overridable by the user
+code-coverage-capture-hook:
+
+.PHONY: check-code-coverage code-coverage-capture code-coverage-dist-clean code-coverage-clean code-coverage-capture-hook

_service:tar_scm:tpm2-tools-5.0.tar.gz/bootstrap -> _service:tar_scm:tpm2-tools-5.4.tar.gz/bootstrap Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/compile -> _service:tar_scm:tpm2-tools-5.4.tar.gz/compile Changed

@@ -1,9 +1,9 @@
 #! /bin/sh
 # Wrapper for compilers which do not understand '-c -o'.
 
-scriptversion=2012-10-14.11; # UTC
+scriptversion=2018-03-07.03; # UTC
 
-# Copyright (C) 1999-2014 Free Software Foundation, Inc.
+# Copyright (C) 1999-2018 Free Software Foundation, Inc.
 # Written by Tom Tromey <tromey@cygnus.com>.
 #
 # This program is free software; you can redistribute it and/or modify
@@ -17,7 +17,7 @@
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -255,7 +255,8 @@
     echo "compile $scriptversion"
     exit $?
     ;;
-  cl | */\\cl | cl.exe | */\\cl.exe )
+  cl | */\\cl | cl.exe | */\\cl.exe | \
+  icl | */\\icl | icl.exe | */\\icl.exe )
     func_cl_wrapper "$@"      # Doesn't return...
     ;;
 esac
@@ -339,9 +340,9 @@
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
+# time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

_service:tar_scm:tpm2-tools-5.0.tar.gz/configure -> _service:tar_scm:tpm2-tools-5.4.tar.gz/configure Changed

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for tpm2-tools 5.0.
+# Generated by GNU Autoconf 2.69 for tpm2-tools 5.4.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
@@ -587,8 +587,8 @@
 # Identity of this package.
 PACKAGE_NAME='tpm2-tools'
 PACKAGE_TARNAME='tpm2-tools'
-PACKAGE_VERSION='5.0'
-PACKAGE_STRING='tpm2-tools 5.0'
+PACKAGE_VERSION='5.4'
+PACKAGE_STRING='tpm2-tools 5.4'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
@@ -635,15 +635,28 @@
 PATH
 EXTRA_LDFLAGS
 EXTRA_CFLAGS
+WC
 OPENSSL
 EXPECT
 MKTEMP
 SHASUM
 SS
 XXD
+pkgpyexecdir
+pyexecdir
+pkgpythondir
+pythondir
+PYTHON_PLATFORM
+PYTHON_EXEC_PREFIX
+PYTHON_PREFIX
+PYTHON_VERSION
 PYTHON
 BASH_SHELL
+TPM2_SIM
+HAS_TPM2_SIM
 tpm_server
+swtpm
+TPM2_ABRMD
 tpm2_abrmd
 CMOCKA_LIBS
 CMOCKA_CFLAGS
@@ -652,10 +665,11 @@
 UNIT_FALSE
 UNIT_TRUE
 LIBDL_LDFLAGS
+tpmsim
 bashcompdir
 with_bashcompdir
-UUID_LIBS
-UUID_CFLAGS
+EFIVAR_LIBS
+EFIVAR_CFLAGS
 CURL_LIBS
 CURL_CFLAGS
 CRYPTO_LIBS
@@ -668,12 +682,16 @@
 TSS2_MU_CFLAGS
 TSS2_TCTILDR_LIBS
 TSS2_TCTILDR_CFLAGS
+HAVE_ESYS_4_0_FALSE
+HAVE_ESYS_4_0_TRUE
 TSS2_ESYS_LIBS
 TSS2_ESYS_CFLAGS
 TSS2_ESYS_2_3_LIBS
 TSS2_ESYS_2_3_CFLAGS
 TSS2_ESYS_3_0_LIBS
 TSS2_ESYS_3_0_CFLAGS
+TSS2_ESYS_4_0_LIBS
+TSS2_ESYS_4_0_CFLAGS
 HAVE_FAPI_FALSE
 HAVE_FAPI_TRUE
 TSS2_FAPI_3_0_LIBS
@@ -690,8 +708,6 @@
 PANDOC
 AUTOCONF_CODE_COVERAGE_2019_01_06_FALSE
 AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE
-CODE_COVERAGE_RULES
-CODE_COVERAGE_LDFLAGS
 CODE_COVERAGE_LIBS
 CODE_COVERAGE_CXXFLAGS
 CODE_COVERAGE_CFLAGS
@@ -699,6 +715,8 @@
 GENHTML
 LCOV
 GCOV
+ifnGNUmake
+ifGNUmake
 CODE_COVERAGE_ENABLED
 CODE_COVERAGE_ENABLED_FALSE
 CODE_COVERAGE_ENABLED_TRUE
@@ -713,7 +731,6 @@
 AMDEPBACKSLASH
 AMDEP_FALSE
 AMDEP_TRUE
-am__quote
 am__include
 DEPDIR
 am__untar
@@ -815,7 +832,8 @@
 PACKAGE_TARNAME
 PACKAGE_NAME
 PATH_SEPARATOR
-SHELL'
+SHELL
+am__quote'
 ac_subst_files=''
 ac_user_opts='
 enable_option_checking
@@ -833,7 +851,9 @@
 with_gcov
 enable_code_coverage
 enable_fapi
+with_efivar
 with_bashcompdir
+with_tpmsim
 enable_unit
 enable_persistent
 enable_dlclose
@@ -856,6 +876,8 @@
 TSS2_FAPI_LIBS
 TSS2_FAPI_3_0_CFLAGS
 TSS2_FAPI_3_0_LIBS
+TSS2_ESYS_4_0_CFLAGS
+TSS2_ESYS_4_0_LIBS
 TSS2_ESYS_3_0_CFLAGS
 TSS2_ESYS_3_0_LIBS
 TSS2_ESYS_2_3_CFLAGS
@@ -872,11 +894,12 @@
 CRYPTO_LIBS
 CURL_CFLAGS
 CURL_LIBS
-UUID_CFLAGS
-UUID_LIBS
+EFIVAR_CFLAGS
+EFIVAR_LIBS
 with_bashcompdir
 CMOCKA_CFLAGS
-CMOCKA_LIBS'
+CMOCKA_LIBS
+PYTHON'
 
 
 # Initialize some variables set by options.
@@ -1427,7 +1450,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures tpm2-tools 5.0 to adapt to many kinds of systems.
+\`configure' configures tpm2-tools 5.4 to adapt to many kinds of systems.
 
 Usage: $0 OPTION... VAR=VALUE...
 
@@ -1498,7 +1521,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of tpm2-tools 5.0:";;
+     short | recursive ) echo "Configuration of tpm2-tools 5.4:";;
    esac
   cat <<\_ACEOF
 
@@ -1540,7 +1563,10 @@
   --with-sysroot=DIR    Search for dependent libraries within DIR (or the
                           compiler's sysroot if not specified).
   --with-gcov=GCOV        use given GCOV for coverage (GCOV=gcov).
+  --with-efivar           Build with lib efivar for pretty print of device
+                          path. Default auto detect
   --with-bashcompdir=DIR  directory for bash completions
+  --with-tpmsim=BIN       simulator used for testing
 
 Some influential environment variables:
   CC          C compiler command
@@ -1566,6 +1592,10 @@
               C compiler flags for TSS2_FAPI_3_0, overriding pkg-config
   TSS2_FAPI_3_0_LIBS
               linker flags for TSS2_FAPI_3_0, overriding pkg-config
+  TSS2_ESYS_4_0_CFLAGS
+              C compiler flags for TSS2_ESYS_4_0, overriding pkg-config
+  TSS2_ESYS_4_0_LIBS
+              linker flags for TSS2_ESYS_4_0, overriding pkg-config
   TSS2_ESYS_3_0_CFLAGS
               C compiler flags for TSS2_ESYS_3_0, overriding pkg-config
   TSS2_ESYS_3_0_LIBS
@@ -1595,14 +1625,16 @@
   CRYPTO_LIBS linker flags for CRYPTO, overriding pkg-config
   CURL_CFLAGS C compiler flags for CURL, overriding pkg-config
   CURL_LIBS   linker flags for CURL, overriding pkg-config
-  UUID_CFLAGS C compiler flags for UUID, overriding pkg-config
-  UUID_LIBS   linker flags for UUID, overriding pkg-config
+  EFIVAR_CFLAGS
+              C compiler flags for EFIVAR, overriding pkg-config
+  EFIVAR_LIBS linker flags for EFIVAR, overriding pkg-config
   with_bashcompdir
               value of completionsdir for bash-completion, overriding
               pkg-config
   CMOCKA_CFLAGS
               C compiler flags for CMOCKA, overriding pkg-config
   CMOCKA_LIBS linker flags for CMOCKA, overriding pkg-config
+  PYTHON      the Python interpreter
 
 Use these variables to override the choices made by `configure' or to help
 it to find libraries and programs with nonstandard names/locations.
@@ -1670,7 +1702,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-tpm2-tools configure 5.0
+tpm2-tools configure 5.4
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -1948,7 +1980,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by tpm2-tools $as_me 5.0, which was
+It was created by tpm2-tools $as_me 5.4, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2401,7 +2433,7 @@
 
 else
 
-$as_echo "#define NDEBUG /**/" >>confdefs.h
+$as_echo "#define NDEBUG 1" >>confdefs.h
 
 fi
     ax_enable_debug=$enable_debug
@@ -4959,7 +4991,7 @@
 fi
 
 : ${AR=ar}
-: ${AR_FLAGS=cru}
+: ${AR_FLAGS=cr}
 
 
 
@@ -5502,11 +5534,8 @@
   test $ac_status = 0; }; then
     # Now try to grab the symbols.
     nlist=conftest.nm
-    if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist\""; } >&5
-  (eval $NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) 2>&5
-  ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; } && test -s "$nlist"; then
+    $ECHO "$as_me:$LINENO: $NM conftest.$ac_objext | $lt_cv_sys_global_symbol_pipe > $nlist" >&5
+    if eval "$NM" conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist 2>&5 && test -s "$nlist"; then
       # Try sorting and uniquifying the output.
       if sort "$nlist" | uniq > "$nlist"T; then
 	mv -f "$nlist"T "$nlist"
@@ -6725,8 +6754,8 @@
 _LT_EOF
       echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&5
       $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&5
-      echo "$AR cru libconftest.a conftest.o" >&5
-      $AR cru libconftest.a conftest.o 2>&5
+      echo "$AR cr libconftest.a conftest.o" >&5
+      $AR cr libconftest.a conftest.o 2>&5
       echo "$RANLIB libconftest.a" >&5
       $RANLIB libconftest.a 2>&5
       cat > conftest.c << _LT_EOF
@@ -7855,6 +7884,12 @@
 	lt_prog_compiler_pic='-KPIC'
 	lt_prog_compiler_static='-static'
         ;;
+      # flang / f18. f95 an alias for gfortran or flang on Debian
+      flang* | f18* | f95*)
+	lt_prog_compiler_wl='-Wl,'
+	lt_prog_compiler_pic='-fPIC'
+	lt_prog_compiler_static='-static'
+        ;;
       # icc used to be incompatible with GCC.
       # ICC 10 doesn't accept -KPIC any more.
       icc* | ifort*)
@@ -11414,7 +11449,7 @@
 # Only expand once:
 
 
-am__api_version='1.15'
+am__api_version='1.16'
 
 # Find a good install program.  We prefer a C program (faster),
 # so one script is as good as another.  But avoid the broken or
@@ -11798,45 +11833,45 @@
 
 ac_config_commands="$ac_config_commands depfiles"
 
-
-am_make=${MAKE-make}
-cat > confinc << 'END'
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} supports the include directive" >&5
+$as_echo_n "checking whether ${MAKE-make} supports the include directive... " >&6; }
+cat > confinc.mk << 'END'
 am__doit:
-	@echo this is the am__doit target
+	@echo this is the am__doit target >confinc.out
 .PHONY: am__doit
 END
-# If we don't find an include directive, just comment out the code.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for style of include used by $am_make" >&5
-$as_echo_n "checking for style of include used by $am_make... " >&6; }
 am__include="#"
 am__quote=
-_am_result=none
-# First try GNU make style include.
-echo "include confinc" > confmf
-# Ignore all kinds of additional output from 'make'.
-case `$am_make -s -f confmf 2> /dev/null` in #(
-*the\ am__doit\ target*)
-  am__include=include
-  am__quote=
-  _am_result=GNU
-  ;;
-esac
-# Now try BSD make style include.
-if test "$am__include" = "#"; then
-   echo '.include "confinc"' > confmf
-   case `$am_make -s -f confmf 2> /dev/null` in #(
-   *the\ am__doit\ target*)
-     am__include=.include
-     am__quote="\""
-     _am_result=BSD
+# BSD make does it like this.
+echo '.include "confinc.mk" # ignored' > confmf.BSD
+# Other make implementations (GNU, Solaris 10, AIX) do it like this.
+echo 'include confinc.mk # ignored' > confmf.GNU
+_am_result=no
+for s in GNU BSD; do
+  { echo "$as_me:$LINENO: ${MAKE-make} -f confmf.$s && cat confinc.out" >&5
+   (${MAKE-make} -f confmf.$s && cat confinc.out) >&5 2>&5
+   ac_status=$?
+   echo "$as_me:$LINENO: \$? = $ac_status" >&5
+   (exit $ac_status); }
+  case $?:`cat confinc.out 2>/dev/null` in #(
+  '0:this is the am__doit target') :
+    case $s in #(
+  BSD) :
+    am__include='.include' am__quote='"' ;; #(
+  *) :
+    am__include='include' am__quote='' ;;
+esac ;; #(
+  *) :
      ;;
-   esac
-fi
-
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $_am_result" >&5
-$as_echo "$_am_result" >&6; }
-rm -f confinc confmf
+esac
+  if test "$am__include" != "#"; then
+    _am_result="yes ($s style)"
+    break
+  fi
+done
+rm -f confinc.* confmf.*
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: ${_am_result}" >&5
+$as_echo "${_am_result}" >&6; }
 
 # Check whether --enable-dependency-tracking was given.
 if test "${enable_dependency_tracking+set}" = set; then :
@@ -11918,7 +11953,7 @@
 
 # Define the identity of the package.
  PACKAGE='tpm2-tools'
- VERSION='5.0'
+ VERSION='5.4'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -11948,8 +11983,8 @@
 
 # For better backward compatibility.  To be removed once Automake 1.9.x
 # dies out for good.  For more background, see:
-# <http://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
-# <http://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
+# <https://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
+# <https://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
 mkdir_p='$(MKDIR_P)'
 
 # We need awk for the "check" target (and possibly the TAP driver).  The
@@ -12128,7 +12163,7 @@
 Aborting the configuration process, to ensure you take notice of the issue.
 
 You can download and install GNU coreutils to get an 'rm' implementation
-that behaves properly: <http://www.gnu.org/software/coreutils/>.
+that behaves properly: <https://www.gnu.org/software/coreutils/>.
 
 If you want to complete the configuration process using your problematic
 'rm' anyway, export the environment variable ACCEPT_INFERIOR_RM_PROGRAM
@@ -12182,6 +12217,17 @@
 
 
 
+
+
+
+
+
+
+
+
+
+
+
 	# allow to override gcov location
 
 # Check whether --with-gcov was given.
@@ -12202,7 +12248,7 @@
 fi
 
 
-	 if test x$enable_code_coverage = xyes; then
+	 if test "x$enable_code_coverage" = xyes; then
   CODE_COVERAGE_ENABLED_TRUE=
   CODE_COVERAGE_ENABLED_FALSE='#'
 else
@@ -12215,10 +12261,93 @@
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_code_coverage" >&5
 $as_echo "$enable_code_coverage" >&6; }
 
-	if  test "$enable_code_coverage" = "yes" ; then :
+	if  test "x$enable_code_coverage" = xyes ; then :
+
 
-		# check for gcov
-		if test -n "$ac_tool_prefix"; then
+	  for ac_prog in gawk mawk nawk awk
+do
+  # Extract the first word of "$ac_prog", so it can be a program name with args.
+set dummy $ac_prog; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_prog_AWK+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$AWK"; then
+  ac_cv_prog_AWK="$AWK" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    ac_cv_prog_AWK="$ac_prog"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+fi
+fi
+AWK=$ac_cv_prog_AWK
+if test -n "$AWK"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AWK" >&5
+$as_echo "$AWK" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+  test -n "$AWK" && break
+done
+
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU make" >&5
+$as_echo_n "checking for GNU make... " >&6; }
+if ${_cv_gnu_make_command+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+      _cv_gnu_make_command="" ;
+    for a in "$MAKE" make gmake gnumake ; do
+      if test -z "$a" ; then continue ; fi ;
+      if "$a" --version 2> /dev/null | grep GNU 2>&1 > /dev/null ; then
+        _cv_gnu_make_command=$a ;
+        AX_CHECK_GNU_MAKE_HEADLINE=$("$a" --version 2> /dev/null | grep "GNU Make")
+        ax_check_gnu_make_version=$(echo ${AX_CHECK_GNU_MAKE_HEADLINE} | ${AWK} -F " " '{ print $(NF); }')
+        break ;
+      fi
+    done ;
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $_cv_gnu_make_command" >&5
+$as_echo "$_cv_gnu_make_command" >&6; }
+  if test "x$_cv_gnu_make_command" = x""; then :
+  ifGNUmake="#"
+else
+  ifGNUmake=""
+fi
+  if test "x$_cv_gnu_make_command" = x""; then :
+  ifnGNUmake=""
+else
+  ifGNUmake="#"
+fi
+  if test "x$_cv_gnu_make_command" = x""; then :
+  { ax_cv_gnu_make_command=; unset ax_cv_gnu_make_command;}
+else
+  ax_cv_gnu_make_command=${_cv_gnu_make_command}
+fi
+  if test "x$_cv_gnu_make_command" = x""; then :
+  as_fn_error $? "not using GNU make that is needed for coverage" "$LINENO" 5
+fi
+
+
+
+
+	# check for gcov
+	if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}$_AX_CODE_COVERAGE_GCOV_PROG_WITH", so it can be a program name with args.
 set dummy ${ac_tool_prefix}$_AX_CODE_COVERAGE_GCOV_PROG_WITH; ac_word=$2
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
@@ -12310,18 +12439,18 @@
   GCOV="$ac_cv_prog_GCOV"
 fi
 
-		if test "X$GCOV" = "X:"; then :
+	if test "X$GCOV" = "X:"; then :
   as_fn_error $? "gcov is needed to do coverage" "$LINENO" 5
 fi
 
 
-				if  test "$GCC" = "no" ; then :
+		if  test "$GCC" = "no" ; then :
 
-			as_fn_error $? "not compiling with gcc, which is required for gcov code coverage" "$LINENO" 5
+		as_fn_error $? "not compiling with gcc, which is required for gcov code coverage" "$LINENO" 5
 
 fi
 
-		# Extract the first word of "lcov", so it can be a program name with args.
+	# Extract the first word of "lcov", so it can be a program name with args.
 set dummy lcov; ac_word=$2
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
 $as_echo_n "checking for $ac_word... " >&6; }
@@ -12358,7 +12487,7 @@
 fi
 
 
-		# Extract the first word of "genhtml", so it can be a program name with args.
+	# Extract the first word of "genhtml", so it can be a program name with args.
 set dummy genhtml; ac_word=$2
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
 $as_echo_n "checking for $ac_word... " >&6; }
@@ -12396,23 +12525,22 @@
 
 
 
-		if  test -z "$LCOV" ; then :
+	if  test x"$LCOV" = x ; then :
 
-			as_fn_error $? "To enable code coverage reporting you must have lcov installed" "$LINENO" 5
+		as_fn_error $? "To enable code coverage reporting you must have lcov installed" "$LINENO" 5
 
 fi
 
-		if  test -z "$GENHTML" ; then :
+	if  test x"$GENHTML" = x ; then :
 
-			as_fn_error $? "Could not find genhtml from the lcov package" "$LINENO" 5
+		as_fn_error $? "Could not find genhtml from the lcov package" "$LINENO" 5
 
 fi
 
-						CODE_COVERAGE_CPPFLAGS="-DNDEBUG"
-		CODE_COVERAGE_CFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
-		CODE_COVERAGE_CXXFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
-		CODE_COVERAGE_LIBS="-lgcov"
-		CODE_COVERAGE_LDFLAGS="$CODE_COVERAGE_LIBS"
+			CODE_COVERAGE_CPPFLAGS="-DNDEBUG"
+	CODE_COVERAGE_CFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
+	CODE_COVERAGE_CXXFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
+	CODE_COVERAGE_LIBS="-lgcov"
 
 
 
@@ -12420,136 +12548,19 @@
 
 
 
-		CODE_COVERAGE_RULES_CHECK='
-	-$(A''M_V_at)$(MAKE) $(AM_MAKEFLAGS) -k check
-	$(A''M_V_at)$(MAKE) $(AM_MAKEFLAGS) code-coverage-capture
-'
-		CODE_COVERAGE_RULES_CAPTURE='
-	$(code_coverage_v_lcov_cap)$(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --capture --output-file "$(CODE_COVERAGE_OUTPUT_FILE).tmp" --test-name "$(call code_coverage_sanitize,$(PACKAGE_NAME)-$(PACKAGE_VERSION))" --no-checksum --compat-libtool $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_OPTIONS)
-	$(code_coverage_v_lcov_ign)$(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --remove "$(CODE_COVERAGE_OUTPUT_FILE).tmp" "/tmp/*" $(CODE_COVERAGE_IGNORE_PATTERN) --output-file "$(CODE_COVERAGE_OUTPUT_FILE)" $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_RMOPTS)
-	-@rm -f $(CODE_COVERAGE_OUTPUT_FILE).tmp
-	$(code_coverage_v_genhtml)LANG=C $(GENHTML) $(code_coverage_quiet) $(addprefix --prefix ,$(CODE_COVERAGE_DIRECTORY)) --output-directory "$(CODE_COVERAGE_OUTPUT_DIRECTORY)" --title "$(PACKAGE_NAME)-$(PACKAGE_VERSION) Code Coverage" --legend --show-details "$(CODE_COVERAGE_OUTPUT_FILE)" $(CODE_COVERAGE_GENHTML_OPTIONS)
-	@echo "file://$(abs_builddir)/$(CODE_COVERAGE_OUTPUT_DIRECTORY)/index.html"
-'
-		CODE_COVERAGE_RULES_CLEAN='
-clean: code-coverage-clean
-distclean: code-coverage-clean
-code-coverage-clean:
-	-$(LCOV) --directory $(top_builddir) -z
-	-rm -rf $(CODE_COVERAGE_OUTPUT_FILE) $(CODE_COVERAGE_OUTPUT_FILE).tmp $(CODE_COVERAGE_OUTPUT_DIRECTORY)
-	-find . $ -name "*.gcda" -o -name "*.gcno" -o -name "*.gcov" $ -delete
-'
+fi
 
-else
 
-		CODE_COVERAGE_RULES_CHECK='
-	@echo "Need to reconfigure with --enable-code-coverage"
-'
-		CODE_COVERAGE_RULES_CAPTURE="$CODE_COVERAGE_RULES_CHECK"
-		CODE_COVERAGE_RULES_CLEAN=''
 
-fi
 
-CODE_COVERAGE_RULES='
-# Code coverage
-#
-# Optional:
-#  - CODE_COVERAGE_DIRECTORY: Top-level directory for code coverage reporting.
-#    Multiple directories may be specified, separated by whitespace.
-#    (Default: $(top_builddir))
-#  - CODE_COVERAGE_OUTPUT_FILE: Filename and path for the .info file generated
-#    by lcov for code coverage. (Default:
-#    $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info)
-#  - CODE_COVERAGE_OUTPUT_DIRECTORY: Directory for generated code coverage
-#    reports to be created. (Default:
-#    $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage)
-#  - CODE_COVERAGE_BRANCH_COVERAGE: Set to 1 to enforce branch coverage,
-#    set to 0 to disable it and leave empty to stay with the default.
-#    (Default: empty)
-#  - CODE_COVERAGE_LCOV_SHOPTS_DEFAULT: Extra options shared between both lcov
-#    instances. (Default: based on $CODE_COVERAGE_BRANCH_COVERAGE)
-#  - CODE_COVERAGE_LCOV_SHOPTS: Extra options to shared between both lcov
-#    instances. (Default: $CODE_COVERAGE_LCOV_SHOPTS_DEFAULT)
-#  - CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH: --gcov-tool pathtogcov
-#  - CODE_COVERAGE_LCOV_OPTIONS_DEFAULT: Extra options to pass to the
-#    collecting lcov instance. (Default: $CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH)
-#  - CODE_COVERAGE_LCOV_OPTIONS: Extra options to pass to the collecting lcov
-#    instance. (Default: $CODE_COVERAGE_LCOV_OPTIONS_DEFAULT)
-#  - CODE_COVERAGE_LCOV_RMOPTS_DEFAULT: Extra options to pass to the filtering
-#    lcov instance. (Default: empty)
-#  - CODE_COVERAGE_LCOV_RMOPTS: Extra options to pass to the filtering lcov
-#    instance. (Default: $CODE_COVERAGE_LCOV_RMOPTS_DEFAULT)
-#  - CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT: Extra options to pass to the
-#    genhtml instance. (Default: based on $CODE_COVERAGE_BRANCH_COVERAGE)
-#  - CODE_COVERAGE_GENHTML_OPTIONS: Extra options to pass to the genhtml
-#    instance. (Default: $CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT)
-#  - CODE_COVERAGE_IGNORE_PATTERN: Extra glob pattern of files to ignore
-#
-# The generated report will be titled using the $(PACKAGE_NAME) and
-# $(PACKAGE_VERSION). In order to add the current git hash to the title,
-# use the git-version-gen script, available online.
-
-# Optional variables
-CODE_COVERAGE_DIRECTORY ?= $(top_builddir)
-CODE_COVERAGE_OUTPUT_FILE ?= $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info
-CODE_COVERAGE_OUTPUT_DIRECTORY ?= $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage
-CODE_COVERAGE_BRANCH_COVERAGE ?=
-CODE_COVERAGE_LCOV_SHOPTS_DEFAULT ?= $(if $(CODE_COVERAGE_BRANCH_COVERAGE),\
---rc lcov_branch_coverage=$(CODE_COVERAGE_BRANCH_COVERAGE))
-CODE_COVERAGE_LCOV_SHOPTS ?= $(CODE_COVERAGE_LCOV_SHOPTS_DEFAULT)
-CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH ?= --gcov-tool "$(GCOV)"
-CODE_COVERAGE_LCOV_OPTIONS_DEFAULT ?= $(CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH)
-CODE_COVERAGE_LCOV_OPTIONS ?= $(CODE_COVERAGE_LCOV_OPTIONS_DEFAULT)
-CODE_COVERAGE_LCOV_RMOPTS_DEFAULT ?=
-CODE_COVERAGE_LCOV_RMOPTS ?= $(CODE_COVERAGE_LCOV_RMOPTS_DEFAULT)
-CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT ?=\
-$(if $(CODE_COVERAGE_BRANCH_COVERAGE),\
---rc genhtml_branch_coverage=$(CODE_COVERAGE_BRANCH_COVERAGE))
-CODE_COVERAGE_GENHTML_OPTIONS ?= $(CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT)
-CODE_COVERAGE_IGNORE_PATTERN ?=
-
-GITIGNOREFILES ?=
-GITIGNOREFILES += $(CODE_COVERAGE_OUTPUT_FILE) $(CODE_COVERAGE_OUTPUT_DIRECTORY)
-
-code_coverage_v_lcov_cap = $(code_coverage_v_lcov_cap_$(V))
-code_coverage_v_lcov_cap_ = $(code_coverage_v_lcov_cap_$(AM_DEFAULT_VERBOSITY))
-code_coverage_v_lcov_cap_0 = @echo "  LCOV   --capture"\
- $(CODE_COVERAGE_OUTPUT_FILE);
-code_coverage_v_lcov_ign = $(code_coverage_v_lcov_ign_$(V))
-code_coverage_v_lcov_ign_ = $(code_coverage_v_lcov_ign_$(AM_DEFAULT_VERBOSITY))
-code_coverage_v_lcov_ign_0 = @echo "  LCOV   --remove /tmp/*"\
- $(CODE_COVERAGE_IGNORE_PATTERN);
-code_coverage_v_genhtml = $(code_coverage_v_genhtml_$(V))
-code_coverage_v_genhtml_ = $(code_coverage_v_genhtml_$(AM_DEFAULT_VERBOSITY))
-code_coverage_v_genhtml_0 = @echo "  GEN   " $(CODE_COVERAGE_OUTPUT_DIRECTORY);
-code_coverage_quiet = $(code_coverage_quiet_$(V))
-code_coverage_quiet_ = $(code_coverage_quiet_$(AM_DEFAULT_VERBOSITY))
-code_coverage_quiet_0 = --quiet
-
-# sanitizes the test-name: replaces with underscores: dashes and dots
-code_coverage_sanitize = $(subst -,_,$(subst .,_,$(1)))
-
-# Use recursive makes in order to ignore errors during check
-check-code-coverage:'"$CODE_COVERAGE_RULES_CHECK"'
-
-# Capture code coverage data
-code-coverage-capture: code-coverage-capture-hook'"$CODE_COVERAGE_RULES_CAPTURE"'
-
-# Hook rule executed before code-coverage-capture, overridable by the user
-code-coverage-capture-hook:
 
-'"$CODE_COVERAGE_RULES_CLEAN"'
 
-A''M_DISTCHECK_CONFIGURE_FLAGS ?=
-A''M_DISTCHECK_CONFIGURE_FLAGS += --disable-code-coverage
 
-.PHONY: check-code-coverage code-coverage-capture code-coverage-capture-hook code-coverage-clean
-'
 
 
 
 
- if false; then
+ if true; then
   AUTOCONF_CODE_COVERAGE_2019_01_06_TRUE=
   AUTOCONF_CODE_COVERAGE_2019_01_06_FALSE='#'
 else
@@ -12564,11 +12575,6 @@
 
 
 
-
-
-
-
-
 ac_config_files="$ac_config_files Makefile"
 
 
@@ -12931,6 +12937,342 @@
 
 
 pkg_failed=no
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for TSS2_ESYS_4_0" >&5
+$as_echo_n "checking for TSS2_ESYS_4_0... " >&6; }
+
+if test -n "$TSS2_ESYS_4_0_CFLAGS"; then
+    pkg_cv_TSS2_ESYS_4_0_CFLAGS="$TSS2_ESYS_4_0_CFLAGS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"tss2-esys >= 4.0.0\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "tss2-esys >= 4.0.0") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_TSS2_ESYS_4_0_CFLAGS=`$PKG_CONFIG --cflags "tss2-esys >= 4.0.0" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+if test -n "$TSS2_ESYS_4_0_LIBS"; then
+    pkg_cv_TSS2_ESYS_4_0_LIBS="$TSS2_ESYS_4_0_LIBS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"tss2-esys >= 4.0.0\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "tss2-esys >= 4.0.0") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_TSS2_ESYS_4_0_LIBS=`$PKG_CONFIG --libs "tss2-esys >= 4.0.0" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+
+
+
+if test $pkg_failed = yes; then
+   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi
+        if test $_pkg_short_errors_supported = yes; then
+	        TSS2_ESYS_4_0_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "tss2-esys >= 4.0.0" 2>&1`
+        else
+	        TSS2_ESYS_4_0_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "tss2-esys >= 4.0.0" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$TSS2_ESYS_4_0_PKG_ERRORS" >&5
+
+
+pkg_failed=no
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for TSS2_ESYS_3_0" >&5
+$as_echo_n "checking for TSS2_ESYS_3_0... " >&6; }
+
+if test -n "$TSS2_ESYS_3_0_CFLAGS"; then
+    pkg_cv_TSS2_ESYS_3_0_CFLAGS="$TSS2_ESYS_3_0_CFLAGS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"tss2-esys >= 3.0.0\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "tss2-esys >= 3.0.0") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_TSS2_ESYS_3_0_CFLAGS=`$PKG_CONFIG --cflags "tss2-esys >= 3.0.0" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+if test -n "$TSS2_ESYS_3_0_LIBS"; then
+    pkg_cv_TSS2_ESYS_3_0_LIBS="$TSS2_ESYS_3_0_LIBS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"tss2-esys >= 3.0.0\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "tss2-esys >= 3.0.0") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_TSS2_ESYS_3_0_LIBS=`$PKG_CONFIG --libs "tss2-esys >= 3.0.0" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+
+
+
+if test $pkg_failed = yes; then
+   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi
+        if test $_pkg_short_errors_supported = yes; then
+	        TSS2_ESYS_3_0_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "tss2-esys >= 3.0.0" 2>&1`
+        else
+	        TSS2_ESYS_3_0_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "tss2-esys >= 3.0.0" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$TSS2_ESYS_3_0_PKG_ERRORS" >&5
+
+
+pkg_failed=no
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for TSS2_ESYS_2_3" >&5
+$as_echo_n "checking for TSS2_ESYS_2_3... " >&6; }
+
+if test -n "$TSS2_ESYS_2_3_CFLAGS"; then
+    pkg_cv_TSS2_ESYS_2_3_CFLAGS="$TSS2_ESYS_2_3_CFLAGS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"tss2-esys >= 2.4.0\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "tss2-esys >= 2.4.0") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_TSS2_ESYS_2_3_CFLAGS=`$PKG_CONFIG --cflags "tss2-esys >= 2.4.0" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+if test -n "$TSS2_ESYS_2_3_LIBS"; then
+    pkg_cv_TSS2_ESYS_2_3_LIBS="$TSS2_ESYS_2_3_LIBS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"tss2-esys >= 2.4.0\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "tss2-esys >= 2.4.0") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_TSS2_ESYS_2_3_LIBS=`$PKG_CONFIG --libs "tss2-esys >= 2.4.0" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+
+
+
+if test $pkg_failed = yes; then
+   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi
+        if test $_pkg_short_errors_supported = yes; then
+	        TSS2_ESYS_2_3_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "tss2-esys >= 2.4.0" 2>&1`
+        else
+	        TSS2_ESYS_2_3_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "tss2-esys >= 2.4.0" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$TSS2_ESYS_2_3_PKG_ERRORS" >&5
+
+	as_fn_error $? "Package requirements (tss2-esys >= 2.4.0) were not met:
+
+$TSS2_ESYS_2_3_PKG_ERRORS
+
+Consider adjusting the PKG_CONFIG_PATH environment variable if you
+installed software in a non-standard prefix.
+
+Alternatively, you may set the environment variables TSS2_ESYS_2_3_CFLAGS
+and TSS2_ESYS_2_3_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details." "$LINENO" 5
+elif test $pkg_failed = untried; then
+     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "The pkg-config script could not be found or is too old.  Make sure it
+is in your PATH or set the PKG_CONFIG environment variable to the full
+path to pkg-config.
+
+Alternatively, you may set the environment variables TSS2_ESYS_2_3_CFLAGS
+and TSS2_ESYS_2_3_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details.
+
+To get pkg-config, see <http://pkg-config.freedesktop.org/>.
+See \`config.log' for more details" "$LINENO" 5; }
+else
+	TSS2_ESYS_2_3_CFLAGS=$pkg_cv_TSS2_ESYS_2_3_CFLAGS
+	TSS2_ESYS_2_3_LIBS=$pkg_cv_TSS2_ESYS_2_3_LIBS
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+$as_echo "#define ESYS_2_3 1" >>confdefs.h
+
+            TSS2_ESYS_CFLAGS=$TSS2_ESYS_2_3_CFLAGS
+
+            TSS2_ESYS_LIBS=$TSS2_ESYS_2_3_LIBS
+
+
+fi
+
+elif test $pkg_failed = untried; then
+     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+pkg_failed=no
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for TSS2_ESYS_2_3" >&5
+$as_echo_n "checking for TSS2_ESYS_2_3... " >&6; }
+
+if test -n "$TSS2_ESYS_2_3_CFLAGS"; then
+    pkg_cv_TSS2_ESYS_2_3_CFLAGS="$TSS2_ESYS_2_3_CFLAGS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"tss2-esys >= 2.4.0\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "tss2-esys >= 2.4.0") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_TSS2_ESYS_2_3_CFLAGS=`$PKG_CONFIG --cflags "tss2-esys >= 2.4.0" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+if test -n "$TSS2_ESYS_2_3_LIBS"; then
+    pkg_cv_TSS2_ESYS_2_3_LIBS="$TSS2_ESYS_2_3_LIBS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"tss2-esys >= 2.4.0\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "tss2-esys >= 2.4.0") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_TSS2_ESYS_2_3_LIBS=`$PKG_CONFIG --libs "tss2-esys >= 2.4.0" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+
+
+
+if test $pkg_failed = yes; then
+   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi
+        if test $_pkg_short_errors_supported = yes; then
+	        TSS2_ESYS_2_3_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "tss2-esys >= 2.4.0" 2>&1`
+        else
+	        TSS2_ESYS_2_3_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "tss2-esys >= 2.4.0" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$TSS2_ESYS_2_3_PKG_ERRORS" >&5
+
+	as_fn_error $? "Package requirements (tss2-esys >= 2.4.0) were not met:
+
+$TSS2_ESYS_2_3_PKG_ERRORS
+
+Consider adjusting the PKG_CONFIG_PATH environment variable if you
+installed software in a non-standard prefix.
+
+Alternatively, you may set the environment variables TSS2_ESYS_2_3_CFLAGS
+and TSS2_ESYS_2_3_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details." "$LINENO" 5
+elif test $pkg_failed = untried; then
+     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "The pkg-config script could not be found or is too old.  Make sure it
+is in your PATH or set the PKG_CONFIG environment variable to the full
+path to pkg-config.
+
+Alternatively, you may set the environment variables TSS2_ESYS_2_3_CFLAGS
+and TSS2_ESYS_2_3_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details.
+
+To get pkg-config, see <http://pkg-config.freedesktop.org/>.
+See \`config.log' for more details" "$LINENO" 5; }
+else
+	TSS2_ESYS_2_3_CFLAGS=$pkg_cv_TSS2_ESYS_2_3_CFLAGS
+	TSS2_ESYS_2_3_LIBS=$pkg_cv_TSS2_ESYS_2_3_LIBS
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+$as_echo "#define ESYS_2_3 1" >>confdefs.h
+
+            TSS2_ESYS_CFLAGS=$TSS2_ESYS_2_3_CFLAGS
+
+            TSS2_ESYS_LIBS=$TSS2_ESYS_2_3_LIBS
+
+
+fi
+
+else
+	TSS2_ESYS_3_0_CFLAGS=$pkg_cv_TSS2_ESYS_3_0_CFLAGS
+	TSS2_ESYS_3_0_LIBS=$pkg_cv_TSS2_ESYS_3_0_LIBS
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+$as_echo "#define ESYS_3_0 1" >>confdefs.h
+
+        TSS2_ESYS_CFLAGS=$TSS2_ESYS_3_0_CFLAGS
+
+         TSS2_ESYS_LIBS=$TSS2_ESYS_3_0_LIBS
+
+fi
+
+elif test $pkg_failed = untried; then
+     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+pkg_failed=no
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for TSS2_ESYS_3_0" >&5
 $as_echo_n "checking for TSS2_ESYS_3_0... " >&6; }
 
@@ -13080,11 +13422,13 @@
 
 $as_echo "#define ESYS_2_3 1" >>confdefs.h
 
-                  TSS2_ESYS_CFLAGS=$TSS2_ESYS_2_3_CFLAGS
+            TSS2_ESYS_CFLAGS=$TSS2_ESYS_2_3_CFLAGS
+
+            TSS2_ESYS_LIBS=$TSS2_ESYS_2_3_LIBS
 
-                   TSS2_ESYS_LIBS=$TSS2_ESYS_2_3_LIBS
 
 fi
+
 elif test $pkg_failed = untried; then
      	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
@@ -13180,11 +13524,13 @@
 
 $as_echo "#define ESYS_2_3 1" >>confdefs.h
 
-                  TSS2_ESYS_CFLAGS=$TSS2_ESYS_2_3_CFLAGS
+            TSS2_ESYS_CFLAGS=$TSS2_ESYS_2_3_CFLAGS
+
+            TSS2_ESYS_LIBS=$TSS2_ESYS_2_3_LIBS
 
-                   TSS2_ESYS_LIBS=$TSS2_ESYS_2_3_LIBS
 
 fi
+
 else
 	TSS2_ESYS_3_0_CFLAGS=$pkg_cv_TSS2_ESYS_3_0_CFLAGS
 	TSS2_ESYS_3_0_LIBS=$pkg_cv_TSS2_ESYS_3_0_LIBS
@@ -13193,12 +13539,37 @@
 
 $as_echo "#define ESYS_3_0 1" >>confdefs.h
 
-                  TSS2_ESYS_CFLAGS=$TSS2_ESYS_3_0_CFLAGS
+        TSS2_ESYS_CFLAGS=$TSS2_ESYS_3_0_CFLAGS
 
-                   TSS2_ESYS_LIBS=$TSS2_ESYS_3_0_LIBS
+         TSS2_ESYS_LIBS=$TSS2_ESYS_3_0_LIBS
 
 fi
 
+else
+	TSS2_ESYS_4_0_CFLAGS=$pkg_cv_TSS2_ESYS_4_0_CFLAGS
+	TSS2_ESYS_4_0_LIBS=$pkg_cv_TSS2_ESYS_4_0_LIBS
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+$as_echo "#define ESYS_4_0 1" >>confdefs.h
+
+    TSS2_ESYS_CFLAGS=$TSS2_ESYS_4_0_CFLAGS
+
+     TSS2_ESYS_LIBS=$TSS2_ESYS_4_0_LIBS
+
+     have_esys_4_0="yes"
+fi
+
+ if test "x${have_esys_4_0}" = "xyes"; then
+  HAVE_ESYS_4_0_TRUE=
+  HAVE_ESYS_4_0_FALSE='#'
+else
+  HAVE_ESYS_4_0_TRUE='#'
+  HAVE_ESYS_4_0_FALSE=
+fi
+
+
+
 pkg_failed=no
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for TSS2_TCTILDR" >&5
 $as_echo_n "checking for TSS2_TCTILDR... " >&6; }
@@ -13571,12 +13942,12 @@
     pkg_cv_CRYPTO_CFLAGS="$CRYPTO_CFLAGS"
  elif test -n "$PKG_CONFIG"; then
     if test -n "$PKG_CONFIG" && \
-    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libcrypto >= 1.0.2g\""; } >&5
-  ($PKG_CONFIG --exists --print-errors "libcrypto >= 1.0.2g") 2>&5
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libcrypto >= 1.1.0\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "libcrypto >= 1.1.0") 2>&5
   ac_status=$?
   $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
-  pkg_cv_CRYPTO_CFLAGS=`$PKG_CONFIG --cflags "libcrypto >= 1.0.2g" 2>/dev/null`
+  pkg_cv_CRYPTO_CFLAGS=`$PKG_CONFIG --cflags "libcrypto >= 1.1.0" 2>/dev/null`
 		      test "x$?" != "x0" && pkg_failed=yes
 else
   pkg_failed=yes
@@ -13588,12 +13959,12 @@
     pkg_cv_CRYPTO_LIBS="$CRYPTO_LIBS"
  elif test -n "$PKG_CONFIG"; then
     if test -n "$PKG_CONFIG" && \
-    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libcrypto >= 1.0.2g\""; } >&5
-  ($PKG_CONFIG --exists --print-errors "libcrypto >= 1.0.2g") 2>&5
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libcrypto >= 1.1.0\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "libcrypto >= 1.1.0") 2>&5
   ac_status=$?
   $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
-  pkg_cv_CRYPTO_LIBS=`$PKG_CONFIG --libs "libcrypto >= 1.0.2g" 2>/dev/null`
+  pkg_cv_CRYPTO_LIBS=`$PKG_CONFIG --libs "libcrypto >= 1.1.0" 2>/dev/null`
 		      test "x$?" != "x0" && pkg_failed=yes
 else
   pkg_failed=yes
@@ -13614,14 +13985,14 @@
         _pkg_short_errors_supported=no
 fi
         if test $_pkg_short_errors_supported = yes; then
-	        CRYPTO_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libcrypto >= 1.0.2g" 2>&1`
+	        CRYPTO_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libcrypto >= 1.1.0" 2>&1`
         else
-	        CRYPTO_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libcrypto >= 1.0.2g" 2>&1`
+	        CRYPTO_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libcrypto >= 1.1.0" 2>&1`
         fi
 	# Put the nasty error message in config.log where it belongs
 	echo "$CRYPTO_PKG_ERRORS" >&5
 
-	as_fn_error $? "Package requirements (libcrypto >= 1.0.2g) were not met:
+	as_fn_error $? "Package requirements (libcrypto >= 1.1.0) were not met:
 
 $CRYPTO_PKG_ERRORS
 
@@ -13653,6 +14024,92 @@
 $as_echo "yes" >&6; }
 
 fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_sm3 in -lcrypto" >&5
+$as_echo_n "checking for EVP_sm3 in -lcrypto... " >&6; }
+if ${ac_cv_lib_crypto_EVP_sm3+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lcrypto  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char EVP_sm3 ();
+int
+main ()
+{
+return EVP_sm3 ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_lib_crypto_EVP_sm3=yes
+else
+  ac_cv_lib_crypto_EVP_sm3=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_EVP_sm3" >&5
+$as_echo "$ac_cv_lib_crypto_EVP_sm3" >&6; }
+if test "x$ac_cv_lib_crypto_EVP_sm3" = xyes; then :
+
+
+$as_echo "#define HAVE_EVP_SM3 1" >>confdefs.h
+
+fi
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_sm4_cfb128 in -lcrypto" >&5
+$as_echo_n "checking for EVP_sm4_cfb128 in -lcrypto... " >&6; }
+if ${ac_cv_lib_crypto_EVP_sm4_cfb128+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lcrypto  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char EVP_sm4_cfb128 ();
+int
+main ()
+{
+return EVP_sm4_cfb128 ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_lib_crypto_EVP_sm4_cfb128=yes
+else
+  ac_cv_lib_crypto_EVP_sm4_cfb128=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_EVP_sm4_cfb128" >&5
+$as_echo "$ac_cv_lib_crypto_EVP_sm4_cfb128" >&6; }
+if test "x$ac_cv_lib_crypto_EVP_sm4_cfb128" = xyes; then :
+
+
+$as_echo "#define HAVE_EVP_SM4_CFB 1" >>confdefs.h
+
+fi
+
 
 pkg_failed=no
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for CURL" >&5
@@ -13745,20 +14202,107 @@
 
 fi
 
+# pretty print of devicepath if efivar library is present
+# auto detect if not specified via the --with-efivar option.
+
+# Check whether --with-efivar was given.
+if test "${with_efivar+set}" = set; then :
+  withval=$with_efivar;
+else
+  with_efivar=auto
+
+fi
+
+
+# use the true program to avoid failing hard
+if test "x$with_efivar" == "xauto"; then :
+
+pkg_failed=no
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for EFIVAR" >&5
+$as_echo_n "checking for EFIVAR... " >&6; }
+
+if test -n "$EFIVAR_CFLAGS"; then
+    pkg_cv_EFIVAR_CFLAGS="$EFIVAR_CFLAGS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"efivar\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "efivar") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_EFIVAR_CFLAGS=`$PKG_CONFIG --cflags "efivar" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+if test -n "$EFIVAR_LIBS"; then
+    pkg_cv_EFIVAR_LIBS="$EFIVAR_LIBS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"efivar\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "efivar") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_EFIVAR_LIBS=`$PKG_CONFIG --libs "efivar" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+
+
+
+if test $pkg_failed = yes; then
+   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi
+        if test $_pkg_short_errors_supported = yes; then
+	        EFIVAR_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "efivar" 2>&1`
+        else
+	        EFIVAR_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "efivar" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$EFIVAR_PKG_ERRORS" >&5
+
+	true
+elif test $pkg_failed = untried; then
+     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+	true
+else
+	EFIVAR_CFLAGS=$pkg_cv_EFIVAR_CFLAGS
+	EFIVAR_LIBS=$pkg_cv_EFIVAR_LIBS
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+fi
+elif test "x$with_efivar" == "xyes"; then :
+
 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for UUID" >&5
-$as_echo_n "checking for UUID... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for EFIVAR" >&5
+$as_echo_n "checking for EFIVAR... " >&6; }
 
-if test -n "$UUID_CFLAGS"; then
-    pkg_cv_UUID_CFLAGS="$UUID_CFLAGS"
+if test -n "$EFIVAR_CFLAGS"; then
+    pkg_cv_EFIVAR_CFLAGS="$EFIVAR_CFLAGS"
  elif test -n "$PKG_CONFIG"; then
     if test -n "$PKG_CONFIG" && \
-    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"uuid\""; } >&5
-  ($PKG_CONFIG --exists --print-errors "uuid") 2>&5
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"efivar\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "efivar") 2>&5
   ac_status=$?
   $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
-  pkg_cv_UUID_CFLAGS=`$PKG_CONFIG --cflags "uuid" 2>/dev/null`
+  pkg_cv_EFIVAR_CFLAGS=`$PKG_CONFIG --cflags "efivar" 2>/dev/null`
 		      test "x$?" != "x0" && pkg_failed=yes
 else
   pkg_failed=yes
@@ -13766,16 +14310,16 @@
  else
     pkg_failed=untried
 fi
-if test -n "$UUID_LIBS"; then
-    pkg_cv_UUID_LIBS="$UUID_LIBS"
+if test -n "$EFIVAR_LIBS"; then
+    pkg_cv_EFIVAR_LIBS="$EFIVAR_LIBS"
  elif test -n "$PKG_CONFIG"; then
     if test -n "$PKG_CONFIG" && \
-    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"uuid\""; } >&5
-  ($PKG_CONFIG --exists --print-errors "uuid") 2>&5
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"efivar\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "efivar") 2>&5
   ac_status=$?
   $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
-  pkg_cv_UUID_LIBS=`$PKG_CONFIG --libs "uuid" 2>/dev/null`
+  pkg_cv_EFIVAR_LIBS=`$PKG_CONFIG --libs "efivar" 2>/dev/null`
 		      test "x$?" != "x0" && pkg_failed=yes
 else
   pkg_failed=yes
@@ -13796,22 +14340,22 @@
         _pkg_short_errors_supported=no
 fi
         if test $_pkg_short_errors_supported = yes; then
-	        UUID_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "uuid" 2>&1`
+	        EFIVAR_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "efivar" 2>&1`
         else
-	        UUID_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "uuid" 2>&1`
+	        EFIVAR_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "efivar" 2>&1`
         fi
 	# Put the nasty error message in config.log where it belongs
-	echo "$UUID_PKG_ERRORS" >&5
+	echo "$EFIVAR_PKG_ERRORS" >&5
 
-	as_fn_error $? "Package requirements (uuid) were not met:
+	as_fn_error $? "Package requirements (efivar) were not met:
 
-$UUID_PKG_ERRORS
+$EFIVAR_PKG_ERRORS
 
 Consider adjusting the PKG_CONFIG_PATH environment variable if you
 installed software in a non-standard prefix.
 
-Alternatively, you may set the environment variables UUID_CFLAGS
-and UUID_LIBS to avoid the need to call pkg-config.
+Alternatively, you may set the environment variables EFIVAR_CFLAGS
+and EFIVAR_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
      	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
@@ -13822,19 +14366,20 @@
 is in your PATH or set the PKG_CONFIG environment variable to the full
 path to pkg-config.
 
-Alternatively, you may set the environment variables UUID_CFLAGS
-and UUID_LIBS to avoid the need to call pkg-config.
+Alternatively, you may set the environment variables EFIVAR_CFLAGS
+and EFIVAR_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details.
 
 To get pkg-config, see <http://pkg-config.freedesktop.org/>.
 See \`config.log' for more details" "$LINENO" 5; }
 else
-	UUID_CFLAGS=$pkg_cv_UUID_CFLAGS
-	UUID_LIBS=$pkg_cv_UUID_LIBS
+	EFIVAR_CFLAGS=$pkg_cv_EFIVAR_CFLAGS
+	EFIVAR_LIBS=$pkg_cv_EFIVAR_LIBS
         { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
 
 fi
+fi
 
 # backwards compat with older pkg-config
 # - pull in AC_DEFUN from pkg.m4
@@ -13874,6 +14419,15 @@
 
 
 
+# Check whether --with-tpmsim was given.
+if test "${with_tpmsim+set}" = set; then :
+  withval=$with_tpmsim;
+fi
+
+tpmsim=$with_tpmsim
+
+
+
 
 # Check OS and set library and compile flags accordingly
 case "${host_os}" in
@@ -14062,11 +14616,55 @@
 fi
 
 
-    if test $tpm2_abrmd = no; then :
+    if test $tpm2_abrmd = yes; then :
+  TPM2_ABRMD=tpm2-abrmd
+else
   as_fn_error $? "Required executable tpm2_abrmd not found, try setting PATH" "$LINENO" 5
+
+fi
+
+
+	if test -z "$tpmsim"; then :
+
+        # Extract the first word of "swtpm", so it can be a program name with args.
+set dummy swtpm; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_prog_swtpm+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$swtpm"; then
+  ac_cv_prog_swtpm="$swtpm" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    ac_cv_prog_swtpm="yes"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+  test -z "$ac_cv_prog_swtpm" && ac_cv_prog_swtpm="no"
+fi
+fi
+swtpm=$ac_cv_prog_swtpm
+if test -n "$swtpm"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $swtpm" >&5
+$as_echo "$swtpm" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
 fi
 
-    # Extract the first word of "tpm_server", so it can be a program name with args.
+
+        # Extract the first word of "tpm_server", so it can be a program name with args.
 set dummy tpm_server; ac_word=$2
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
 $as_echo_n "checking for $ac_word... " >&6; }
@@ -14104,10 +14702,67 @@
 fi
 
 
-    if test $tpm_server = no; then :
-  as_fn_error $? "Required executable tpm_server not found, try setting PATH" "$LINENO" 5
+        if test $swtpm = yes; then :
+  TPM2_SIM=swtpm
+else
+  if test $tpm_server = yes; then :
+  TPM2_SIM=tpm_server
+else
+  as_fn_error $? "Required executables swtpm or tpm_server not found, try setting PATH" "$LINENO" 5
+fi
 fi
 
+else
+
+        # Extract the first word of "$tpmsim", so it can be a program name with args.
+set dummy $tpmsim; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_prog_HAS_TPM2_SIM+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$HAS_TPM2_SIM"; then
+  ac_cv_prog_HAS_TPM2_SIM="$HAS_TPM2_SIM" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    ac_cv_prog_HAS_TPM2_SIM="yes"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+  test -z "$ac_cv_prog_HAS_TPM2_SIM" && ac_cv_prog_HAS_TPM2_SIM="no"
+fi
+fi
+HAS_TPM2_SIM=$ac_cv_prog_HAS_TPM2_SIM
+if test -n "$HAS_TPM2_SIM"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAS_TPM2_SIM" >&5
+$as_echo "$HAS_TPM2_SIM" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+        if test "$HAS_TPM2_SIM" = yes; then :
+  TPM2_SIM=$tpmsim
+else
+  as_fn_error $? "Required executable $tpmsim not found, system tests require a tpm simulator shell!" "$LINENO" 5
+
+fi
+
+
+fi
+
+
     # Extract the first word of "bash", so it can be a program name with args.
 set dummy bash; ac_word=$2
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
@@ -14150,24 +14805,36 @@
   as_fn_error $? "Required executable bash not found, system tests require a bash shell!" "$LINENO" 5
 fi
 
-    # Extract the first word of "python", so it can be a program name with args.
-set dummy python; ac_word=$2
+
+
+
+
+
+
+        # Find any Python interpreter.
+    if test -z "$PYTHON"; then
+      for ac_prog in python python2 python3  python3.9 python3.8 python3.7 python3.6 python3.5 python3.4 python3.3  python3.2 python3.1 python3.0  python2.7 python2.6 python2.5 python2.4 python2.3 python2.2 python2.1  python2.0
+do
+  # Extract the first word of "$ac_prog", so it can be a program name with args.
+set dummy $ac_prog; ac_word=$2
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
 $as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_PYTHON+:} false; then :
+if ${ac_cv_path_PYTHON+:} false; then :
   $as_echo_n "(cached) " >&6
 else
-  if test -n "$PYTHON"; then
-  ac_cv_prog_PYTHON="$PYTHON" # Let the user override the test.
-else
-as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+  case $PYTHON in
+  \\/* | ?:\\/*)
+  ac_cv_path_PYTHON="$PYTHON" # Let the user override the test with a path.
+  ;;
+  *)
+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
   test -z "$as_dir" && as_dir=.
     for ac_exec_ext in '' $ac_executable_extensions; do
   if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_prog_PYTHON="yes"
+    ac_cv_path_PYTHON="$as_dir/$ac_word$ac_exec_ext"
     $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
     break 2
   fi
@@ -14175,10 +14842,10 @@
   done
 IFS=$as_save_IFS
 
-  test -z "$ac_cv_prog_PYTHON" && ac_cv_prog_PYTHON="no"
-fi
+  ;;
+esac
 fi
-PYTHON=$ac_cv_prog_PYTHON
+PYTHON=$ac_cv_path_PYTHON
 if test -n "$PYTHON"; then
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON" >&5
 $as_echo "$PYTHON" >&6; }
@@ -14188,13 +14855,168 @@
 fi
 
 
-    if test $PYTHON = no; then :
-  as_fn_error $? "Required executable python not found, some system tests will fail!" "$LINENO" 5
+  test -n "$PYTHON" && break
+done
+test -n "$PYTHON" || PYTHON=":"
+
+    fi
+    am_display_PYTHON=python
+
+
+  if test "$PYTHON" = :; then
+      as_fn_error $? "Required executable python not found, some system tests will fail!" "$LINENO" 5
+
+  else
+
+
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $am_display_PYTHON version" >&5
+$as_echo_n "checking for $am_display_PYTHON version... " >&6; }
+if ${am_cv_python_version+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  am_cv_python_version=`$PYTHON -c "import sys; sys.stdout.write(sys.version:3)"`
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_python_version" >&5
+$as_echo "$am_cv_python_version" >&6; }
+  PYTHON_VERSION=$am_cv_python_version
+
+
+
+  PYTHON_PREFIX='${prefix}'
+
+  PYTHON_EXEC_PREFIX='${exec_prefix}'
+
+
+
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $am_display_PYTHON platform" >&5
+$as_echo_n "checking for $am_display_PYTHON platform... " >&6; }
+if ${am_cv_python_platform+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  am_cv_python_platform=`$PYTHON -c "import sys; sys.stdout.write(sys.platform)"`
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_python_platform" >&5
+$as_echo "$am_cv_python_platform" >&6; }
+  PYTHON_PLATFORM=$am_cv_python_platform
+
+
+  # Just factor out some code duplication.
+  am_python_setup_sysconfig="\
+import sys
+# Prefer sysconfig over distutils.sysconfig, for better compatibility
+# with python 3.x.  See automake bug#10227.
+try:
+    import sysconfig
+except ImportError:
+    can_use_sysconfig = 0
+else:
+    can_use_sysconfig = 1
+# Can't use sysconfig in CPython 2.7, since it's broken in virtualenvs:
+# <https://github.com/pypa/virtualenv/issues/118>
+try:
+    from platform import python_implementation
+    if python_implementation() == 'CPython' and sys.version:3 == '2.7':
+        can_use_sysconfig = 0
+except ImportError:
+    pass"
+
+
+            { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $am_display_PYTHON script directory" >&5
+$as_echo_n "checking for $am_display_PYTHON script directory... " >&6; }
+if ${am_cv_python_pythondir+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test "x$prefix" = xNONE
+     then
+       am_py_prefix=$ac_default_prefix
+     else
+       am_py_prefix=$prefix
+     fi
+     am_cv_python_pythondir=`$PYTHON -c "
+$am_python_setup_sysconfig
+if can_use_sysconfig:
+    sitedir = sysconfig.get_path('purelib', vars={'base':'$am_py_prefix'})
+else:
+    from distutils import sysconfig
+    sitedir = sysconfig.get_python_lib(0, 0, prefix='$am_py_prefix')
+sys.stdout.write(sitedir)"`
+     case $am_cv_python_pythondir in
+     $am_py_prefix*)
+       am__strip_prefix=`echo "$am_py_prefix" | sed 's|.|.|g'`
+       am_cv_python_pythondir=`echo "$am_cv_python_pythondir" | sed "s,^$am__strip_prefix,$PYTHON_PREFIX,"`
+       ;;
+     *)
+       case $am_py_prefix in
+         /usr|/System*) ;;
+         *)
+	  am_cv_python_pythondir=$PYTHON_PREFIX/lib/python$PYTHON_VERSION/site-packages
+	  ;;
+       esac
+       ;;
+     esac
+
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_python_pythondir" >&5
+$as_echo "$am_cv_python_pythondir" >&6; }
+  pythondir=$am_cv_python_pythondir
+
+
+
+  pkgpythondir=\${pythondir}/$PACKAGE
+
+
+        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $am_display_PYTHON extension module directory" >&5
+$as_echo_n "checking for $am_display_PYTHON extension module directory... " >&6; }
+if ${am_cv_python_pyexecdir+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test "x$exec_prefix" = xNONE
+     then
+       am_py_exec_prefix=$am_py_prefix
+     else
+       am_py_exec_prefix=$exec_prefix
+     fi
+     am_cv_python_pyexecdir=`$PYTHON -c "
+$am_python_setup_sysconfig
+if can_use_sysconfig:
+    sitedir = sysconfig.get_path('platlib', vars={'platbase':'$am_py_prefix'})
+else:
+    from distutils import sysconfig
+    sitedir = sysconfig.get_python_lib(1, 0, prefix='$am_py_prefix')
+sys.stdout.write(sitedir)"`
+     case $am_cv_python_pyexecdir in
+     $am_py_exec_prefix*)
+       am__strip_prefix=`echo "$am_py_exec_prefix" | sed 's|.|.|g'`
+       am_cv_python_pyexecdir=`echo "$am_cv_python_pyexecdir" | sed "s,^$am__strip_prefix,$PYTHON_EXEC_PREFIX,"`
+       ;;
+     *)
+       case $am_py_exec_prefix in
+         /usr|/System*) ;;
+         *)
+	   am_cv_python_pyexecdir=$PYTHON_EXEC_PREFIX/lib/python$PYTHON_VERSION/site-packages
+	   ;;
+       esac
+       ;;
+     esac
+
 fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_python_pyexecdir" >&5
+$as_echo "$am_cv_python_pyexecdir" >&6; }
+  pyexecdir=$am_cv_python_pyexecdir
+
+
+
+  pkgpyexecdir=\${pyexecdir}/$PACKAGE
+
+
+
+  fi
+
 
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for module yaml in python" >&5
-$as_echo_n "checking for module yaml in python... " >&6; }
-  echo "import yaml" | python - 2>/dev/null
+
+    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for module yaml in $PYTHON" >&5
+$as_echo_n "checking for module yaml in $PYTHON... " >&6; }
+  echo "import yaml" | $PYTHON - 2>/dev/null
   if test $? -ne 0 ; then
     as_fn_error $? "not found" "$LINENO" 5
   else
@@ -14495,8 +15317,50 @@
   as_fn_error $? "Required executable openssl not found, some system tests will fail!" "$LINENO" 5
 fi
 
+    # Extract the first word of "wc", so it can be a program name with args.
+set dummy wc; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_prog_WC+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$WC"; then
+  ac_cv_prog_WC="$WC" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    ac_cv_prog_WC="yes"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+  test -z "$ac_cv_prog_WC" && ac_cv_prog_WC="no"
+fi
+fi
+WC=$ac_cv_prog_WC
+if test -n "$WC"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $WC" >&5
+$as_echo "$WC" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+    if test $WC = no; then :
+  as_fn_error $? "Required executable wc not found, some system tests will fail!" "$LINENO" 5
+fi
+
     unit_test_tool_report="- tpm2_abrmd: $tpm2_abrmd
-    - tpm_server: $tpm_server
+    - TPM simulator: $TPM2_SIM
     - bash: $BASH_SHELL
     - python: $PYTHON
     - xxd: $XXD
@@ -14613,6 +15477,7 @@
 fi
 
 
+  if test "x$ax_is_release" = "xno"; then :
 
     { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -Werror" >&5
 $as_echo_n "checking whether C compiler accepts -Werror... " >&6; }
@@ -14651,6 +15516,7 @@
 fi
 
 
+fi
 
 
     { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -Wformat" >&5
@@ -15203,6 +16069,46 @@
 
 
 
+# Enable gnu99 mode, since we use some of these features.
+
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -std=gnu99" >&5
+$as_echo_n "checking whether C compiler accepts -std=gnu99... " >&6; }
+if ${ax_cv_check_cflags___std_gnu99+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -std=gnu99"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  ax_cv_check_cflags___std_gnu99=yes
+else
+  ax_cv_check_cflags___std_gnu99=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___std_gnu99" >&5
+$as_echo "$ax_cv_check_cflags___std_gnu99" >&6; }
+if test "x$ax_cv_check_cflags___std_gnu99" = xyes; then :
+  EXTRA_CFLAGS="$EXTRA_CFLAGS -std=gnu99"
+else
+  as_fn_error $? "Cannot enable -std=gnu99" "$LINENO" 5
+
+fi
+
+
+
 # Best attempt compiler options that are on newer versions of GCC that
 # we can't widely enforce without killing other peoples builds.
 # Works with gcc only. Needs to be disabled on BSD and clang
@@ -15356,7 +16262,7 @@
 
 
 
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -Wbool-compare" >&5
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -Wbool-compare" >&5
 $as_echo_n "checking whether C compiler accepts -Wbool-compare... " >&6; }
 if ${ax_cv_check_cflags___Wbool_compare+:} false; then :
   $as_echo_n "(cached) " >&6
@@ -15388,8 +16294,7 @@
 if test "x$ax_cv_check_cflags___Wbool_compare" = xyes; then :
   EXTRA_CFLAGS="$EXTRA_CFLAGS -Wbool-compare"
 else
-  as_fn_error $? "Cannot enable -Wbool-compare, consider configuring with --disable-hardening" "$LINENO" 5
-
+  :
 fi
 
 
@@ -15672,6 +16577,10 @@
   as_fn_error $? "conditional \"HAVE_FAPI\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
 fi
+if test -z "${HAVE_ESYS_4_0_TRUE}" && test -z "${HAVE_ESYS_4_0_FALSE}"; then
+  as_fn_error $? "conditional \"HAVE_ESYS_4_0\" was never defined.
+Usually this means the macro was only invoked conditionally." "$LINENO" 5
+fi
 if test -z "${UNIT_TRUE}" && test -z "${UNIT_FALSE}"; then
   as_fn_error $? "conditional \"UNIT\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
@@ -16077,7 +16986,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by tpm2-tools $as_me 5.0, which was
+This file was extended by tpm2-tools $as_me 5.4, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -16143,7 +17052,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/\\""\`\$/\\\\&/g'`"
 ac_cs_version="\\
-tpm2-tools config.status 5.0
+tpm2-tools config.status 5.4
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
@@ -16545,7 +17454,7 @@
 
 
 
-AMDEP_TRUE="$AMDEP_TRUE" ac_aux_dir="$ac_aux_dir"
+AMDEP_TRUE="$AMDEP_TRUE" MAKE="${MAKE-make}"
 
 _ACEOF
 
@@ -17700,29 +18609,35 @@
   # Older Autoconf quotes --file arguments for eval, but not when files
   # are listed without --file.  Let's play safe and only enable the eval
   # if we detect the quoting.
-  case $CONFIG_FILES in
-  *\'*) eval set x "$CONFIG_FILES" ;;
-  *)   set x $CONFIG_FILES ;;
-  esac
+  # TODO: see whether this extra hack can be removed once we start
+  # requiring Autoconf 2.70 or later.
+  case $CONFIG_FILES in #(
+  *\'*) :
+    eval set x "$CONFIG_FILES" ;; #(
+  *) :
+    set x $CONFIG_FILES ;; #(
+  *) :
+     ;;
+esac
   shift
-  for mf
+  # Used to flag and report bootstrapping failures.
+  am_rc=0
+  for am_mf
   do
     # Strip MF so we end up with the name of the file.
-    mf=`echo "$mf" | sed -e 's/:.*$//'`
-    # Check whether this is an Automake generated Makefile or not.
-    # We used to match only the files named 'Makefile.in', but
-    # some people rename them; so instead we look at the file content.
-    # Grep'ing the first line is not enough: some people post-process
-    # each Makefile.in and add a new line on top of each file to say so.
-    # Grep'ing the whole file is not good either: AIX grep has a line
+    am_mf=`$as_echo "$am_mf" | sed -e 's/:.*$//'`
+    # Check whether this is an Automake generated Makefile which includes
+    # dependency-tracking related rules and includes.
+    # Grep'ing the whole file directly is not great: AIX grep has a line
     # limit of 2048, but all sed's we know have understand at least 4000.
-    if sed -n 's,^#.*generated by automake.*,X,p' "$mf" | grep X >/dev/null 2>&1; then
-      dirpart=`$as_dirname -- "$mf" ||
-$as_expr X"$mf" : 'X$.*^/$//*^/^/*/*$' \| \
-	 X"$mf" : 'X$//$^/' \| \
-	 X"$mf" : 'X$//$$' \| \
-	 X"$mf" : 'X$/$' \| . 2>/dev/null ||
-$as_echo X"$mf" |
+    sed -n 's,^am--depfiles:.*,X,p' "$am_mf" | grep X >/dev/null 2>&1 \
+      || continue
+    am_dirpart=`$as_dirname -- "$am_mf" ||
+$as_expr X"$am_mf" : 'X$.*^/$//*^/^/*/*$' \| \
+	 X"$am_mf" : 'X$//$^/' \| \
+	 X"$am_mf" : 'X$//$$' \| \
+	 X"$am_mf" : 'X$/$' \| . 2>/dev/null ||
+$as_echo X"$am_mf" |
     sed '/^X$.*^/$\/\/*^/^/*\/*$/{
 	    s//\1/
 	    q
@@ -17740,53 +18655,48 @@
 	    q
 	  }
 	  s/.*/./; q'`
-    else
-      continue
-    fi
-    # Extract the definition of DEPDIR, am__include, and am__quote
-    # from the Makefile without running 'make'.
-    DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`
-    test -z "$DEPDIR" && continue
-    am__include=`sed -n 's/^am__include = //p' < "$mf"`
-    test -z "$am__include" && continue
-    am__quote=`sed -n 's/^am__quote = //p' < "$mf"`
-    # Find all dependency output files, they are included files with
-    # $(DEPDIR) in their names.  We invoke sed twice because it is the
-    # simplest approach to changing $(DEPDIR) to its actual value in the
-    # expansion.
-    for file in `sed -n "
-      s/^$am__include $am__quote$.*(DEPDIR).*$$am__quote"'$/\1/p' <"$mf" | \
-	 sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g'`; do
-      # Make sure the directory exists.
-      test -f "$dirpart/$file" && continue
-      fdir=`$as_dirname -- "$file" ||
-$as_expr X"$file" : 'X$.*^/$//*^/^/*/*$' \| \
-	 X"$file" : 'X$//$^/' \| \
-	 X"$file" : 'X$//$$' \| \
-	 X"$file" : 'X$/$' \| . 2>/dev/null ||
-$as_echo X"$file" |
-    sed '/^X$.*^/$\/\/*^/^/*\/*$/{
-	    s//\1/
-	    q
-	  }
-	  /^X$\/\/$^/.*/{
+    am_filepart=`$as_basename -- "$am_mf" ||
+$as_expr X/"$am_mf" : '.*/$^/^/*$/*$' \| \
+	 X"$am_mf" : 'X$//$$' \| \
+	 X"$am_mf" : 'X$/$' \| . 2>/dev/null ||
+$as_echo X/"$am_mf" |
+    sed '/^.*\/$^/^/*$\/*$/{
 	    s//\1/
 	    q
 	  }
-	  /^X$\/\/$$/{
+	  /^X\/$\/\/$$/{
 	    s//\1/
 	    q
 	  }
-	  /^X$\/$.*/{
+	  /^X\/$\/$.*/{
 	    s//\1/
 	    q
 	  }
 	  s/.*/./; q'`
-      as_dir=$dirpart/$fdir; as_fn_mkdir_p
-      # echo "creating $dirpart/$file"
-      echo '# dummy' > "$dirpart/$file"
-    done
+    { echo "$as_me:$LINENO: cd "$am_dirpart" \
+      && sed -e '/# am--include-marker/d' "$am_filepart" \
+        | $MAKE -f - am--depfiles" >&5
+   (cd "$am_dirpart" \
+      && sed -e '/# am--include-marker/d' "$am_filepart" \
+        | $MAKE -f - am--depfiles) >&5 2>&5
+   ac_status=$?
+   echo "$as_me:$LINENO: \$? = $ac_status" >&5
+   (exit $ac_status); } || am_rc=$?
   done
+  if test $am_rc -ne 0; then
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "Something went wrong bootstrapping makefile fragments
+    for automatic dependency tracking.  Try re-running configure with the
+    '--disable-dependency-tracking' option to at least be able to build
+    the package (albeit without support for automatic dependency tracking).
+See \`config.log' for more details" "$LINENO" 5; }
+  fi
+  { am_dirpart=; unset am_dirpart;}
+  { am_filepart=; unset am_filepart;}
+  { am_mf=; unset am_mf;}
+  { am_rc=; unset am_rc;}
+  rm -f conftest-deps.mk
 }
  ;;

_service:tar_scm:tpm2-tools-5.0.tar.gz/configure.ac -> _service:tar_scm:tpm2-tools-5.4.tar.gz/configure.ac Changed

@@ -1,5 +1,5 @@
 AC_INIT(tpm2-tools,
-    m4_esyscmd_s(git describe --tags --always --dirty))
+    m4_esyscmd_s(cat ./VERSION))
 AC_CONFIG_MACRO_DIR(m4)
 
 AX_IS_RELEASE(dash-version)
@@ -46,21 +46,56 @@
       )
 AM_CONDITIONAL(HAVE_FAPI, test "$enable_fapi" = yes)
 
-PKG_CHECK_MODULES(TSS2_ESYS_3_0, tss2-esys >= 3.0.0,
-                  AC_DEFINE(ESYS_3_0, 1, Esys3.0)
-                  AC_SUBST(TSS2_ESYS_CFLAGS, $TSS2_ESYS_3_0_CFLAGS)
-                   AC_SUBST(TSS2_ESYS_LIBS, $TSS2_ESYS_3_0_LIBS),
-                  PKG_CHECK_MODULES(TSS2_ESYS_2_3, tss2-esys >= 2.4.0,
-                  AC_DEFINE(ESYS_2_3, 1, Esys2.3)
-                  AC_SUBST(TSS2_ESYS_CFLAGS, $TSS2_ESYS_2_3_CFLAGS)
-                   AC_SUBST(TSS2_ESYS_LIBS, $TSS2_ESYS_2_3_LIBS)))
+PKG_CHECK_MODULES(
+    TSS2_ESYS_4_0,
+    tss2-esys >= 4.0.0,
+    AC_DEFINE(ESYS_4_0, 1, Esys4.0)
+    AC_SUBST(TSS2_ESYS_CFLAGS, $TSS2_ESYS_4_0_CFLAGS)
+     AC_SUBST(TSS2_ESYS_LIBS, $TSS2_ESYS_4_0_LIBS)
+     have_esys_4_0="yes",
+    PKG_CHECK_MODULES(
+        TSS2_ESYS_3_0,
+        tss2-esys >= 3.0.0,
+        AC_DEFINE(ESYS_3_0, 1, Esys3.0)
+        AC_SUBST(TSS2_ESYS_CFLAGS, $TSS2_ESYS_3_0_CFLAGS)
+         AC_SUBST(TSS2_ESYS_LIBS, $TSS2_ESYS_3_0_LIBS),
+        PKG_CHECK_MODULES(TSS2_ESYS_2_3, tss2-esys >= 2.4.0,
+            AC_DEFINE(ESYS_2_3, 1, Esys2.3)
+            AC_SUBST(TSS2_ESYS_CFLAGS, $TSS2_ESYS_2_3_CFLAGS)
+            AC_SUBST(TSS2_ESYS_LIBS, $TSS2_ESYS_2_3_LIBS)
+        )
+    )
+)
+
+AM_CONDITIONAL(HAVE_ESYS_4_0, test "x${have_esys_4_0}" = "xyes")
+
 PKG_CHECK_MODULES(TSS2_TCTILDR, tss2-tctildr)
 PKG_CHECK_MODULES(TSS2_MU, tss2-mu)
 PKG_CHECK_MODULES(TSS2_RC, tss2-rc)
 PKG_CHECK_MODULES(TSS2_SYS, tss2-sys)
-PKG_CHECK_MODULES(CRYPTO, libcrypto >= 1.0.2g)
+PKG_CHECK_MODULES(CRYPTO, libcrypto >= 1.1.0)
+AC_CHECK_LIB(crypto, EVP_sm3, 
+        AC_DEFINE(HAVE_EVP_SM3, 1, Support EVP_sm3 in openssl),
+        )
+AC_CHECK_LIB(crypto, EVP_sm4_cfb128, 
+        AC_DEFINE(HAVE_EVP_SM4_CFB, 1, Support EVP_sm4_cfb in openssl),
+        )
 PKG_CHECK_MODULES(CURL, libcurl)
-PKG_CHECK_MODULES(UUID, uuid)
+
+# pretty print of devicepath if efivar library is present
+# auto detect if not specified via the --with-efivar option.
+AC_ARG_WITH(efivar,
+  AS_HELP_STRING(--with-efivar, Build with lib efivar for pretty print of device path. Default auto detect),
+  ,
+  with_efivar=auto
+)
+
+# use the true program to avoid failing hard
+AS_IF(test "x$with_efivar" == "xauto",
+  PKG_CHECK_MODULES(EFIVAR, efivar,,true),
+  test "x$with_efivar" == "xyes",
+  PKG_CHECK_MODULES(EFIVAR, efivar),
+)
 
 # backwards compat with older pkg-config
 # - pull in AC_DEFUN from pkg.m4
@@ -86,6 +121,12 @@
                            with_bashcompdir="${datarootdir}/bash-completion/completions"))
 AC_SUBST(bashcompdir, $with_bashcompdir)
 
+AC_ARG_WITH(tpmsim,
+            AS_HELP_STRING(--with-tpmsim=BIN, simulator used for testing),
+            ,
+            )
+AC_SUBST(tpmsim, $with_tpmsim)
+
 AC_CANONICAL_HOST
 
 # Check OS and set library and compile flags accordingly
@@ -113,8 +154,8 @@
 
 dnl macro that checks for specific modules in python
 AC_DEFUN(AC_PYTHON_MODULE,
-AC_MSG_CHECKING(for module $1 in python)
-  echo "import $1" | python - 2>/dev/null
+AC_MSG_CHECKING(for module $1 in $PYTHON)
+  echo "import $1" | $PYTHON - 2>/dev/null
   if test $? -ne 0 ; then
     AC_MSG_ERROR(not found)
   else
@@ -137,20 +178,37 @@
     PKG_CHECK_MODULES(CMOCKA,cmocka)
 
     AC_CHECK_PROG(tpm2_abrmd, tpm2-abrmd, yes, no)
-    AS_IF(test $tpm2_abrmd = no,
-          AC_MSG_ERROR(Required executable tpm2_abrmd not found, try setting PATH))
-
-    AC_CHECK_PROG(tpm_server, tpm_server, yes, no)
-    AS_IF(test $tpm_server = no,
-          AC_MSG_ERROR(Required executable tpm_server not found, try setting PATH))
+    AS_IF(test $tpm2_abrmd = yes,
+	  TPM2_ABRMD=tpm2-abrmd,
+          AC_MSG_ERROR(Required executable tpm2_abrmd not found, try setting PATH)
+    )
+    AC_SUBST(TPM2_ABRMD)
+
+	AS_IF(test -z "$tpmsim", 
+        AC_CHECK_PROG(swtpm, swtpm, yes, no)
+        AC_CHECK_PROG(tpm_server, tpm_server, yes, no)
+        AS_IF(test $swtpm = yes, TPM2_SIM=swtpm,
+          AS_IF(test $tpm_server = yes, TPM2_SIM=tpm_server,
+                 AC_MSG_ERROR(Required executables swtpm or tpm_server not found, try setting PATH)))
+        ,
+        
+        AC_CHECK_PROG(HAS_TPM2_SIM, $tpmsim, yes, no)
+        AS_IF(test "$HAS_TPM2_SIM" = yes,
+            TPM2_SIM=$tpmsim,
+            AC_MSG_ERROR(Required executable $tpmsim not found, system tests require a tpm simulator shell!)
+        )
+        
+    )
+    AC_SUBST(TPM2_SIM)
 
     AC_CHECK_PROG(BASH_SHELL, bash, yes, no)
     AS_IF(test $BASH_SHELL = no,
           AC_MSG_ERROR(Required executable bash not found, system tests require a bash shell!))
 
-    AC_CHECK_PROG(PYTHON, python, yes, no)
-    AS_IF(test $PYTHON = no,
-          AC_MSG_ERROR(Required executable python not found, some system tests will fail!))
+    AM_PATH_PYTHON(,
+        ,
+        AC_MSG_ERROR(Required executable python not found, some system tests will fail!)
+    )
 
     AC_PYTHON_MODULE(yaml)
 
@@ -179,8 +237,12 @@
     AS_IF(test $OPENSSL = no,
           AC_MSG_ERROR(Required executable openssl not found, some system tests will fail!))
 
+    AC_CHECK_PROG(WC, wc, yes, no)
+    AS_IF(test $WC = no,
+          AC_MSG_ERROR(Required executable wc not found, some system tests will fail!))
+
     unit_test_tool_report="- tpm2_abrmd: $tpm2_abrmd
-    - tpm_server: $tpm_server
+    - TPM simulator: $TPM2_SIM
     - bash: $BASH_SHELL
     - python: $PYTHON
     - xxd: $XXD
@@ -232,7 +294,7 @@
 
   add_hardened_c_flag(-Wall)
   add_hardened_c_flag(-Wextra)
-  add_hardened_c_flag(-Werror)
+  AS_IF(test "x$ax_is_release" = "xno", add_hardened_c_flag(-Werror))
 
   add_hardened_c_flag(-Wformat)
   add_hardened_c_flag(-Wformat-security)
@@ -268,6 +330,9 @@
 # -D_GNU_SOURCE is required for execvpe() in options.c
 add_c_flag(-D_GNU_SOURCE, AC_MSG_ERROR(Cannot enable -D_GNU_SOURCE))
 
+# Enable gnu99 mode, since we use some of these features.
+add_c_flag(-std=gnu99, AC_MSG_ERROR(Cannot enable -std=gnu99))
+
 # Best attempt compiler options that are on newer versions of GCC that
 # we can't widely enforce without killing other peoples builds.
 # Works with gcc only. Needs to be disabled on BSD and clang
@@ -276,7 +341,7 @@
        add_c_flag(-Wstringop-truncation)
        add_c_flag(-Wduplicated-branches)
        add_c_flag(-Wduplicated-cond)
-       add_hardened_c_flag(-Wbool-compare),)
+       add_c_flag(-Wbool-compare),)
 
 # Best attempt, strip unused stuff from the binary to reduce size.
 # Rather than nesting these and making them ugly just use a counter.

_service:tar_scm:tpm2-tools-5.0.tar.gz/depcomp -> _service:tar_scm:tpm2-tools-5.4.tar.gz/depcomp Changed

@@ -1,9 +1,9 @@
 #! /bin/sh
 # depcomp - compile a program generating dependencies as side-effects
 
-scriptversion=2016-01-11.22; # UTC
+scriptversion=2018-03-07.03; # UTC
 
-# Copyright (C) 1999-2017 Free Software Foundation, Inc.
+# Copyright (C) 1999-2018 Free Software Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,7 +16,7 @@
 # GNU General Public License for more details.
 
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -783,7 +783,7 @@
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
 # time-stamp-time-zone: "UTC0"

_service:tar_scm:tpm2-tools-5.0.tar.gz/dist/bash-completion/tpm2-tools/tpm2_completion.bash -> _service:tar_scm:tpm2-tools-5.4.tar.gz/dist/bash-completion/tpm2-tools/tpm2_completion.bash Changed

@@ -2445,11 +2445,14 @@
             -L | --policy)
                 _filedir
                 return;;
+            -g | --hash-algorithm)
+                COMPREPLY=($(compgen -W "${hash_methods*}" -- "$cur"))
+                return;;
         esac
 
         COMPREPLY=($(compgen -W "-h --help -v --version -V --verbose -Q --quiet \
         -Z --enable-erata -T --tcti \
-        -C -s -a -P -p -L --hierarchy --size --attributes --hierarchy-auth --index-auth --policy --cphash " \
+        -C -s -a -P -p -L --hierarchy --size --attributes --hierarchy-auth --index-auth --policy --hash-algorithm --cphash " \
         -- "$cur"))
     } &&
     complete -F _tpm2_nvdefine tpm2_nvdefine
@@ -3015,6 +3018,8 @@
 
         local format_methods=(tss plain)
 
+        local pcr_format_methods=(values serialized)
+
         local signing_scheme=(rsassa rsapss ecdsa ecdaa sm2 ecshnorr hmac)
 
         local key_object=(rsa ecc aes camellia hmac xor keyedhash)
@@ -3040,10 +3045,14 @@
             -o | --output)
                 _filedir
                 return;;
+            -F | --pcrs_format)
+                COMPREPLY=($(compgen -W "${pcr_format_methods*}" -- "$cur"))
+                return;;
         esac
 
         COMPREPLY=($(compgen -W "-h --help -v --version -V --verbose -Q --quiet \
         -Z --enable-erata -T --tcti \
+        -F --pcrs_format \
         -o --output " \
         -- "$cur"))
     } &&
@@ -4096,6 +4105,8 @@
 
         local format_methods=(tss plain)
 
+        local pcr_format_methods=(values serialized)
+
         local signing_scheme=(rsassa rsapss ecdsa ecdaa sm2 ecshnorr hmac)
 
         local key_object=(rsa ecc aes camellia hmac xor keyedhash)
@@ -4127,6 +4138,9 @@
             -l | --pcr-list)
                 _filedir
                 return;;
+            -F | --pcrs_format)
+                COMPREPLY=($(compgen -W "${pcr_format_methods*}" -- "$cur"))
+                return;;
             -m | --message)
                 _filedir
                 return;;
@@ -4148,7 +4162,7 @@
         esac
 
         COMPREPLY=($(compgen -W "-h --help -v --version -V --verbose -Q --quiet \
-        -Z --enable-erata -T --tcti \
+        -Z --enable-erata -T --tcti -F --pcrs_format \
         -c -p -l -m -s -f -o -q -g --key-context --auth --pcr-list --message --signature --format --pcr --qualification --hash-algorithm --cphash " \
         -- "$cur"))
     } &&

_service:tar_scm:tpm2-tools-5.4.tar.gz/dist/bash-completion/tpm2-tools/tss2_gettpm2object Added

_service:tar_scm:tpm2-tools-5.4.tar.gz/docs Added

_service:tar_scm:tpm2-tools-5.4.tar.gz/docs/AUTHORS.md Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/docs/CHANGELOG.md Added

@@ -0,0 +1,2052 @@
+## Changelog
+
+All notable changes to this project will be documented in this file.
+
+Starting with release 5.4, The format is based on Keep a Changelog(http://keepachangelog.com/).
+
+## 5.4 - 2022-12-05
+
+### Added:
+  * tpm2_policyrestart:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PolicyRestart.
+
+  * tpm2_policynvwritten:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PolicyNvWritten.
+
+  * tpm2_policylocality:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PolicyLocality.
+
+  * tpm2_policycountertimer:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PolicyCounterTimer.
+
+  * tpm2_policycommandcode:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PolicyCommandCode.
+
+  * tpm2_policypassword:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PolicyPassword.
+
+  * tpm2_policyauthvalue:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PolicyAuthValue.
+
+  * tpm2_policyauthorize:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PolicyAuthorize.
+  
+  * tpm2_print:
+     - Support printing serialized ESYS_TR's
+
+  * tpm2_create:
+     - Add a clarifying message to usage of `-c` when TPM2_CreateLoaded
+       is not supported.
+
+  * tpm2_getcap:
+     - Add support for vendor agnostic capabilites. Requires tpm2-tss version 4.0
+       and higher to enable.
+
+  * Add a script, check_endorsement_cert.sh, to validate the endorsement
+    certificate chain. It takes two inputs - A TPM2B_PUBLIC format EKpublic and
+    a PEM format EKcertificate specified in that order as arguments.
+
+### 5.3 2022-09-27
+
+  * .ci/download-deps.sh: update tpm2-abrmd dependency version to 2.4.1
+
+  * .cirrus.yml: updated the freebsd version to 13.1 in the CI.
+
+  ### 5.3-rc1 2022-09-12
+
+  * tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
+
+  * Fix tssprivkey formatted PEM generation and load errors on 32 bit systems.
+
+  * CI: Add testing of 32bit systems with multiarch/qemu-user-static containers.
+
+  * Known issue: FAPI tools will not work on 32bit user-static qemu on 64bit
+    host because readdir returns NULL. Follow the issue on
+    https://gitlab.com/qemu-project/qemu/-/issues/263
+
+  ### 5.3-rc0 2022-08-02
+
+  * tpm2_nvextend: fix for including ESYS_TR handle to calculate object name.
+
+  * tpm2_nv(read/write): allow policy authorization only for single iterations
+    for a maximum buffer size of TPM2_PT_NV_BUFFER_MAX.
+
+  * tpm2_policylocality: fix logical inversion that caused any argument to be
+    interpreted as zero, except "zero" would be interpreted as one.
+
+  * tpm2_nvdefine: fixed to set TPMA_NV_PLATFORMCREATE attribute default when
+    authorizing with platform hierarchy.
+
+  * tpm2_getekcertificate: fixed the url/link for retrieving ek
+    certificates from ekop.intel.com.
+
+  * tools/tpm2_tool.c: fix an issue where LOG_WARN messages were displayed
+    despite setting the quite flag.
+
+  * tpm2_import: fix an issue where openssl load function resets a specified
+    scheme with TPM2_ALG_NULL.
+  
+  * tpm2_sign, tpm2_verifysignature: fixes for sm2 signing and verification.
+  
+  * Support alternative ECC curves for which default EK templates exist
+    (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
+    
+  * tools/misc/tpm2_checkquote: add sm2 verification of signature.
+
+  * tpm2_startauthsession:
+    - Added option **-G**, **--key-algorithm=ALGORITHM** to specify the
+      symmetric algorithm used in parameter encryption/decryption.
+  
+  * tpm2_certify:
+    - Added option **\--scheme**=_ALGORITHM_ for supporting signature schemes.
+     Signing schemes should follow the "formatting standards", see section
+     "Algorithm Specifiers".
+
+  * tpm2_getcommandauditdigest:
+    - Added option **\--scheme**=_ALGORITHM_ for supporting signature schemes.
+     Signing schemes should follow the "formatting standards", see section
+     "Algorithm Specifiers".
+
+  * tpm2_getsessionauditdigest:
+    - Added option **\--scheme**=_ALGORITHM_ for supporting signature schemes.
+     Signing schemes should follow the "formatting standards", see section
+     "Algorithm Specifiers".
+
+  * tpm2_quote:
+    - Added option **\--scheme**=_ALGORITHM_ for supporting signature schemes.
+     Signing schemes should follow the "formatting standards", see section
+     "Algorithm Specifiers".
+
+  * lib/tpm2.c: flushcontext cphash calculation workaround for a system api bug
+    where in the flush handle was erroneously placed in the handle area instead
+    of parameter area.
+
+  * tpm2_flushcontext: options **-t**, **-l**, **-s** can now be simultaneously
+    specified.
+
+  * tpm2_import: support restricted parent with an aes128cfb symmetric parameter.
+
+
+  * tpm2_nvreadpublic: drop ntoh on attributes because they get marshalled to
+    the correct endianness by libmu to begin with.
+
+  * tpm2_print: remove unused **-i** option.
+
+  * tpm2_policyor: fix segfault when no options or arguments to specify the list
+    of policies to be compounded.
+
+  * tpm2_certify: fix man page for short options and add tests The short
+    options for the signing-key-auth and certified-key-auth were swapped. The
+    case fix in the man page makes it less intuitive but have to go through with
+    the change so that we don't break any existing scripts. This change does not
+    affect the long options. Tests have been added to ensure the functionality.
+
+  * .cirrus.yml: updated the freebsd version to 13.
+
+  * VERSION: add version file - Generate the version file with bootstrap and
+    include in the DIST tarball so endusers can call autoreconf on a dist
+    tarball which doesn't have git. This alleviates git describe errors on
+    release tarballs in the autoreconf case.
+
+  * tpm2_clear:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_Clear.
+
+  * tpm2_dictionarylockout:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_DictionaryAttackLockReset and TPM2_CC_DictionaryAttackParameters.
+
+  * tpm2_clearcontrol:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC__ClearControl.
+
+  * tpm2_sign:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_Sign.
+
+  * tpm2_setprimarypolicy:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_SetPrimaryPolicy.
+
+  * tpm2_setclock:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_ClockSet.
+
+  * tpm2_rsadecrypt:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_RSA_Decrypt.
+
+  * tpm2_duplicate:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_Duplicate.
+
+  * tpm2_clockrateadjust:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_ClockRateAdjust.
+
+  * tpm2_createprimary:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_CreatePrimary.
+
+  * tpm2_quote:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_Quote.
+
+  * tpm2_policysecret:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PolicySecret
+
+  * tpm2_policynv:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PolicyNV.
+
+  * tpm2_policyauthorizenv:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PolicyAuthorizeNV.
+
+  * tpm2_import:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_Import.
+
+  * tpm2_hmac:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_HMAC.
+
+  * tpm2_hierarchycontrol:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_HierarchyControl.
+
+  * tpm2_load:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_Load.
+
+  * tpm2_gettime:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_GetTime.
+
+  * tpm2_evictcontrol:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_EvictControl.
+
+  * tpm2_encryptdecrypt:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_EncryptDecrypt.
+
+  * tpm2_getpolicydigest:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_GetPolicyDigest.
+
+  * tpm2_loadexternal:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_LoadExternal.
+
+  * tpm2_pcrreset:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PCR_Reset.
+        
+  * tpm2_pcrread:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PCR_Read.
+
+  * tpm2_pcrevent:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PCR_Event.
+        
+  * tpm2_pcrallocate:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_PCR_Allocate.
+
+  * tpm2_loadexternal:
+      - Added support to tpm2_loadexternal for parsing and loading the public
+        portion of a TSS2 Privkey PEM file. The path to the PEM file must be
+        specified using the **-r** option while skipping the **-G** option for
+        key type.
+
+  * tpm2_print:
+      - Added capability to parse out and print the public portion of a
+        TSS Private Key in the PEM format with the arg option
+        **TSSPRIVKEY_OBJ**.
+
+  * tpm2_geteccparameters:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_ECC_Parameters.
+
+  * tpm2_flushcontext:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_FlushContext.
+
+  * tpm2_ecephemeral:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_EC_Ephemeral.
+        
+  * tpm2_ecdhzgen:
+      - Added option **--cphash** to output the cpHash for the command
+        TPM2_CC_ECDH_ZGen.
+      
+  * tpm2_load:
+      - Added capability to load pem files in TSS2-Private-Key format for
+        interoperability with tpm2-tss-engine, tpm2-openssl provider,
+        tpm2-pkcs11, and tpm2-pytss.
+
+  * tpm2_ecdhkeygen:
+      - Added option to output the cpHash for the command TPM2_CC_ECDH_KeyGen.
+
+  * tpm2_commit:
+      - Added option to output the cpHash for the command TPM2_CC_Commit.
+
+  * tpm2:
+      - Added option to specify **--help=no-man**
+
+  * tpm2_nvreadpublic:
+      - Added option **\--cphash**=_FILE_ to specify file path to record hash
+        of the command parameters. This is commonly termed as cpHash.
+      - Added option **\--rphash**=_FILE_ to specify file path to record the
+        hash of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+      - Added option **-n**, **\--name** to specify the name of the nvindex in
+        hex bytes. This is used when cpHash is calculated without dispatching
+        the TPM2_NV_Write command to the TPM ie when **--tcti=none**
+
+  * tpm2_nvundefine:
+      - Added option **\--rphash**=_FILE_ to specify file path to record the
+        hash of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+      - Added option **-n**, **\--name** to specify the name of the nvindex in
+        hex bytes. This is used when cpHash is calculated without dispatching
+        the TPM2_NV_Write command to the TPM.
+      - Added option **\--with-policydelete** when calculating cpHash with
+        **\--tcti=none** there is no way to know if the attribute
+        TPMA_NV_POLICYDELETE has been set from the NV index name alone.
+    
+  * tpm2_nvreadlock:
+      - Added option **\--rphash**=_FILE_ to specify file path to record the
+        hash of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+      - Added option **-n**, **\--name** to specify the name of the nvindex in
+        hex bytes. This is used when cpHash is calculated without dispatching
+        the TPM2_NV_Write command to the TPM.
+
+  * tpm2_nvwritelock:
+      - Added option **\--rphash**=_FILE_ to specify file path to record the
+        hash of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_nvincrement:
+      - Added option **\--rphash**=_FILE_ to specify file path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_nvcertify:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+      - Added option **-n**, **\--name** to specify the name of the nvindex in
+        hex bytes. This is used when cpHash is calculated without dispatching
+        the TPM2_NV_Write command to the TPM.
+      - Added option **\-signer-name** to specify the signer name in hex bytes.
+        This is used when cpHash is calculated without dispatching the
+        TPM2_NV_Write command to the TPM.
+
+  * tpm2_nvwrite:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+      - Added option -n, --name to specify the name of the nvindex in hex bytes.
+        This is used when cpHash is calculated without dispatching the
+        TPM2_NV_Write command to the TPM.
+
+  * Minimum tpm2-tss version is now 3.2.0 to support openssl3 migration.
+
+  * Fix test harness leaving tpm servers running after a make check. Fixes sporadic
+    hangs in testing.
+
+### 5.2 2021-09-28
+### 5.2-rc0 2021-09-01
+
+* tpm2_nvextend:
+
+  * Added option -n, --name to specify the name of the nvindex in hex bytes.
+    This is used when cpHash ought to be calculated without dispatching the
+    TPM2_NV_Extend command to the TPM.
+
+* tpm2_nvread:
+
+  * Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+    of the response parameters. This is commonly termed as rpHash.
+  * Added option **\-n**, **\--name** to specify the name of the nvindex in
+    hex bytes. This is used when cpHash ought to be calculated without
+    dispatching the TPM2_NVRead command to the TPM.
+  * Added option **-S**, **\--session** to specify to specify an auxiliary
+    session for auditing and or encryption/decryption of the parameters.
+
+* tpm2_nvsetbits:
+
+  * Added option **\--rphash**=_FILE_ to specify file path to record the hash
+    of the response parameters. This is commonly termed as rpHash.
+  * Added option **-S**, **\--session** to specify to specify an auxiliary
+    session for auditing and or encryption/decryption of the parameters.
+  * Added option **\-n**, **\--name** to specify the name of the nvindex in
+    hex bytes. This is used when cpHash ought to be calculated without
+    dispatching the TPM2_NV_SetBits command to the TPM.
+
+* tpm2_createprimary:
+
+  * Support public-key output at creation time in various public-key formats.
+
+* tpm2_create:
+
+  * Support public-key output at creation time in various public-key formats.
+
+* tpm2_print:
+
+  * Support outputing public key in various public key formats over the default
+    YAML output. Supports taking `-u` output from `tpm2_create` and converting
+    it to a PEM or DER file format.
+
+* tpm2_import:
+
+  * Add support for importing keys with sealed-data-blobs.
+
+* tpm2_rsaencrypt, tpm2_rsadecrypt:
+
+  * Add support for specifying the hash algorithm with oaep.
+
+* tpm2_pcrread, tpm2_quote:
+
+  * Add option **-F**, **\--pcrs_format** to specify PCR format selection for
+    the binary blob in the PCR output file. 'values' will output a binary blob
+    of the PCR values. 'serialized' will output a binary blob of the PCR
+    values in the form of serialized data structure in little endian format.
+
+* tpm2_eventlog:
+
+  * Add support for decoding StartupLocality.
+  * Add support for printing the partition information.
+  * Add support for reading eventlogs longer than 64kb including from
+    /sys/kernel/security/tpm0/binary_bios-measurements.
+
+* tpm2_duplicate:
+
+  * Add option **-L**, **\--policy** to specify an authorization policy to be
+    associated with the duplicated object.
+  * Added support for external key duplication without needing the TCTI.
+
+* tools:
+
+  * Enhance error message on invalid passwords when sessions cannot be used.
+
+* lib/tpm2_options:
+
+  * Add option to specify fake tcti which is required in cases where sapi ctx
+    is required to be initialized for retrieving command parameters without
+    invoking the tcti to talk to the TPM.
+
+* openssl:
+
+  * Dropped support for OpenSSL < 1.1.0
+  * Add support for OpenSSL 3.0.0
+
+* Support added to make the repository documentation and man pages available
+  live on readthedocs.
+
+* Bug-fixes:
+
+  * tpm2_import: Don't allow setting passwords for imported object with -p
+    option as the tool doesn't modify the TPM2B_SENSITIVE structure. Added
+    appropriate logging to indicate using **tpm2_changeauth** after import.
+
+  * lib/tpm2_util.c: The function to calculate pHash algorithm returned error
+    when input session is a password session and the only session in the command.
+
+  * lib/tpm2_alg_util.c: Fix an error where oaep was parsed under ECC.
+
+  * tpm2_sign: Fix segfaults when tool does not find TPM resources (TPM or RM).
+
+  * tpm2_makecredential: Fix an issue where reading input from stdin could
+    result in unsupported data size larger than the largest digest size.
+
+  * tpm2_loadexternal: Fix an issue where restricted attribute could not be set.
+
+  * lib/tpm2_nv_util.h: The NV index size is dependent on different data sets
+    read from the GetCapability structures because there is a dependency on the
+    NV operation type: Define vs Read vs Write vs Extend. Fix a sane default in
+    the case where GetCapability fails or fails to report the specific property/
+    data set. This is especially true because some properties are TPM
+    implementation dependent.
+
+  * tpm2_createpolicy: Fix an issue where tool exited silently without reporting
+    an error if wrong pcr string is specified.
+
+  * lib/tpm2_alg_util: add error message on public init to prevent tools from
+    dying silently, add an error message.
+
+  * tpm2_import: fix an issue where an imported hmac object scheme was NULL.
+    While allowed, it was inconsistent with other tools like tpm2_create which
+    set the scheme as hmac->sha256 when generating a keyedhash object.
+
+### 5.1.1 2021-06-21
+
+  * tpm2_import: fix fixed AES key CVE-2021-3565
+      - tpm2_import used a fixed AES key for the inner wrapper, which means that
+        a MITM attack would be able to unwrap the imported key. To fix this,
+        ensure the key size is 16 bytes or bigger and use OpenSSL to generate a
+        secure random AES key.
+
+### 5.1 2021-05-24
+
+  * Build
+      - Dependency-update: Minimum tpm2-tss version dependency bumped to 3.1.0
+      - Dependency-update: Minimum tpm2-abrmd version dependency bumped to 2.4.0
+      - tpm2_eventlog: Fix build errors on 64 bit arm systems.
+      - tpm2_checkquote: Fix build on 32b little-endian platforms.
+      - Fixes builds on CentOS 7 which notably has an ancient version of
+        GCC: 4.8.5 and an older version of OSSL, 1.0.2
+      - Configure handles searching for python executable more gracefully, thus
+        just having python3, will work.
+      - Moved to GitHub Actions for CI testing.
+      - Added fedora-32 to CI testing configurations and related fixes.
+      - FreeBSD testing is bumped up to version 12.2
+      - Fix compiler and packaging warnings for OpenSuse builds.
+      - configure: make build gnu99.
+      - configure: make -Wbool-compare non fatal.
+      - configure: only use -Werror for non-release builds
+
+  * tss2:
+      - Support in tools for PolicyRef inclusion in policy search per latest TSS.
+      - Support to use TPM objects protected by a policy with PolicySigned.
+      - Enable backward compatibility to old Fapi callback API.
+      - Fix PCR selection for tss2 quote.
+      - Support policy signed policies by implementing Fapi_SetSignCB.
+
+  * Command/ response parameter support for auditing and pHash policies:
+      - lib/tpm2_util.c: Add method to determine hashing alg for cp/rphash
+      - Add support to calculate rphash for tpm2_create, tpm2_activatecredential,
+        tpm2_certify, tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps,
+        tpm2_changepps, tpm2_nvdefine, tpm2_nvextend, tpm2_unseal
+      - Add support to calculate cphash for tpm2_changeeps, tpm2_changepps.
+
+  * Session-support:
+      - tpm2_sessionconfig: Add tool to display and configure session attributes.
+      - tpm2_getrandom: Fix— session input was hardcoded for audit-only
+      - tpm2_startauthsession: Add option to specify the bind object  and its
+        authorization value.
+      - tpm2_startauthsession: support for bounded-only session.
+      - tpm2_startauthsession: support for salted-only session.
+      - tpm2_startauthsession: add option to specify an hmac session type.
+      - Add support for specifying non-authorization sessions for audit and
+        parameter encryption for tpm2_getrandom, tpm2_create, tpm2_nvextend,
+        tpm2_nvdefine, tpm2_unseal, tpm2_activatecredential, tpm2_certify,
+        tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps, tpm2_changepps.
+
+  * tpm2_eventlog:
+      - Support for event type: EV_IPL extensively used by the Shim and Grub.
+      - Support for event type: EV_EFI_GPT_EVENT to parse.
+        UEFI_PARTITION_TABLE_HEADER and UEFI_PARTITION_ENTRY.
+      - Support for event type: EFI_SIGNATURE_LIST, which contains one or more
+        EFI_SIGNATURE_DATA.
+      - Support for event type EV_EFI_VARIABLE_AUTHORITY.
+      - Parse UEFI_PLATFORM_FIRMWARE_BLOB structure that the CRTM MUST put into
+        the Event Log entry TCG_PCR_EVENT2.event field for event types
+        EV_POST_CODE, EV_S_CRTM_CONTENTS, and EV_EFI_PLATFORM_FIRMWARE_BLOB.
+      - Parse secureboot variable to indicate enable as 'Yes'.
+      - Parse BootOrder variable to a more readable format.
+      - Parse Boot variables per EFI_LOAD_OPTION described in more details in
+        UEFI Spec Section 3.1.3
+      - Parse Device-path in a readable format using the efivar library.
+      - Support for logs longer than 64 kilobytes.
+      - Perform verification for event types where digest can be verified from
+        their event payload.
+      - Better support for multiline strings.
+      - Fix handling of event log EV_POST_CODE data where field is empty and len
+        is specified.
+
+  * scripts/utils: Add a utility to read the cert chain of embedded CA.
+
+  * tpm2_getekcertificate: Fix tool failing to return error/non-zero for HTTP 404.
+
+  * tpm2_nvdefine: allow setting hash algorithm by command line parameter for NV
+    indices set in extend mode.
+
+  * tpm2_duplicate, tpm2_import: support duplicating non-TPM keys to a remote TPM
+    without first requiring them to be loaded to a local TPM.
+
+  * tpm2_dictionarylockout: Fix issue where setting value for one parameter caused
+    to reset the others.
+
+  * tpm2_getpolicydigest: Add new tool to enable TPM2_CC_PolicyGetDigest.
+
+  * Fix segfault where optind > argc.
+
+  * tools/tpm2_checkquote: fix missing initializer
+
+  * tpm2_convert: fix EVP_EncodeUpdate usage for OSSL < 1.1.0
+
+  * openssl: fix EVP_ENCODE_CTX_(new|free)
+
+  * test: Add support for swTPM simulator to the testing framework and make it the
+  default if mssim isn't available.
+
+  * tpm2_unseal:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+
+  * tpm2_nvextend:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+
+  * tpm2_nvdefine:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+
+  * tpm2_changepps:
+      - Added option **\--cphash**=_FILE_ to specify ile path to record the hash
+        of the command parameters. This is commonly termed as cpHash.
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_changeeps:
+      - Added option **\--cphash**=_FILE_ to specify ile path to record the hash
+        of the command parameters. This is commonly termed as cpHash.
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_changeauth:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_certifycreation:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_certify:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_activatecredential:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_create:
+       - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+         of the response parameters. This is commonly termed as rpHash.
+
+  * tpm2_unseal:
+      - Added option **-S**, **--session** to specify auxiliary sessions for
+        audit and encryption.
+
+  * tpm2_nvdefine:
+      - Added option **-S**, **--session** to specify auxiliary sessions for
+        audit and encryption.
+
+  * tpm2_nvextend:
+      - Added option **-S**, **--session** to specify auxilary sessions for
+        audit and encryption.
+
+### 5.1-rc1 2021-05-19
+
+* scripts/utils: Add a utility to read the cert chain of embedded CA
+* .ci/download-deps.sh: Bump tpm2-tss version to 3.1.0
+* build: only use -Werror for non-release builds
+
+### 5.1-rc0 2021-04-20
+
+  * Build
+      - Dependency-update: Minimum tpm2-tss version dependency bumped to 3.0.3
+      - Dependency-update: Minimum tpm2-abrmd version dependency bumped to 2.4.0
+      - tpm2_eventlog: Fix build errors on 64 bit arm systems.
+      - tpm2_checkquote: Fix build on 32b little-endian platforms.
+      - Fixes builds on CentOS 7 which notably has an ancient version of
+        GCC: 4.8.5 and an older version of OSSL, 1.0.2
+      - Configure handles searching for python executable more gracefully, thus
+        just having python3, will work.
+      - Moved to GitHub Actions for CI testing.
+      - Added fedora-32 to CI testing configurations and related fixes.
+      - FreeBSD testing is bumped up to version 12.2
+      - Fix compiler and packaging warnings for OpenSuse builds.
+      - configure: make build gnu99.
+      - configure: make -Wbool-compare non fatal.
+
+  * tss2:
+      - Support in tools for PolicyRef inclusion in policy search per latest TSS.
+      - Support to use TPM objects protected by a policy with PolicySigned.
+      - Enable backward compatibility to old Fapi callback API.
+      - Fix PCR selection for tss2 quote.
+      - Support policy signed policies by implementing Fapi_SetSignCB.
+
+  * Command/ response parameter support for auditing and pHash policies:
+      - lib/tpm2_util.c: Add method to determine hashing alg for cp/rphash
+      - Add support to calculate rphash for tpm2_create, tpm2_activatecredential,
+        tpm2_certify, tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps,
+        tpm2_changepps, tpm2_nvdefine, tpm2_nvextend, tpm2_unseal
+      - Add support to calculate cphash for tpm2_changeeps, tpm2_changepps.
+
+  * Session-support:
+      - tpm2_sessionconfig: Add tool to display and configure session attributes.
+      - tpm2_getrandom: Fix— session input was hardcoded for audit-only
+      - tpm2_startauthsession: Add option to specify the bind object  and its
+        authorization value.
+      - tpm2_startauthsession: support for bounded-only session.
+      - tpm2_startauthsession: support for salted-only session.
+      - tpm2_startauthsession: add option to specify an hmac session type.
+      - Add support for specifying non-authorization sessions for audit and
+        parameter encryption for tpm2_getrandom, tpm2_create, tpm2_nvextend,
+        tpm2_nvdefine, tpm2_unseal, tpm2_activatecredential, tpm2_certify,
+        tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps, tpm2_changepps.
+
+  * tpm2_eventlog:
+      - Support for event type: EV_IPL extensively used by the Shim and Grub.
+      - Support for event type: EV_EFI_GPT_EVENT to parse.
+        UEFI_PARTITION_TABLE_HEADER and UEFI_PARTITION_ENTRY.
+      - Support for event type: EFI_SIGNATURE_LIST, which contains one or more
+        EFI_SIGNATURE_DATA.
+      - Support for event type EV_EFI_VARIABLE_AUTHORITY.
+      - Parse UEFI_PLATFORM_FIRMWARE_BLOB structure that the CRTM MUST put into
+        the Event Log entry TCG_PCR_EVENT2.event field for event types
+        EV_POST_CODE, EV_S_CRTM_CONTENTS, and EV_EFI_PLATFORM_FIRMWARE_BLOB.
+      - Parse secureboot variable to indicate enable as 'Yes'.
+      - Parse BootOrder variable to a more readable format.
+      - Parse Boot variables per EFI_LOAD_OPTION described in more details in
+        UEFI Spec Section 3.1.3
+      - Parse Device-path in a readable format using the efivar library.
+      - Support for logs longer than 64 kilobytes.
+      - Perform verification for event types where digest can be verified from
+        their event payload.
+      - Better support for multiline strings.
+      - Fix handling of event log EV_POST_CODE data where field is empty and len
+        is specified.
+
+  * tpm2_getekcertificate: Fix tool failing to return error/non-zero for HTTP 404.
+
+  * tpm2_nvdefine: allow setting hash algorithm by command line parameter for NV
+    indices set in extend mode.
+
+  * tpm2_duplicate, tpm2_import: support duplicating non-TPM keys to a remote TPM
+    without first requiring them to be loaded to a local TPM.
+
+  * tpm2_dictionarylockout: Fix issue where setting value for one parameter caused
+    to reset the others.
+
+  * tpm2_getpolicydigest: Add new tool to enable TPM2_CC_PolicyGetDigest.
+
+  * Fix segfault where optind > argc.
+
+  * tools/tpm2_checkquote: fix missing initializer
+
+  * tpm2_convert: fix EVP_EncodeUpdate usage for OSSL < 1.1.0
+
+  * openssl: fix EVP_ENCODE_CTX_(new|free)
+
+  * test: Add support for swTPM simulator to the testing framework and make it the
+  default if mssim isn't available.
+
+  * tpm2_unseal:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+
+  * tpm2_nvextend:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+
+  * tpm2_nvdefine:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+
+  * tpm2_changepps:
+      - Added option **\--cphash**=_FILE_ to specify ile path to record the hash
+        of the command parameters. This is commonly termed as cpHash.
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_changeeps:
+      - Added option **\--cphash**=_FILE_ to specify ile path to record the hash
+        of the command parameters. This is commonly termed as cpHash.
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_changeauth:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_certifycreation:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_certify:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_activatecredential:
+      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+        of the response parameters. This is commonly termed as rpHash.
+      - Added option **-S**, **\--session** to specify to specify an auxiliary
+        session for auditing and or encryption/decryption of the parameters.
+
+  * tpm2_create:
+       - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
+         of the response parameters. This is commonly termed as rpHash.
+
+  * tpm2_unseal:
+      - Added option **-S**, **--session** to specify auxiliary sessions for
+        audit and encryption.
+
+  * tpm2_nvdefine:
+      - Added option **-S**, **--session** to specify auxiliary sessions for
+        audit and encryption.
+
+  * tpm2_nvextend:
+      - Added option **-S**, **--session** to specify auxilary sessions for
+        audit and encryption.
+
+### 5.0 - 2020-11-16
+
+#### Non Backwards Compatible Changes
+
+  * Default hash algorithm is now sha256. Prior versions claimed sha1, but were
+    inconsistent in choice. Best practice is to specify the hash algorithm to
+    avoid suprises.
+   
+  * tpm2_tools and tss2_tools are now a busybox style commandlet. Ie
+    tpm2\_getrandom becomes tpm2 getrandom. make install will install symlinks
+    to the old tool names and the tpm2 commandlet will interogate argv0 for
+    the command to run. This will provide backwards compatibility if they are
+    installed. If you wish to use the old names not installed system wide, set
+    DESTDIR during install to a seperate path and set the proper directory on
+    PATH.
+
+  * tpm2\_eventlog's output changed to be YAML compliant. The output before
+    was intended to be YAML compliant but was never properly checked and tested.
+
+  * umask set to 0117 for all tools.
+
+  * tpm2\_getekcertificate now outputs the INTC EK certificates in PEM format
+    by default. In order to output the URL safe variant of base64 encoded
+    output of the INTC EK certificate use the added option **--raw**.
+
+#### Dependency update
+
+  * Update tpm2-tss dependency version to
+    3.0.1(https://github.com/tpm2-software/tpm2-tss/releases/tag/3.0.1)
+
+  * Update tpm2-abrmd dependency version to
+    2.3.3(https://github.com/tpm2-software/tpm2-abrmd/releases/tag/2.3.3)
+
+#### New tools and features
+
+  * tpm2\_zgen2phase:
+    - Add new tool to support command TPM2\_CC\_ZGen\_2Phase.
+
+  * tpm2\_ecdhzgen:
+    - Add new tool to support command TPM2\_CC\_ECDH\_ZGen.
+
+  * tpm2\_ecdhkeygen:
+    - Add new tool to support command TPM2\_CC\_ECDH\_KeyGen.
+
+  * tpm2\_commit:
+    - Add new tool to support command TPM2\_CC\_Commit.
+
+  * tpm2\_ecephemeral:
+    - Add new tool to support command TPM2\_CC\_EC\_Ephemeral.
+
+  * tpm2\_geteccparameters:
+    - Add new tool to support command TPM2\_CC\_ECC\_Parameters.
+
+  * tpm2\_setcommandauditstatus:
+    - Added new tool to support command TPM2\_CC\_SetCommandCodeAuditStatus.
+
+  * tpm2\_getcommandauditstatus:
+    - Added new tool to support command TPM2\_CC\_GetCommandAuditDigest.
+
+  * tpm2\_getsessionauditdigest:
+    - Added new tool to support command TPM2\_CC\_GetSessionAuditDigest.
+
+  * tpm2\_certifyX509certutil:
+    - Added new tool for creating partial x509 certrificates required to support
+      the TPM2\_CC\_CertifyX509 command.
+
+  * tpm2\_policysigned:
+    - Added option **\--cphash-input** to specify the command parameter hash
+      (cpHashA), enforcing the TPM command to be authorized as well as its handle
+      and parameter values.
+
+  * tpm2\_createprimary:
+    - Added option to specify the unique data from the stdin by adding provision
+      for specifying the option value for unique file as **-**.
+
+  * tpm2\_startauthsession:
+    - Added new feature/option **\--audit-session** to start an HMAC session to
+      be used as an audit session.
+
+  * tpm2\_getrandom:
+    - Added new feature/option **-S**, **\--session** to specify a HMAC session
+      to be used as an audit session. This adds support for auditing the command
+      using an audit session.
+    - Added new feature/option **\--rphash** to specify file path to record the
+      hash of the response parameters. This is commonly termed as rpHash.
+    - Added new feature/option **\--cphash** to specify a file path to record
+      the hash of the command parameters. This is commonly termed as cpHash.
+      NOTE: In absence of **\--rphash** option, when this option is selected,
+      The tool will not actually execute the command, it simply returns a
+      cpHash.
+
+  * tpm2_getcap:
+    - tpm2_getcap was missing raw on a property TPM2_PT_REVISION, and it should
+      always be specified.
+
+  * tpm2_sign:
+    - Add option **--commit-index** to specify the commit index to use when
+      performing an ECDAA signature.
+    - Add support for ECDAA signature.
+
+  * tpm2_getekcertificate:
+    - Add option **--raw** to output EK certificate in URL safe variant base64
+      encoded format. By default it outputs a PEM formatted certificate.
+    - The tool can now output INTC and non INTC EK certificates from NV indices
+      specified by the TCG EK profile specification.
+
+  * tpm2_activatecredential:
+    - The secret data input can now be specified as stdin with **-s** option.
+    - The public key used for encryption can be specified as **-u** to make it
+      similar to rest of the tools specifying a public key. The old **-e**
+      option is retained for backwards compatibility.
+    - Add option to specify the key algorithm when the input public key is in
+      PEM format using the new option **-G**, **--key-algorithm**. Can specify
+      either RSA/ECC. When this option is used, input public key is expected to
+      be in PEM format and the default TCG EK template is used for the key
+      properties.
+
+  * tpm2\_checkqoute:
+    - Add EC support.
+    - Support loading *tss* signatures.
+    - Support loading tpm2 pcrread PCR values by specifying the PCR selection
+      using the new option **-l**, **\--pcr-list**.
+    - Added support for automatically detecting the signature format. With this
+      **-F**, **\--format** option is retained for backwards compatibility but
+      it is deprecated.
+
+  * tpm2\_createak:
+    - add option to output qualified name with new option
+      **-q**, **\--ak-qualified-name**.
+
+  * tpm2\_policypcr:
+    - Add option for specifying cumulative hash of PCR's as an argument.
+
+  * tpm2\_readpublic:
+    - Add option to output qualified name using the new option
+      **-q**, **\--qualified-name**.
+
+  * tpm2\_print:
+    - Support printing TPM2B\_PUBLIC data structures.
+    - Support printing TPMT\_PUBLIC data structures.
+
+  * tpm2\_send:
+    - Add support for handling sending and receiving command and response buffer
+     for multiple commands.
+
+  * tpm2\_verifysignature:
+    - Added support for verifying RSA-PSS signatures.
+
+  * tpm2\_eventlog:
+    - Add handling of sha1 log format.
+    - Add fixes for eventlog output to be proper YAML.
+    - Add support for sha384, sha512, sm3_256 PCR hash algorithms.
+    - Add support for computing PCR values based on the events.
+
+  * tpm2_tools (all):
+    - Set stdin/stdout to non-buffering.
+    - Added changes for FreeBSD portability.
+
+#### Bug fixes
+
+  * Fix printing short options when no ascii character is used.
+
+  * OpenSSL: Fix deprecated OpenSSL functions. ECC Functions with suffix GFp
+    will become deprecated (DEPRECATED_1_2_0).
+
+  * tpm2\_eventlog: output EV_POST_CODE as string not firmware blob to be
+    compliant with TCG PC Client FPF section 2.3.4.1 and 9.4.12.3.4.1
+
+  * Fix missing handle maps for ESY3 handle breaks. See #1994.
+
+  * tpm2\_rsaencrypt: fix OAEP RSA encryption failing to invalid hash selection.
+
+  * tpm2\_rsadecrypt: fix OAEP RSA decryption failing to invalid hash selection.
+
+  * tpm2\_sign: fix for signing failures with restricted signing keys when
+    input data to sign is not a digest, rather the full message. The validation
+    ticket creation process defaults to the owner hierarchy and so in order to
+    choose other hierarchies the **tpm2\_hash** tool should be used instead.
+
+  * tpm2\_print: fix segfault when **-t** option is omitted by appropriately
+    warning of the required option.
+
+  * tpm2\_nvdefine: fix for default size when size is not specified by invoking
+    TPM2_CC_GetCapability.
+
+  * Fix for an issue where the return code for unsupported algorithms was
+    tool_rc_general instead of tool_rc_unsupported in **tpm2_create** and
+    **tpm2_createprimary** tools.
+
+  * Fix for an issue where RSA_PSS signature verification caused failures.
+
+  * **tpm2_nvreadpublic**, **tpm2_kdfa**, **tpm2_checkquote**, **tpm2_quote**:
+    Fixes for issues with interoperability of the attestation tools between big
+    and little endian platforms.
+
+  * tss2\_\*:
+    - Fix bash-completion for tss2_pcrextend and tss2_verifysignature
+    - Add force option to tss2_list
+    - Make force option consistent in all fapi tools
+    - Do not decode non-TPM errors
+    - Enhance integration tests to test changes of optional/mandatory parameters
+    - Add --hex parameter to tss2_getrandom
+    - Fix autocompletion issue
+    - Switch tss2\_\* to with-"="-style
+    - Add size parameter to tss2_createseal
+    - References to the cryptographic profile (fapi-profile(5)) and config file
+      (fapi-config(5)) man pages from all relevant tss2\_\* man pages.
+    - Fix policy branch selection menu item from 1 to 0.
+
+#### CI changes
+
+  * Travis-CI
+    - Drop Ubuntu-16.04 and add Ubuntu-20.04.
+    - Added unit/integration test instance to verify we are not breaking tool
+      options and or maintaining backwards compatibility with 4.X version.
+
+  * Cirrus-CI:
+    - Added support for testing on FreeBSD.
+
+#### Documentation
+
+  * wiki pages have been removed and data has been migrated to
+    tpm2-software.github.io portal's tutorial section.
+
+  * Fix the problem with man and no-man help output for tools were not correctly
+    displayed.
+
+  * man:
+    - tpm2_create: Correct max seal data size from 256 bytes to 128 bytes.
+
+    - tpm2_nvread: Fix manpage example.
+
+    - tpm2_nvwrite: Added missing information on how to specify the NV index as
+     an argument.
+
+    - tpm2_unseal: Add end-to-end example.
+
+    - tpm2_nvincrement: Fix incorrect commands in example section.
+
+    - tpm2_hmac: Fix the example section.
+
+### 4.3.0 - 2020-08-24
+
+ * tss2_*: Fix double-free errors in commands asking for password authorization
+
+ * tss2_*: Fix shorthand command -f that was falsely requiring an argument
+
+ * tss2_*: Update tss2_encrypt to the new FAPI interface
+   - The argument 'policyPath' is removed which was never read anyway
+
+ * tss2_*: Remove the additional '\n' that was appended when redirecting to stdout
+
+ * tss2_*: Update mandatory vs optional treatment of arguments according to latest Fapi spec
+
+ * tss2_*: tss2_getinfo now retrieves the correct FAPI version from Fapi_GetInfo
+
+ * tss2_*: Fix the error handling in case of multiple inputs and/or outputs from stdin/stdout
+
+ * tss2_*: Fix syntax errors and update content of man pages according to latest Fapi spec
+
+ * tss2_*: Add parameter types to all man page
+
+ * tss2_*: tss2_setappdata now reads from file or stdin allowing to store also binary data
+
+ * tss2_*: Memory leaks are fixed in cases when a returned empty non-char output value was passed to file output
+
+ * tss2_pcrextend: fix extending PCR 0
+
+ * tss2_quote: fix unused TSS2_RC in LOG_ERR
+
+### 4.2.1 - 2020-05-25
+
+* Fix missing handle maps for ESY3 handle breaks. See #1994.
+
+* Bump ESYS minimum dependency version from 2.3.0 to 2.4.0.
+
+* Fix for loop declarations build error.
+
+### 4.2 2020-04-08
+
+ * Fix various issues reported by static analysis tools.
+
+ * Add integration test for ECC based getekcertificate.
+
+ * Fix for issue #1959 where ARM builds were failing.
+
+ * Add a check in autotools to add "expect" as a package dependency for fapi tools.
+
+ * tpm2_createek: Drop the unused -p or --ek-auth option
+
+ * tpm2_policyor: List of policy files should be specified as an argument
+   instead of -l option. The -l option is still retained for backwards
+   compatibility. See issue#1894.
+
+ * tpm2\_eventlog: add a tool for parsing and displaying the event log.
+
+ * tpm2_createek: Fix an issue where the `template` option looked for args
+
+ * tpm2_hierarchycontrol: Fixed bug where tool operation failed silently
+
+ * tpm2_nvdefine: Fixed an issue where text output suggested failures as passes
+
+ * tpm2_certify: Add an example usage in man page
+
+ * tpm2_policyor: Fix a bug where tool failed silently when no input were given
+
+ * tpm2_getekcertificate: Intel (R) PTT EK cert web portal is set as default address
+
+ * tpm2_alg_util.c: Fix a bug where string rsa3072 was not parsed
+
+ * .ci/download-deps.sh: Change tss dependency to 2.4.0 to acquire SAPI handles for cpHash calculations
+
+ * tpm2_policycphash: Add a tool to implement enhanced authorization with cpHash of a command
+
+ * Add options to tools to enable cpHash outputs: tpm2_nvsetbits, tpm2_nvextend,
+   tpm2_nvincrement, tpm2_nvread, tpm2_nvreadlock, tpm2_writelock, tpm2_nvdefine,
+   tpm2_nvundefine, tpm2_nvcertify, tpm2_policynv, tpm2_policyauthorizenv,
+   tpm2_policysecret, tpm2_create, tpm2_load, tpm2_activatecredential, tpm2_unseal,
+   tpm2_changeauth, tpm2_duplicate, tpm2_import, tpm2_rsadecrypt, tpm2_certify,
+   tpm2_certifycreation, tpm2_hierarchycontrol, tpm2_setprimarypolicy, tpm2_clearcontrol,
+   tpm2_dictionarylockout, tpm2_evictcontrol, tpm2_setclock, tpm2_clockrateadjust,
+   tpm2_clear, tpm2_nvwrite, tpm2_encryptdecrypt, tpm2_hmac.
+
+ * tpm2_import: Fix an issue where the imported key always required to have a policy
+
+ * tpm2_policysecret: Fix an issue where authorization model was fixed to password only
+
+ * Feature API (FAPI) tools added. These additional set of tools implement utilities
+   using the FAPI which was added to the tpm2-tss v2.4.4:
+   tss2_decrypt, tss2_encrypt, tss2_list, tss2_changeauth, tss2_delete,
+   tss2_import, tss2_getinfo, tss2_createkey, tss2_createseal, tss2_exportkey,
+   tss2_getcertificate, tss2_getplatformcertificates, tss2_gettpmblobs,
+   tss2_getappdata, tss2_setappdata, tss2_setcertificate, tss2_sign,
+   tss2_verifysignature, tss2_verifyquote, tss2_createnv, tss2_nvextend,
+   tss2_nvincrement, tss2_nvread, tss2_nvsetbits, tss2_nvwrite,
+   tss2_getdescription, tss2_setdescription, tss2_pcrextend, tss2_quote,
+   tss2_pcrread, tss2_authorizepolicy, tss2_exportpolicy, tss2_import,
+   tss2_provision, tss2_getrandom, tss2_unseal, tss2_writeauthorizenv
+
+ * tpm2_policycountertimer: Fix an issue where operandB array was reversed causing faulty comparisons.
+
+### 4.1.3 - 2020-06-02
+
+* tpm2\_create: Fix issue with userauth attribute being cleared if policy is specified.
+
+### 4.1.2 - 2020-05-18
+
+* Fix missing handle maps for ESY3 handle breaks. See #1994.
+
+### 4.1.1 - 2020-01-21
+
+* tpm2\_certify: Fix output of attestation data including size field. Now outputs just bytes.
+* tpm2\_certifycreation: Fix tool to match manpage where the code had the -C and -c options reversed.
+* tpm2\_gettime: Fix output of attestation data including size field. Now outputs just bytes.
+* tpm2\_nvcertify: Fix output of attestation data including size field. Now outputs just bytes.
+* tpm2\_nvreadpublic: add name hash output.
+* tpm2\_import: Support object policies when importing raw key material.
+* Fix overflow in pcrs.h where sizeof() was used instead of ARRAY\_LEN().
+* build:
+  - Fix compilation issue: lib/tpm2\_hash.c:17:19: note: 'left' was declared here.
+* man:
+    - Fix manpage examples that have "sha" instead of "sha1"
+    - tpm2\_shutdown manpage was missing, add it to build.
+    - Fix manpage example for tpm2\_createak's tpm2\_evictcontrol example.
+
+### 4.1 2019-11-25
+
+* tpm2\_certifycreation: New tool enabling command TPM2\_CertifyCreation.
+
+* tpm2\_checkquote:
+   - Fix YAML output bug.
+   - \-g option for specifying hash algorithm is optional and defaults to
+     sha256.
+
+* tpm2\_changeeps: A new tool for changing the Endorsement hierarchy primary seed.
+
+* tpm2\_changepps: A new tool for changing the Platform hierarchy primary seed.
+
+* tpm2\_clockrateadjust: Add a new tool for modifying the period on the TPM.
+
+* tpm2\_create: Add tool options for specifying output data for use in
+certification
+  - \--creation-data to save the creation data
+  - \--creation-ticket or -t to save the creation ticket
+  - \--creation-hash or -d to save the creation hash
+  - \--template-data for saving the template data of the key
+  - \--outside-info or -q for specifying unique data to include in creation data.
+  - \--pcr-list or -l  Add option to specify pcr list to add to creation data.
+
+* tpm2\_createprimary: Add tool options for specifying output data for use
+  in certification
+  - \--creation-data to save the creation data
+  - \--creation-ticket or -t to save the creation ticket
+  - \--creation-hash or -d to save the creation hash
+  - \--template-data for saving the template data of the key
+  - \--outside-info or -q for specifying unique data to include in creation data.
+  - \--pcr-list or -l  Add option to specify pcr list to add to creation data.
+
+* tpm2\_evictcontrol:
+    - Fix bug in automatic persistent handle selection when
+      hierarchy is platform.
+    - Fix bug in YAML key action where action was wrong when using ESYS\_TR.
+
+* tpm2\_getcap: clean up remanenats of -c option in manpages and tool output.
+
+* tpm2\_gettime: Add a new tool for retrieving a signed timestamp from a TPM.
+
+* tpm2\_nvcertify: Add a new tool for certifying the contents of an NV index.
+
+* tpm2\_nvdefine:
+  - Support default set of attributes so -a is not mandatory.
+  - Support searching for free index if an index isn't specified.
+
+* tpm2\_nvextend: Add a new tool for extending an NV index similair to a PCR.
+
+* tpm2\_nvreadpublic:
+  - Support specifying nv index to read public data from as argument.
+
+* tpm2\_nvsetbits: Add a new tool for setting the values of PCR with type
+    "bits".
+
+* tpm2\_nvundefine: Add support for deleting NV indices with attribute
+    `TPMA_NV_POLICY_DELETE` set using NV Undefine Special command.
+
+* tpm2\_nvwritelock: Add a new tool for setting a write lock on an NV index
+    or globally locking nv indices with TPMA\_NV\_GLOBALLOCK.
+
+* tpm2\_policyauthorizenv: New tool enabling signed, revocable policies.
+
+* tpm2\_policyauthvalue: New tool enabling authorization to be bound to the
+    authorization of another object.
+
+* tpm2\_policycountertimer: Add a new tool for enabling policy bound to TPM
+  clock or timer values.
+
+* tpm2\_policynamehash: Add a new tool for specifying policy based on object
+  name.
+
+* tpm2\_policynv: Add a new tool for specifying policy based on NV contents.
+
+* tpm2\_nvwritten: Add a new tool for specifying policy based on whether or not
+    an NV index was written to.
+
+* tpm2\_policysecret: Add tool options for specifying
+  - \--expiration or -t
+  - \--ticket
+  - \--timeout
+  - \--nonce-tpm or -x
+  - \--qualification or -q
+
+* tpm2\_policysigned: New tool enabling policy command TPM2\_PolicySigned.
+
+* tpm2\_policytemplate: New tool enabling policy command TPM2\_PolicyTemplate.
+
+* tpm2\_policyticket: New tool enabling policy command TPM2\_PolicyTicket.
+
+* tpm2\_readclock: Add a new tool for reading the TPM clock.
+
+* tpm2\_setclock: Add a new tool for setting the TPM clock.
+
+* tpm2\_setprimarypolicy: New tool setting policy on hierarchies.
+
+* tpm2\_shutdown: Add a new tool for issuing a TPM shutdown command.
+
+* misc:
+  - Support "tpmt" as a public key output format that only saves the TPMT
+  structure.
+  - Qualifying data or extra data in many tools can be hex array string or
+  binary file.
+  - Add support for specifying NV index type when specifying NV attributes.
+  - Support added for tools to run on FreeBSD.
+  - Skip and notify of action that man pages will not install if the package
+  pandoc is missing.
+  - Fix precedence issue with bitwise operator order int tpm2_getcap
+  - travis: bump abrmd version 2.3.0
+  - tpm2_util.c: Fix an issue int variable size was checked against uint
+  - pcr.c: Fix buffer length issue to support all defined hash algorithm
+
+### 4.0.1 - 2019-10-28
+
+tpm2_checkquote:
+  Fix YAML output bug.
+
+### 3.2.1 - 2019-10-10
+
+* Fix invalid memcpy when extracting ECDSA plain signatures.
+* Fix resource leak on FILE * in hashing routine.
+* Correct PCR logic to prevent memory corruption bug.
+* Errata handler fix.
+
+### 4.0 - 2019-09-09
+
+* tpm2_activatecredential:
+  - \--context is now \--credentialedkey-context.
+  - \--key-context is now \--credentialkey-context.
+  - \--Password is now \--credentialedkey-auth.
+  - \--endorse-passwd is now \--credentialkey-auth.
+  - \--in-file is now \--credential-secret.
+  - \--out-file is now \--certinfo-data.
+  - -f becomes -i.
+  - -k becomes -C.
+  - -e becomes -E.
+
+* tpm2_certify:
+  - \--halg is now \--hash-algorithm.
+  - \--obj-context is now \--certifiedkey-context.
+  - \--key-context is now \--signingkey-context.
+  - \--pwdo is now \--certifiedkey-auth.
+  - \--pwdk is now \--signingkey-auth.
+  - -a becomes -o.
+  - -k becomes -p.
+  - -c becomes -C.
+  - -k becomes -K.
+
+* tpm2_changeauth:
+  - New tool for changing the authorization values of:
+    - Hierarchies
+    - NV
+    - Objects
+  - Replaces tpm2_takeownership with more generic functionality.
+
+* tpm2_checkquote:
+  - \--halg is now \--hash-algorithm.
+  - \--pcr-input-file is now \--pcr.
+  - \--pubfile is now \--public.
+  - \--qualify-data is now \--qualification.
+  - -f becomes -F.
+  - -F becomes -f.
+  - -G becomes -g.
+
+* tpm2_clear:
+  - \--lockout-passwd is now \--auth-lockout.
+
+* tpm2_clearcontrol:
+  - New tool for enabling or disabling tpm2_clear commands.
+
+* tpm2_create
+  - \--object-attributes is now \--attributes.
+  - \--pwdp is now \--parent-auth.
+  - \--pwdo is now \--key-auth.
+  - \--in-file is now \--sealing-input.
+  - \--policy-file is now \--policy.
+  - \--pubfile is now \--public.
+  - \--privfile is now \--private.
+  - \--out-context is now \--key-context.
+  - \--halg is now \--hash-algorithm.
+  - \--kalg is now \--key-algorithm.
+  - -o becomes -c.
+  - -K becomes -p.
+  - -A becomes -b.
+  - -I becomes -i.
+  - -g becomes an optional option.
+  - -G becomes an optional option.
+  - Supports TPM command CreateLoaded via -c.
+
+* tpm2_createak:
+  - Renamed from tpm2_getpubak
+
+* tpm2_createek:
+  - renamed from tpm2_getpubek
+
+* tpm2_createpolicy:
+  - \--out-policy-file is now \--policy.
+  - \--policy-digest-alg is now \--policy-algorithm.
+  - \--auth-policy-session is now \--policy-session.
+  - -L becomes -l.
+  - -F becomes -f.
+  - -f becomes -o.
+  - Removed option \--set-list with short option -L.
+  - Removed option \--pcr-input-file with short option -F.
+  - Pcr policy options replaced with pcr password mini language.
+  - Removed short option a for specifying auth session. Use long option \--policy-session.
+  - Removed short option -P for specifying pcr policy. Use long option \--policy-pcr.
+
+* tpm2_createprimary:
+  - \--object-attributes is now \--attributes.
+  - -o is now -c
+  - \--pwdp is now \--hierarchy-auth.
+  - \--pwdk is now \--key-auth.
+  - \--halg is now \--hash-algorithm.
+  - \--kalg is now \--key-algorithm.
+  - \--context-object is now \--key-context.
+  - \--policy-file is now \--policy.
+  - support for unique field when creating objects via -u
+  - saves a context file for the generated primary's handle to disk via -c.
+  - -A becomes -a.
+  - -K becomes -p.
+  - -H becomes -C.
+  - -g becomes optional.
+  - -G becomes optional.
+
+* tpm2_dictionarylockout:
+  - \--lockout-passwd is now \--auth.
+  - -P becomes -p.
+
+* tpm2_duplicate:
+  - New tool for duplicating TPM objects.
+
+* tpm2_encryptdecrypt:
+  - \--pwdk is now \--auth.
+  - \--out-file is now \--output.
+  - -D becomes -d.
+  - -I becomes an argument.
+  - -P becomes -p.
+  - Support IVs via -t or \--iv.
+  - Support modes via -G.
+  - Support padding via -e or \--pad.
+  - Supports input and output to stdin and stdout respectively.
+
+* tpm2_evictcontrol:
+  - \--auth is now \--hierarchy.
+  - \--context is now \--object-context.
+  - \--pwda is now \--auth.
+  - \--persistent with short option -S is now an argument.
+  - -A becomes -C.
+  - Added option \--output -o to serialize handle to disk.
+  - Removed option \--handle with short option -H.
+  - Raw object-handles and object-contexts are commonly handled with object
+    handling logic.
+  - Removed option \--input-session-handle with short option -i.
+  - Authorization session is now part of password mini language.
+
+* tpm2_getcap:
+  - -c becomes an argument.
+  - Most instances of value replaced with raw in YAML output.
+  - TPM2_PT_MANUFACTURER displays string value and raw value.
+  - Supports \--pcr option for listing hash algorithms and bank numbers.
+
+* tpm2_getekcertificate:
+  - Renamed from tpm2_getmanufec
+
+* tpm2_getmanufec:
+  - Renamed the tool to tpm2_getekcertificate.
+  - Removed ek key creation and management logic.
+  - Added option for getting ek cert for offline platform via -x.
+  - Support for ECC keys.
+  - \--ec-cert is now \--ek-certificate,
+  - \--untrusted is now \--allow-unverified,
+  - \--output is now \--ek-public,
+  - -U is now -X.
+  - -O is now -x.
+  - -f becomes -o.
+  - Removed option -P or \--endorse-passwd.
+  - Removed option -p or \--ek-passwd.
+  - Removed option -w or \--owner-passwd.
+  - Removed option -H or \--persistent-handle.
+  - Removed option -G or \--key-algorithm.
+  - Removed option -N or \--non-persistent.
+  - Removed option -O or \--offline.
+
+* tpm2_getpubak:
+  - renamed to tpm2_createak.
+  - -f becomes -p and -f is used for format of public key output.
+  - \--auth-endorse is now \--eh-auth.
+  - \--auth-ak is now \--ak-auth.
+  - \--halg is now \--hash-algorithm.
+  - \--kalg is now \--key-algorithm.
+  - -e becomes -P.
+  - -P becomes -p.
+  - -D becomes -g.
+  - -p becomes -u.
+  - \--context becomes \--ak-context.
+  - \--algorithm becomes \--kalg.
+  - \--digest-alg becomes \--halg.
+  - \--privfile becomes \--private.
+  - remove -k persistant option. Use tpm2_evictcontrol.
+  - Fix -o option to -w.
+  - now saves a context file for the generated primary's handle to disk.
+  - -E becomes -e.
+  - -g changes to -G.
+  - support for non-persistent AK generation.
+
+* tpm2_getpubek:
+  - renamed to tpm2_createek
+  - \--endorse-passwd is now \--eh-auth.
+  - \--owner-passwd is now \--owner-auth.
+  - \--ek-passwd is now \--ek-auth.
+  - \--file is now \--public.
+  - \--context is now \--ek-context.
+  - \--algorithm is now \--key-algorithm.
+  - -e is now -P.
+  - -P is now -p.
+  - -p is now -u.
+  - -o is now -w.
+  - -g is now -G.
+  - Support for saving a context file for the generated primary keys handle
+    to disk.
+  - support for non-persistent EK generation.
+  - -f is now -p.
+  - -f support for format of public key output.
+
+* tpm2_getrandom:
+  - change default output to binary.
+  - add \--hex option for output to hex format.
+  - \--out-file is now \--output.
+  - bound input request on max hash size per spec, allow -f to override this.
+
+* tpm_gettestresult:
+  - new tool for getting test results.
+
+* tpm2_hash:
+  - add \--hex for specifying hex output.
+  - default output of hash to stdout.
+  - default output of hash as binary.
+  - remove output of ticket to stdout.
+  - \--halg is now \--hash-algorithm.
+  - \--out-file is now \--output.
+  - -a is now -C.
+  - -H is now -a.
+
+* tpm2_hmac:
+  - add -t option for specifying ticket result.
+  - \--out-file is now \--output.
+  - \--auth-key is now \--auth.
+  -\--algorithm is now \--hash-algorithm.
+  - \--pwdk is now \--auth-key.
+  - -C is now -c.
+  - -P is now -p.
+
+* tpm2_hierarchycontrol:
+  - new tool added for enabling or disabling the use
+    of a hierarchy and its associated NV storage.
+
+* tpm2_import:
+  - \--object-attributes is now \--attributes.
+  - \--auth-parent is now \--parent-auth.
+  - \--auth-key is now \--key-auth.
+  - \--algorithm is now \--key-algorithm.
+  - \--in-file is now \--input.
+  - \--parent-key is now \--parent-context.
+  - \--privfile is now \--private.
+  - \--pubfile is now \--public.
+  - \--halg is now \--hash-algorithm.
+  - \--policy-file is now \--policy.
+  - \--sym-alg-file is now \--encryption-key.
+  - -A is now -b.
+  - -k is now -i.
+  - support OSSL style -passin argument as \--passin for PEM file passwords.
+  - support additional import key types:
+    - RSA1024/2048.
+    - AES128/192/256.
+  - -q changes to -u to align with tpm2_loads public/private output arguments.
+  - Supports setting object name algorithm via -g.
+  - support specifying parent key with a context file.
+  - \--parent-key-handle/-H becomes \--parent-key/-C
+  - Parent public data option is optional and changes from `-K` to `-U`.
+  - Supports importing external RSA 2048 keys via pem files.
+  - Supports ECC Parent keys.
+
+* tpm2_incrementalselftest:
+  - Add tool to test support of specific algorithms.
+
+* tpm2_listpersistent:
+  - deleted as tpm2_getcap and tpm2_readpublic can be used instead.
+
+* tpm2_load:
+  - -o is now -c.
+  - \--context-parent is now \--parent-context.
+  - \--auth-parent is now \--auth.
+  - \--pubfile is now \--public.
+  - \--privfile is now \--private.
+  - \--out-context is now \--key-context.
+  - now saves a context file for the generated primary's handle to disk.
+  - Option `--pwdp` changes to `--auth-parent`.
+
+* tpm2_loadexternal:
+  - \--object-attributes is now --attributes.
+  - -o is now -c
+  - \--key-alg is now \--key-algorithm.
+  - \--pubfile is now \--public.
+  - \--privfile is now \--private.
+  - \--auth-key is now \--auth.
+  - \--policy-file is now \--policy.
+  - \--halg is now \--hash-algorithm.
+  - \--out-context is now \--key-context.
+  - Remove unused -P option.
+  - -H is now -a.
+  - Fix -A option to -b for attributes.
+  - now saves a context file for the generated primary's handle to disk.
+  - support OSSL style -passin argument as \--passin for PEM file passwords.
+  - name output to file and stdout. Changes YAML stdout output.
+  - ECC Public and Private PEM support.
+  - AES Public and Private "raw file" support.
+  - RSA Public and Private PEM support.
+  - Object Attribute support.
+  - Object authorization support.
+  - Default hierarchy changes to the *null* hierarchy.
+
+* tpm2_makecredential:
+  - \--out-file is now \--credential-blob
+  - \--enckey is now \--encryption-key.
+  - Option `--sec` changes to `--secret`.
+
+* tpm2_nvdefine:
+  - \--handle-passwd is now \--hierarchy-auth.
+  - \--index-passwd is now \--index-auth.
+  - \--policy-file is now \--policy.
+  - \--auth-handle is now \--hierarchy.
+  - -a becomes -C.
+  - -t becomes -a.
+  - -I becomes -p.
+  - Removed option \--index with short option -x. It is now an argument.
+  - Removed option \--input-session-handle with short option -S.
+  - Authorization session is now part of password mini language.
+
+* tpm2_nvincrement:
+  - New tool to increment value of a Non-Volatile (NV) index setup as a
+  counter.
+
+* tpm2_nvlist:
+  - tpm2_nvlist is now tpm2_nvreadpublic.
+
+* tpm2_nvread:
+  - \--handle-passwd is now \--auth.
+  - \--auth-handle is now \--hierarchy.
+  - -a becomes -C.
+  - Removed option \--index with short option -x. It is now an argument.
+  - Removed short option -o for specifying offset. Use long option \--offset.
+  - Removed option \--input-session-handle with short option -S.
+  - Authorization session is now part of password mini language.
+  - Removed option \--set-list with short option -L.
+  - Removed option \--pcr-input-file with short option -F.
+  - Pcr policy options replaced with pcr password mini language.
+  - fix a buffer overflow.
+
+* tpm2_nvreadlock:
+  - \--handle-passwd is now \--auth.
+  - \--auth-handle is now \--hierarchy.
+  - -a becomes -C.
+  - Removed option \--index with short option -x. It is now an argument.
+  - Removed option \--input-session-handle with short option -S.
+  - Authorization session is now part of password mini language.
+
+* tpm2_nvwrite:
+  - \--handle-passwd is now \--auth.
+  - \--auth-handle is now \--hierarchy.
+  - -a becomes -C.
+  - Removed option \--index with short option -x. It is now an argument.
+  - Removed short option -o for specifying offset. Use long option \--offset.
+  - Removed option \--input-session-handle with short option -S.
+  - Authorization session is now part of password mini language.
+  - Removed option \--set-list with short option -L.
+  - Removed option \--pcr-input-file with short option -F.
+  - Pcr policy options replaced with pcr password mini language.
+
+* tpm2_nvrelease:
+  - \--handle-passwd is now \--auth.
+  - \--auth-handle is now \--hierarchy.
+  - -a becomes -C.
+  - Removed option \--index with short option -x. It is now an argument.
+  - Removed option \--input-session-handle with short option -S.
+  - Authorization session is now part of password mini language.
+
+* tpm2_nvundefine:
+  - Renamed from tpm2_nvrelease.
+
+* tpm2_pcrallocate:
+  - New tool for changing the allocated PCRs of a TPM.
+
+* tpm2_pcrevent:
+  - \--password is now \--auth.
+  - Removed option \--pcr-index with short option -i.
+  - PCR index is now specified as an argument.
+  - Removed option \--input-session-handle with short option -S.
+  - Authorization session is now part of password mini language.
+
+* tpm2_pcrlist:
+  - -gls options go away with -g and -l becoming a single argument.
+
+* tpm2_pcrread:
+  - Renamed from tpm2_pcrlist.
+
+* tpm2_print:
+  - New tool that decodes a TPM data structure and prints enclosed elements
+  to stdout as YAML.
+
+* tpm2_policyauthorize:
+  - New tool that allows for policies to change by associating the policy to
+  a signing authority essentially allowing the auth policy to change.
+
+* tpm2_policycommandcode:
+  - New tool to restricts TPM object authorization to specific TPM commands.
+
+* tpm2_policyduplicationselect:
+  - New tool for creating a policy to restrict duplication to a new parent
+  and or duplicable object.
+
+* tpm2_policylocality:
+  - New tool for creating a policy restricted to a locality.
+
+* tpm2_policypcr:
+  - New tool to generate a pcr policy event that bounds auth to specific PCR
+  values in user defined pcr banks and indices.
+
+* tpm2_policyor:
+  - New tool to compound multiple policies in a logical OR fashion to allow
+  multiple auth methods using a policy session.
+
+* tpm2_policypassword:
+  - New tool to mandate specifying of the object password in clear using a
+    policy session.
+
+* tpm2_policysecret:
+  - New tool to associate auth of a reference object as the auth of the new
+    object using a policy session.
+
+* tpm2_quote:
+  - \--ak-context is now \--key-context.
+  - \--ak-password is now \--auth.
+  - \--sel-list is now \--pcr-list.
+  - \--qualify-data is now \--qualification-data.
+  - \--pcrs is now \--pcr.
+  - \--sig-hash-algorithm is now \--hash-algorithm.
+  - -P becomes -p
+  - -L becomes -l.
+  - -p becomes -o.
+  - -G becomes -g.
+  - -g becomes optional.
+  - Removed option \--id-list with short option -l.
+  - Removed option \--ak-handle with short option -k.
+  - Raw object-handles and object-contexts are commonly handled with object
+    handling logic.
+
+* tpm2_readpublic:
+  - \--opu is now \--output.
+  - \--context-object is now \--object-context.
+  - Removed option \--object with short option -H.
+  - Raw object-handles and object-contexts are commonly handled with object
+    handling logic.
+  - Added \--serialized-handle for saving serialized ESYS_TR handle to disk.
+  - Added \--name with short option -n for  saving the binary name.
+  - Supports ECC pem and der file generation.
+
+* tpm2_rsadecrypt:
+  - \--pwdk is now \--auth.
+  - \--out-file is now \--output.
+  - -P becomes -p.
+  - Added \--label with short option -l for specifying label.
+  - Added \--scheme with short option -s for specifying encryption scheme.
+  - Removed option -I or in-file input option and make argument.
+  - Removed option \--key-handle with short option -k.
+  - Raw object-handles and object-contexts are commonly handled with object
+    handling logic.
+  - Removed option \--input-session-handle with short option -S.
+  - Authorization session is now part of password mini language.
+
+* tpm2_rsaencrypt:
+  - \--out-file is now \--output.
+  - Added \--scheme with short option -s for specifying encryption scheme.
+  - Added \--label with -l for specifying label.
+  - Removed option \--key-handle with short option -k.
+  - Raw object-handles and object-contexts are commonly handled with object
+    handling logic.
+  - make output binary either stdout or file based on -o.
+
+* tpm2_selftest:
+  - New tool for invoking tpm selftest.
+
+* tpm2_send:
+  - \--out-file is now \--output.
+
+* tpm2_sign:
+  - \--pwdk is now \--auth.
+  - \--halg is now \--hash-algorithm.
+  - \--sig is now \--signature.
+  - -P becomes -p.
+  - -s becomes -o.
+  - Added \--digest with short option -d.
+  - Added \--scheme with short option -s.
+  - Supports rsapss.
+  - Removed option \--key-handle with short option -k.
+  - Raw object-handles and object-contexts are commonly handled with object
+    handling logic.
+  - Removed option \--msg with short option -m.
+  - Make -d toggle if input is a digest.
+  - Removed option \--input-session-handle with short option -S.
+  - Authorization session is now part of password mini language.
+  - Supports signing a pre-computed hash via -d.
+
+* tpm2_startauthsession:
+  - New tool to start/save a trial-policy-session (default) or policy-
+    authorization-session with command line option --policy-session.
+
+* tpm2_stirrandom:
+  - new command for injecting entropy into the TPM.
+
+* tpm2_takeownership:
+  - split into tpm2_clear and tpm2_changeauth
+
+* tpm2_testparms:
+  - new tool for querying tpm for supported algorithms.
+
+* tpm2_unseal:
+  - \--pwdk is now \--auth.
+  - \--outfile is now \--output.
+  - \--item-context is now \--object-context.
+  - -P becomes -p
+  - Removed option \--item with short option -H.
+  - Raw object-handles and object-contexts are commonly handled with object
+    handling logic.
+  - Removed option \--input-session-handle with short option -S.
+  - Authorization session is now part of password mini language.
+  - Removed option \--set-list with short option -L.
+  - Removed option \--pcr-input-file with short option -F.
+  - Pcr policy options replaced with pcr password mini language.
+
+
+* tpm2_verifysignature:
+  - \--halg is now \--hash-algorithm.
+  - \--msg is now \--message.
+  - \--sig is now \--signature.
+  - -D becomes -d.
+  - -t becomes optional.
+  - Issue warning when ticket is specified for a NULL hierarchy.
+  - Added option \--format with short option -f.
+  - Removed option \--raw with short option -r.
+  - Removed option \--key-handle with short option -k.
+  - Raw object-handles and object-contexts are commonly handled with object
+    handling logic.
+  - Support routines for OpenSSL compatible format of public keys (PEM, DER) and
+    plain signature data without TSS specific headers.
+
+* misc:
+  - cmac algorithm support.
+  - Add support for reading authorisation passwords from a file.
+  - Ported all tools from SAPI to ESAPI.
+  - Load TCTI's by SONAME, not raw .so file.
+  - system tests are now run with make check when --enable-unit is used in configure.
+  - Libre SSL builds fixed.
+  - Dynamic TCTIS. Support for pluggable TCTI modules via the -T or --tcti
+    options.
+  - test: system testing scripts moved into subordinate test directory.
+  - configure: enable code coverage option.
+  - env: add TPM2TOOLS_ENABLE_ERRATA to control the -Z or errata option.
+    affects all tools.
+  - Fix parsing bug in PCR mini-language.
+  - Fix misspelling of TPM2_PT_HR constants which effects tpm2_getcap output.
+  - configure option --with-bashcompdir for specifying bash completion
+    directory.
+
+### 3.2.0 - 2019-06-19
+  * fix configure bug for linking against libmu.
+  * tpm2_changeauth: Support changing platform hierarchy auth.
+  * tpm2_flushcontext: Introduce new tool for flushing handles from the TPM.
+  * tpm2_checkquote: Introduce new tool for checking validity of quotes.
+  * tpm2_quote: Add ability to output PCR values for quotes.
+  * tpm2_makecredential: add support for executing tool off-TPM.
+  * tpm2_pcrreset: introduce new tool for resetting PCRs.
+  * tpm2_quote: Fix AK auth password not being used.
+
+### 3.1.4 - 2019-03-14
+  * Fix various man pages
+  * tpm2_getmanufec: fix OSSL build warnings
+  * Fix broken -T option
+  * Various build compatibility fixes
+  * Fix some unit tests
+  * Update build for recent autoconf-archive versions
+  * Install m4 files
+
+### 3.1.3 - 2018-10-15
+  * Restore support for the TPM2TOOLS_* env vars for TCTI configuration, in
+  addition to supporting the new unified TPM2TOOLS_ENV_TCTI
+  * Fix tpm2_getcap to print properties with the TPM_PT prefix, rather than
+  TPM2_PT
+  * Make test_tpm2_activecredential Python 3 compatible
+  * Fix tpm2_takeownership to only attempt to change the specified hierarchies
+
+### 3.1.2 - 2018-08-14
+  * Revert the change to use user supplied object attributes exclusively. This is an inappropriate behavioural change for a MINOR version number increment.
+  * Fix inclusion of object attribute specifiers section in tpm2_create and tpm2_createprimary man pages.
+  * Use better object attribute defaults for authentication, preventing an empty password being used for authentication when a policy is set.
+
+### 3.1.1 - 2018-07-09
+  * Allow man page installation without pandoc being available
+
+### 3.1.0 - 2018-06-21
+  * Update to use TSS version 2.0
+  * When user supplies nv attributes use those exclusively, not in addition to the defaults
+  * When user supplies object attributes use those exclusively, not in addition to the defaults
+  * Load TCTI's by SONAME, not raw .so file
+
+### 3.0.4 - 2018-05-30
+  * Fix save and load for TPM2B_PRIVATE object.
+  * Use a default buffer size for tpm2_nv{read,write} if the TPM reports a 0 size.
+  * Fix --verbose and --version options crossover.
+  * Generate man pages from markdown and include them in the distribution tarball.
+  * Print usage summary if tools are executed with no options or man page can't be displayed.
+
+### 3.0.3 - 2017-15-18
+  * Tools that don't need a TPM to work no longer request
+    a TPM connection. Namely, tpm2_rc_decode
+  * Fix undefined references in libmarshal port.
+
+### 3.0.2 - 2017-12-18
+  * configure: enable code coverage option.
+  * build: enable silent rules options.
+  * Add system tests to dist tarball.
+  * tpm2_nv(read|write): fix buffer overflows.
+
+### 3.0.1 - 2017-12-11
+  * Makefile: add missing LICENSE and markdown files.
+### 3.0 - 2017-12-08
+  * tpm2_getmanufec: -O as a flag for -f has changed. -O is for existing EK public structure
+      and -f is only for generated EK public output.
+  * tpm2_nvlist: output in yaml format.
+  * tpm2_makecredential format changes to the -o output file.
+  * tpm2-quote: -o option removed.
+  * tpm2_rsaencrypt: -I is now an argument and input defaults to stdin. -o is optional and
+    defaults to stdout.
+  * tpm2_listpersistent: output friendly object attributes.
+  * tpm2_createprimary: support friendly object attributes via -A. -H becomes auth
+    hierarchy.
+  * tpm2_create: support friendly object attributes via -A.
+  * tpm2_nvwrite and tpm2_nvread have support for satisfying PCR policies.
+  * tpm2_encryptdecrypt: has support for EncryptDecrypt2 command.
+  * tpm2_nvwrite: -f option removed, support for stdin data supported. Support for starting
+      index to write to.
+  * errata framework added for dealing with spec errata.
+  * tpm2_quote: -G option for signature hash algorithm specification.
+  * tpm2_dump_capability: renamed to tpm2_getcap.
+  * tpm2_send_command: renamed to tpm2_send and the input file is now an
+    argument vs using -i.
+  * tpm2_dump_capability: outputs human readable command codes.
+  * camelCase options are now all lower case. For example, --camelCase becomes --camel-case.
+  * tpm2_quote,readpublic, and sign now have support for pem/der output/inputs. See the
+    respective man pages for more details.
+  * tpm2_nvread: Has an output file option, -f.
+  * manpages: Are now in Markdown and converted to roff using pandoc.
+  * tpm2_create - options 'o' and 'O' changed to 'u' and 'r' respectively.
+  * tpm2_pcrlist: support yaml output for parsing.
+  * tpm2_pcrevent: new tool for hashing and extending pcrs.
+  * Make tpm2_{createprimary,create,load,pcrlist,hmac} tools to support the --quiet option.
+  * Support for a --quiet option to suppress messages printed by tools to standard output.
+  * tpm2_hmac: support for files greater than 1024 bytes, changes in options and arguments.
+  * tpm2_hash: support for files greater than 1024 bytes, changes in options and arguments.
+  * Install is now to bin vs sbin. Ensure that sbin tools get removed!
+  * make dist and distcheck are now working.
+  * installation into customized locations are now working, see issue #402 for details.
+  * tpm2_pcrlist: renamed from tpm2_listpcrs.
+  * tpm2_pcrextend: new tool for extending PCRs.
+  * tpm2_getmanufec: -E option no longer required, defaults to stdout.
+  * tpm2_nvlist: Support for friendly nv attributes in output.
+  * Support for friendly algorithm names for algorithm identifiers.
+  * tpm2_nvread: The option, -s, or size option is no longer required.
+  * tpm2_nvwrite: fixed to write files larger than 1024 in size.
+  * tpm2_nvread: fixed to read files larger than 1024 in size.
+  * tpm2_nvdefine supports "nice-names" for nv space attributes.
+  * Support using PCR Policy directly with tpm2_unseal tool.
+  * Support PCR policy creation in tpm2_createpolicy
+  * Support using a policy session as input to tools that may need to satisfy complex policies
+    other than password.
+  * tpm2_unseal: supports output to stdoud.
+  * tpm2_create: enforce policy based authorization.
+  * tpm2_createprimary: add ability to create objects with policy based authorization.
+  * tpm2_nvdefine: add ability to create nv indexes with policy based authorization.
+  * Support Clang Build.
+  * tpm2_unseal test uses endorsement hierarchy as platform hierarchy is unavailable on a
+    real tpm.
+  * Numerous cleanups and minor bug fixes.
+
+### v2.0 - 2017-03-29
+
+  * Tracked on the milestone: https://github.com/tpm2-software/tpm2-tools/milestone/2
+  * Reworked all the tools to support configurable TCTIs, based on build time
+    configuration, one can specify the tcti via the --tcti (-T) option to all
+    tools.
+  * tpm2_getrandom interface made -s a positional argument.
+  * Numerous bug fixes.
+
+### v1.1 - 2016-11-04
+
+  * travis ci support.
+  * Allow for unit tests to be enabled selectively.
+  * tpm2_rc_decode tool: Decode TPM_RC error codes.
+  * Android Make file
+  * tpm2_listpersistent: list all persistent objects
+  * test scripts for tpm2-tools
+  * tpm2_nvreadlock
+  * tpm2_getmanufec: retrieve EC from tpm manufacturer server.
+  * Copy 'common' and 'sample' code from the TPM2.0-TSS repo.
+
+  **Modified**
+
+  * tpm2_takeownership: update option -c to use lockout password to clear.
+  * tpm2_listpcrs: add options -L and -s, rewrite to increase performance.
+  * tpm2_quote: added -L option to support selection of multiple banks.
+  * tpm2_quote: add -q option to get qualifying data.
+  * configure: Use pkg-config to get info about libcurl and libcrypto.
+  * configure: Use pkg-config to locate SAPI and TCTI headers / libraries.
+  * tpm2_x: Add -X option to enable password input in Hex format.
+  * tpm2_nvdefine: Change -X option to -I.
+  * tpm2-nvwrite: fix for unable to write 1024B+ data.
+  * tpm2_getmanufec: Fix base64 encoding.
+  * tpm2_x: fixed a lot of TPM2B failures caused by wrong initialization.
+  * tpm2_getmanufec: let configure handle libs.
+  * tpm2_getmanufec: Convert from dos to unix format.
+  * build: Check for TSS2 library @ configure time.
+  * build: Detect required TSS2 and TCTI headers.
+  * build: Use libtool to build the common library
+  * build: Install all binaries into sbin.
+  * build: Build common sources into library.
+  * build: Move all source files to 'src'.
+  * Makefile.am: Move all build rules into single Makefile.am.
+  * everything: Use new TCTI headers and fixup API calls.
+  * everything: Update source to cope with sapi header cleanup.
+  * tpm2_activatecredential: Updated to support TCG compatible EK
+  * tpm2_getpubak: Updated to use TCG compatible EK
+  * tpm2_getpubek: fix ek creation to follow TCG EK profile spec.
+
+  **Removed**
+
+  * Windows related code
+  * dependency on the TPM2.0-TSS repo source code
+
+### v1.0 - 2015-10-19
+
+  * 1.0 release
+  * 29 tools included

_service:tar_scm:tpm2-tools-5.4.tar.gz/docs/CONTRIBUTING.md Added

@@ -0,0 +1,25 @@
+## Guidelines for submitting bugs:
+
+All non security bugs can be filed on the Issues tracker:
+
+<https://github.com/tpm2-software/tpm2-tools/issues>
+
+Security sensitive bugs should be handled per the instructions in the
+SECURITY.md(SECURITY.md) file.
+
+## Guidelines for submitting changes:
+
+All changes should be introduced via github pull requests. This allows anyone to
+comment and provide feedback in lieu of having a mailing list. For pull requests
+opened by non-maintainers, any maintainer may review and merge that pull request.
+For maintainers, they either must have their pull request reviewed by another
+maintainer if possible, or leave the PR open for at least 24 hours, we consider
+this the window for comments.
+
+All tests must pass on Github Actions CI for the merge to occur.
+All changes must not introduce superfluous whitespace changes or whitespace errors.
+All changes should adhere to the coding standard documented under misc.
+
+### Guideline for merging changes:
+Changes should be merged with the "rebase" option on github to avoid merge commits.
+This provides for a clear linear history.

_service:tar_scm:tpm2-tools-5.4.tar.gz/docs/INSTALL.md Added

@@ -0,0 +1,217 @@
+## Building tpm2-tools
+
+Below you will find instructions to build and install the tpm2-tools project.
+
+### Download the Source
+To obtain the tpm2-tools sources you must clone them as below:
+```
+git clone https://github.com/tpm2-software/tpm2-tools
+```
+
+### Dependencies
+
+To build and install the tpm2-tools software the following software is required:
+
+  * GNU Autoconf (version >= 2019.01.06)
+  * GNU Automake
+  * GNU Libtool
+  * pkg-config
+  * C compiler
+  * C Library Development Libraries and Header Files (for pthreads headers)
+  * ESAPI - TPM2.0 TSS ESAPI library (tss2-esys) and header files
+  * OpenSSL libcrypto library and header files (version >= 1.1.0)
+  * Curl library and header files
+
+#### Optional Dependencies:
+  * To build the man pages you need pandoc(https://github.com/jgm/pandoc)
+  * FAPI - TPM2.0 TSS FAPI library (tss2-fapi) and header files
+  * To enable the new userspace resource manager, one must get tpm2-tabrmd
+    (**recommended**).
+  * When ./configure is invoked with --enable-unit or --enable-unit=abrmd,
+    the tests are run towards a resource manager, tpm2-abrmd, which must be on $PATH.
+  * When ./configure is invoked with --enable-unit=mssim, the tests are run directly
+    towards tpm_server, without resource manager.
+  * For the tests, with or without resource manager, tpm_server must be installed.
+  * Some tests pass only if xxd, expect, bash and python with PyYAML are available
+  * Some tests optionally use (but do not require) curl
+
+### Typical Distro Dependency Installation
+
+Here we are going to satisfy tpm2-tools dependencies with:
+* tpm2-tss: <https://github.com/tpm2-software/tpm2-tss>
+* tpm2-abrmd: <https://github.com/tpm2-software/tpm2-abrmd>
+* TPM simulator: <https://downloads.sourceforge.net/project/ibmswtpm2/ibmtpm1332.tar.gz>
+
+Which are necessary for the build example section at the bottom of this file, we need to satisfy the dependencies for each item named above except for the simulator.
+
+#### Ubuntu 16.04
+
+Satisfying the dependencies for tpm2-tools falls into two general steps, stuff
+you can easily get via the package manager, and stuff you cannot.
+
+**NOTE**: The *tpm2 Userspace Dependencies* may not be the correct version in
+your distros package manager.
+
+**Packages**:
+
+The packages in the below command can be ascertained via the package manager.
+
+```
+sudo apt-get install autoconf automake libtool pkg-config gcc \
+    libssl-dev libcurl4-gnutls-dev python-yaml
+```
+**Notes**:
+
+  * One can substitute gcc for clang if they desire.
+  * On pre-ubuntu 16.04 `libcurl4-gnutls-dev` was provided by `libcurl-dev`
+    * The libcurl dependency can be satisfied in many ways, and likely change
+      with Ubuntu versions:
+      * `libcurl4-openssl-dev 7.47.0-1ubuntu2.2`
+      * `libcurl4-nss-dev 7.47.0-1ubuntu2.2`
+      * `libcurl4-gnutls-dev 7.47.0-1ubuntu2.2`
+  * One needs autoconf archive, which is too old in the packagemanager. You can get
+    working version from here(http://ftpmirror.gnu.org/autoconf-archive/autoconf-archive-2019.01.06.tar.xz)
+
+**tpm2 Userspace Dependencies**:
+
+The following tpm2 userspace dependencies can be satisfied by getting the
+source, building and installing them. They can be located here:
+
+  * ESAPI - The enhanced system API: <https://github.com/tpm2-software/tpm2-tss>
+  * ABRMD (**recommended but optional**) - Which is the userspace resource
+    manager: <https://github.com/tpm2-software/tpm2-abrmd>
+
+
+
+#### Fedora
+
+
+In case you want to build from source the next command block should cover all the dependencies for tpm2-tools, the enhanced system API (tpm2-tss) and the userspace resource manager (tpm2-abrmd).
+
+```
+$ sudo dnf -y update && sudo dnf -y install automake libtool \
+autoconf autoconf-archive libstdc++-devel gcc pkg-config \
+uriparser-devel libgcrypt-devel dbus-devel glib2-devel \
+compat-openssl10-devel libcurl-devel PyYAML
+
+```
+Some distros have the dependencies already packaged, you can simply install the package that contains the needed build requirements.
+
+```
+$ sudo dnf builddep tpm2-tools
+
+```
+
+The package installed above contains all the dependencies for tpm2-tools included the projects mentioned at the beginning of this section (tpm2-tss and tpm2-abrmd)
+
+For more detailed information about the dependencies of tpm2-tss and tmp2-abrmd, please consult the corresponding links for each project. You can find these links in
+the Dependency-Matrix(https://tpm2-software.github.io/versions/)
+
+## Building
+
+To compile tpm2-tools execute the following commands from the root of the
+source directory:
+```
+$ ./bootstrap
+$ ./configure
+$ make
+```
+
+This is sufficient for running as long as you alter `PATH` so that it points to
+the *tools* directory, or just execute them via a full path.
+
+For Example:
+
+```
+./tools/tpm2_getrandom 4
+```
+
+### Building from source example
+
+
+Now we can start building the projects, there are four major steps for building the projects from source:
+#### Bootstrapping the build
+
+With the bootstrap command we run a script which generates the list of source files along with the configure script.
+
+In the project directory:
+
+```
+$  ./bootstrap
+```
+
+#### Configuring the build
+
+Here we run the configure script, this generates the makefiles needed for the compilation.
+
+```
+$ ./configure
+```
+
+Depending of the project, you can add additional information to the configure script, please refer to the links provided below for more information about the custom options.
+
+* Default values for GNU installation directories: <https://www.gnu.org/prep/standards/html_node/Directory-Variables.html>
+* Custom options for tpm2-tss: <https://github.com/tpm2-software/tpm2-tss/blob/master/INSTALL.md>
+* Custom options for tpm2-abrmd: <https://github.com/tpm2-software/tpm2-abrmd/blob/master/INSTALL.md>
+
+#### Compiling the Libraries
+
+We use the make command for compile the code.
+
+```
+$ make -j$(nproc)
+```
+
+
+#### Installing the Libraries
+
+Once we have finish building the projects it's time to install them.
+
+```
+$ sudo make install
+```
+Now putting all together:
+
+* ##### Tpm2-tss
+```
+$ git clone https://github.com/tpm2-software/tpm2-tss.git
+$ cd tpm2-tss
+$ ./bootstrap
+$ ./configure --prefix=/usr
+$ make -j5
+$ sudo make install
+```
+
+* ##### Tpm2-abrmd
+```
+$ git clone https://github.com/tpm2-software/tpm2-abrmd.git
+$ cd tpm2-abrmd
+$ ./bootstrap
+$ ./configure --with-dbuspolicydir=/etc/dbus-1/system.d
+--with-udevrulesdir=/usr/lib/udev/rules.d
+--with-systemdsystemunitdir=/usr/lib/systemd/system
+--libdir=/usr/lib64 --prefix=/usr
+$ make -j5
+$ sudo make install
+```
+
+* ##### Tpm2-tools
+```
+$ git clone https://github.com/tpm2-software/tpm2-tools.git
+$ cd tpm2-tools
+$ ./bootstrap
+$ ./configure --prefix=/usr
+$ make -j5
+$ sudo make install
+```
+* ##### TPM simulator
+```
+$ mkdir ibmtpm && cd ibmtpm
+$ wget https://sourceforge.net/projects/ibmswtpm2/files/latest/download -O ibmtpm.tar.gz
+$ tar -zxvf ibmtpm.tar.gz
+$ cd src
+$ make -j5
+```
+
+
+And it's done, you are ready to run the projects.

_service:tar_scm:tpm2-tools-5.4.tar.gz/docs/LICENSE Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/docs/MAINTAINERS.md Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/docs/README.md Added

@@ -0,0 +1,44 @@
+!Build Status(https://github.com/tpm2-software/tpm2-tools/workflows/CI/badge.svg)(https://github.com/tpm2-software/tpm2-tools/actions)
+!FreeBSD Build Status(https://api.cirrus-ci.com/github/tpm2-software/tpm2-tools.svg?branch=master)(https://cirrus-ci.com/github/tpm2-software/tpm2-tools)
+!codecov(https://codecov.io/gh/tpm2-software/tpm2-tools/branch/master/graph/badge.svg)(https://codecov.io/gh/tpm2-software/tpm2-tools)
+!Coverity Scan(https://img.shields.io/coverity/scan/3997.svg)(https://scan.coverity.com/projects/01org-tpm2-0-tools)
+!Language grade: C/C++(https://img.shields.io/lgtm/grade/cpp/g/tpm2-software/tpm2-tools.svg?logo=lgtm&logoWidth=18)(https://lgtm.com/projects/g/tpm2-software/tpm2-tools/context:cpp)
+
+**This site contains the code for the TPM (Trusted Platform Module) 2.0 tools based on tpm2-tss**
+
+## Build and Installation instructions:
+Instructions for building and installing the tpm2-tools are provided in the INSTALL.md(INSTALL.md) file.
+
+## Release Procedures
+Instructions for how releases are conducted, including our QA practices, please see the RELEASE.md(RELEASE.md) file.
+
+## Support
+Please use the mailing list at https://lists.linuxfoundation.org/mailman/listinfo/tpm2 for general questions. The Issue Tracker on
+github should be reserved for actual feature requests or bugs. For security bugs, please see CONTRIBUTING.md(CONTRIBUTING.md)
+for information on how to submit those.
+
+## Resources
+
+Reference the tutorials at tpm2-software.github.io(https://tpm2-software.github.io).
+
+TPM 2.0 specifications can be found at Trusted Computing Group(http://www.trustedcomputinggroup.org/).
+
+Specifically, the following sections:
+
+### The Library Specification
+This specifies the external programatic interface to the TPM:
+<https://trustedcomputinggroup.org/tpm-library-specification/>
+
+### The Enhanced System API Specification
+This is the *ESAPI* dependency mentioned in INSTALL.md(INSTALL.md). This is the enhanced software API to the tpm. The tpm2-tools
+project relies heavily on this. <https://trustedcomputinggroup.org/wp-content/uploads/TSS_ESAPI_Version-0.9_Revision-04_reviewEND030918.pdf>
+
+### The TCTI Specification
+This specifies the transmission interfaces or how bytes get from the system api to the tpm.
+<https://trustedcomputinggroup.org/wp-content/uploads/TSS_TCTI_v1.0_r04_Public-Review.pdf>
+
+### Books
+  * A Practical Guide to TPM 2.0(https://link.springer.com/book/10.1007%2F978-1-4302-6584-9) `ISBN: 978-1-4302-6583-2 (Print) 978-1-4302-6584-9 (Online)`
+
+## Contributing
+Instructions for contributing to the project are provided in the CONTRIBUTING.md(CONTRIBUTING.md) file.

_service:tar_scm:tpm2-tools-5.4.tar.gz/docs/RELEASE.md Added

@@ -0,0 +1,211 @@
+# Release Process
+This document describes the overall release process of the tpm2-tools project.
+
+# Milestones
+All releases should have a milestone used to track the release. If the release version is not known, as covered in Version Numbers(#Version Numbers),
+then an "x" may be used for the unknown number, or the generic term "next" may be used. The description field of the milestone will be used to record
+the CHANGELOG for that release. See CHANGELOG Update(#CHANGELOG Update) for details.
+
+# Release Lifecycle
+
+All tpm2-tools project releases before 4.0 is considered legacy and is or will
+be reaching end of life. Releases greater than 4.0 will always
+**will be backwards compatible**.
+
+Release will be conducted off the master branch and feature/bugfix only releas branches
+can be created off of *master* and maintained as needed.
+The majority of development will occur on *master* with tagged release numbers
+following semver.org recommendations. This page explicitly does not formalize an
+LTS support timeline, and that is intentional. The release schedules and
+required features are driven by community involvement and needs. However,
+milestones will be created to outline the goals, bugs, issues and timelines of
+the next release.
+
+## End Of Life versions
+- 1.X(https://github.com/tpm2-software/tpm2-tools/tree/1.X)
+- 2.X(https://github.com/tpm2-software/tpm2-tools/tree/2.X)
+- 3.X(https://github.com/tpm2-software/tpm2-tools/tree/3.X)
+
+# Release Information
+
+Releases shall be tagged following semantic version guidelines found at:
+  - http://semver.org/
+
+The general release process will be one of two models:
+
+- Tag releases off of branch master.
+- Tag releases off of a release specific branch.
+  - Release specific branch names can be for long-running major versions, IE 3.1, 3.2, 3.3, etc.
+    and *SHALL* be named `<major-version>.X`.
+  - Release specific branch names can be for long-running minor versions, IE 3.1.1, 3.1.2, etc.
+    and *SHALL* be named `<major-version>.<minor-version>.X`.
+
+Release candidates will be announced on the
+mailing list(https://lists.linuxfoundation.org/mailman/listinfo/tpm2). When a RC has gone 1
+week without new substantive changes, a release will be conducted. Substantive
+changes are generally not editorial in nature and they do not contain changes to
+the CI system. Substantive changes are changes to the man-pages, code or tests.
+
+When a release is cut, the process is the same as a Release Candidate (RC), with the exception that
+it is not marked as "pre-release" on GitHub. The release notes should include everything from the
+last release to the latest release.
+
+# CHANGELOG Update
+Before tagging the repository with the release version, the maintainer MUST update the CHANGELOG file with the contents from the description field
+from the corresponding release milestone and update any missing version string details in the CHANGELOG and milestone entry.
+
+The commit that updated the CHANGELOG entry will be tagged as the final release.
+
+For a final release, change the version to the final release version (i.e: 3.0.5-rc3 -> 3.0.5) and
+update the date. The commit for this change will be tagged as the release version.
+
+## Testing
+The tools code **MUST** pass the Github Actions CI testing and have a clean
+Coverity scan result performed on every release. The CI testing not
+only tests for valid outputs, but also runs tests uses clang's ASAN
+feature to detect memory corruption issues.
+  - BUG: Reconfigure Coverity: https://github.com/tpm2-software/tpm2-tools/issues/1727
+
+## Release Checklist
+
+The steps, in order, required to make a release.
+
+- Ensure current HEAD is pointing to the last commit in the release branch.
+
+- Ensure Github Actions CI(https://github.com/tpm2-software/tpm2-tools/actions) has conducted a passing build of
+  HEAD.
+
+- Update version and date information in CHANGELOG.md(CHANGELOG.md) **and** commit per the
+  CHANGELOG Update(#CHANGELOG Update) instructions.
+
+- Create a signed tag for the release. Use the version number as the title line in the tag commit
+  message and use the CHANGELOG.md(CHANGELOG.md) contents for that release as the body.
+  ```bash
+  git tag -s <tag-name>
+  ```
+
+- Build a tarball for the release and check the dist tarball. **Note**: The file name of the tarball
+  should include a match for the git tag name.
+  ```bash
+  make distcheck
+  ```
+
+- Generate a detached signature for the tarball.
+  ```bash
+  gpg --armor --detach-sign <tarball>
+  ```
+
+- Push **both** the current git HEAD (should be the CHANGELOG edit) and tag to the release branch.
+  ```bash
+  git push origin HEAD:<release-branch>
+  git push origin <tag-name>
+  ```
+
+- Verify that the Github Actions CI build passes. **Note**: Github Actions CI will have two builds, one for the
+  push to master and one for the tag push. Both should succeed.
+
+- Create a release on Github(https://github.com/tpm2-software/tpm2-tools/releases),
+  using the `<release-tag>` uploaded. If it is a release candidate, ensure you check the "pre-release"
+  box on the GitHub UI. Use the CHANGELOG.md(CHANGELOG.md) contents for
+  that release as the message for the GitHub release. **Add the dist tarball and signature file
+  to the release**.
+
+- Update the dependency-matrix(https://tpm2-software.github.io/versions/)
+  ensuring that the CI is building against a released version of:
+  - tpm2-abrmd(https://github.com/tpm2-software/tpm2-abrmd)
+  - tpm2-tss(https://github.com/tpm2-software/tpm2-tss)
+
+  Configuration can be modified via docker-prelude.sh(.ci/docker-prelude.sh).
+
+- After the release (not a release candidate) add a commit to master updating the News section of
+  the README(README.md) to point to the latest release.
+
+- Send announcement on mailing list(https://lists.linuxfoundation.org/mailman/listinfo/tpm2).
+
+
+## Historical Version Information
+
+Versions after v1.1.0 will no longer have the "v" prefix. Autoconf now sets
+the VERSION #define based on the output of git describe. See commit 2e8a07bc
+for the details.
+
+Version tags after v1.1.0 shall be signed.
+
+## Verifying git signature
+
+Valid known public keys can be reached by
+referencing the annotated tags listed below:
+
+- william-roberts-pub
+- javier-martinez-pub
+- joshua-lock-pub
+- idesai-pub
+
+or via a PGP public keyring server like:
+  - http://keyserver.pgp.com/vkd/GetWelcomeScreen.event
+
+Import the key into your keyring:
+```
+$ git show annotated-tag-name | gpg --import
+```
+
+**Example**:
+```
+$ git show william-roberts-pub | gpg --import
+```
+
+Verify the release tag:
+```
+$ git tag --verify signed-tag-name
+```
+
+# Local Release Configuration
+
+Below you will find information how to configure your machine locally to conduct releases.
+
+## Signing Key Setup
+
+Signing keys should have these four properties going forward:
+  - belong to a project maintainer.
+  - be discoverable using a public GPG key server.
+  - be associated(https://help.github.com/articles/adding-a-new-gpg-key-to-your-github-account/)
+    with the maintainers GitHub account.
+  - be discoverable via an annotated tag within the repository itself.
+
+Ensure you have a key set up:
+```
+$ gpg --list-keys
+```
+
+If you don't generate one:
+```
+$ gpg --gen-key
+```
+
+Add that key to the gitconfig:
+```bash
+git config user.signingkey gpg-key-id
+```
+
+Make sure that key is reachable as an object in the repository:
+```bash
+gpg -a --export gpg-key-id | git hash-object -w --stdin object SHA
+git tag -a your-name-here-pub object SHA
+```
+
+Make sure you push the tag referencing your public key:
+```bash
+git push origin your-name-here-pub
+```
+
+Make sure you publish your key by doing:
+  - http://keyserver.pgp.com/vkd/GetWelcomeScreen.event
+    - Select "Publish your key".
+    - Select "Key block"
+    - Copy and paste the output of `gpg --armor --export <key-id>`
+    - Validate your email account.
+
+After that, you can sign tags:
+```bash
+git tag --sign signed-tag-name
+```

_service:tar_scm:tpm2-tools-5.0.tar.gz/install-sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/install-sh Changed

@@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2014-09-12.12; # UTC
+scriptversion=2018-03-11.20; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -271,15 +271,18 @@
     fi
     dst=$dst_arg
 
-    # If destination is a directory, append the input filename; won't work
-    # if double slashes aren't ignored.
+    # If destination is a directory, append the input filename.
     if test -d "$dst"; then
       if test "$is_target_a_directory" = never; then
         echo "$0: $dst_arg: Is a directory" >&2
         exit 1
       fi
       dstdir=$dst
-      dst=$dstdir/`basename "$src"`
+      dstbase=`basename "$src"`
+      case $dst in
+	*/) dst=$dst$dstbase;;
+	*)  dst=$dst/$dstbase;;
+      esac
       dstdir_status=0
     else
       dstdir=`dirname "$dst"`
@@ -288,6 +291,11 @@
     fi
   fi
 
+  case $dstdir in
+    */) dstdirslash=$dstdir;;
+    *)  dstdirslash=$dstdir/;;
+  esac
+
   obsolete_mkdir_used=false
 
   if test $dstdir_status != 0; then
@@ -324,14 +332,16 @@
             # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
             ;;
           *)
-            # $RANDOM is not portable (e.g. dash);  use it when possible to
-            # lower collision chance
+            # Note that $RANDOM variable is not portable (e.g. dash);  Use it
+            # here however when possible just to lower collision chance.
             tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
+
             trap 'ret=$?; rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 2>/dev/null; exit $ret' 0
 
-            # As "mkdir -p" follows symlinks and we work in /tmp possibly;  so
-            # create the $tmpdir first (and fail if unsuccessful) to make sure
-            # that nobody tries to guess the $tmpdir name.
+            # Because "mkdir -p" follows existing symlinks and we likely work
+            # directly in world-writeable /tmp, make sure that the '$tmpdir'
+            # directory is successfully created first before we actually test
+            # 'mkdir -p' feature.
             if (umask $mkdir_umask &&
                 $mkdirprog $mkdir_mode "$tmpdir" &&
                 exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1
@@ -434,8 +444,8 @@
   else
 
     # Make a couple of temp file names in the proper directory.
-    dsttmp=$dstdir/_inst.$$_
-    rmtmp=$dstdir/_rm.$$_
+    dsttmp=${dstdirslash}_inst.$$_
+    rmtmp=${dstdirslash}_rm.$$_
 
     # Trap to clean up those temp files at exit.
     trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
@@ -500,9 +510,9 @@
 done
 
 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
+# time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/config.h.in -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/config.h.in Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/efi_event.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/efi_event.h Changed

@@ -2,7 +2,6 @@
 #ifndef TCG_EFI_EVENT_H
 #define TCG_EFI_EVENT_H 1
 
-#include <uuid/uuid.h>
 #include <uchar.h>
 #include <tss2/tss2_tpm2_types.h>
 
@@ -42,12 +41,28 @@
 #define EV_EFI_ACTION                    EV_EFI_EVENT_BASE + 0x7
 #define EV_EFI_PLATFORM_FIRMWARE_BLOB    EV_EFI_EVENT_BASE + 0x8
 #define EV_EFI_HANDOFF_TABLES            EV_EFI_EVENT_BASE + 0x9
+#define EV_EFI_PLATFORM_FIRMWARE_BLOB2   EV_EFI_EVENT_BASE + 0xa
+#define EV_EFI_HANDOFF_TABLES2           EV_EFI_EVENT_BASE + 0xb
+#define EV_EFI_VARIABLE_BOOT2            EV_EFI_EVENT_BASE + 0xc
+
 #define EV_EFI_VARIABLE_AUTHORITY        EV_EFI_EVENT_BASE + 0xe0
 
 #ifndef PACKED
 #define PACKED __attribute__((__packed__))
 #endif
 
+/* GUIDs used by UEFI/GPT are stored in a mixed-endian layout, where the first
+ * three fields are serialized as little-endian and the final two fields are
+ * serialized as big-endian. This differs from uuid_t which is entirely a
+ * big-endian layout (just an array of 16 bytes).
+ */
+typedef struct {
+  UINT32 Data1;
+  UINT16 Data2;
+  UINT16 Data3;
+  UINT8 Data48;
+} PACKED EFI_GUID;
+
 typedef struct {
   UINT16 AlgorithmId;
   UINT8 Digest;
@@ -66,11 +81,16 @@
  /* TCG_EVENT2 comes next */
 } PACKED TCG_EVENT_HEADER2;
 
+/* Helper structure for dealing with unaligned char16_t */
 typedef struct {
-  uuid_t VariableName;
+    char16_t c;
+} PACKED UTF16_CHAR;
+
+typedef struct {
+  EFI_GUID VariableName;
   UINT64 UnicodeNameLength;
   UINT64 VariableDataLength;
-  char16_t UnicodeName;
+  UTF16_CHAR UnicodeName;
   /* INT8 VariableData comes next */
 } PACKED UEFI_VARIABLE_DATA;
 
@@ -80,6 +100,13 @@
     UINT64 BlobLength;
 } PACKED UEFI_PLATFORM_FIRMWARE_BLOB;
 
+
+typedef struct {
+  UINT8 BlobDescriptionSize;
+  BYTE  BlobDescription;
+  /* UEFI_PLATFORM_FIRMWARE_BLOB comes next */
+} PACKED UEFI_PLATFORM_FIRMWARE_BLOB2;
+
 typedef struct {
     UINT32 pcrIndex;
     UINT32 eventType;
@@ -118,4 +145,89 @@
     BYTE DevicePath;
 } PACKED UEFI_IMAGE_LOAD_EVENT;
 
+/* 
+   These structs represent a GUID Partition Table. UEFI_GPT_DATA is defined in
+   the TGC PC Client Platform Firmware Profile Specification Version 1.05,
+   Revision 23, Table 10. UEFI_PARTITION_TABLE_HEADER and UEFI_PARTITION_ENTRY
+   are defined in the UEFI Specification Version 2.9, Section 5.3.
+ */
+typedef struct {
+    UINT64 Signature;
+    UINT32 Revision;
+    UINT32 HeaderSize;
+    UINT32 HeaderCRC32;
+    UINT32 Reserved;
+    UINT64 MyLBA;
+    UINT64 AlternateLBA;
+    UINT64 FirstUsableLBA;
+    UINT64 LastUsableLBA;
+    EFI_GUID DiskGUID;
+    UINT64 PartitionEntryLBA;
+    UINT32 NumberOfPartitionEntries;
+    UINT32 SizeOfPartitionEntry;
+    UINT32 PartitionEntryArrayCRC32;
+} PACKED UEFI_PARTITION_TABLE_HEADER;
+
+typedef struct {
+    EFI_GUID PartitionTypeGUID;
+    EFI_GUID UniquePartitionGUID;
+    UINT64 StartingLBA;
+    UINT64 EndingLBA;
+    UINT64 Attributes;
+    /* To make the entire struct 128 bytes, PartitionName is 36 characters. */
+    UTF16_CHAR PartitionName36;
+} PACKED UEFI_PARTITION_ENTRY;
+
+typedef struct {
+    UEFI_PARTITION_TABLE_HEADER UEFIPartitionHeader;
+    UINT64 NumberOfPartitions;
+    UEFI_PARTITION_ENTRY Partitions;
+} PACKED UEFI_GPT_DATA;
+
+/*
+ * An UEFI signature database is represented as a concatenated list of
+ * EFI_SIGNATURE_LIST, which contains one or more EFI_SIGNATURE_DATA. These
+ * structs are described in more details in UEFI Spec Section 32.4.1
+ */
+typedef struct {
+    EFI_GUID SignatureType;
+    UINT32 SignatureListSize;
+    UINT32 SignatureHeaderSize;
+    UINT32 SignatureSize;
+    // BYTE SignatureHeaderSignatureHeaderSize;
+    // BYTE SignaturesSignatureSize;
+} PACKED EFI_SIGNATURE_LIST;
+
+typedef struct {
+    EFI_GUID SignatureOwner;
+    BYTE SignatureData;
+} PACKED EFI_SIGNATURE_DATA;
+
+/*
+ * EFI_LOAD_OPTION describes a load option variable. This struct is described
+ * in more details in UEFI Spec Section 3.1.3
+ */
+typedef struct {
+    UINT32 Attributes;
+    UINT16 FilePathListLength;
+    UINT16 Description;
+    // EFI_DEVICE_PATH_PROTOCOL FilePathList;
+    // UINT8 OptionalData;
+} PACKED EFI_LOAD_OPTION;
+
+/*
+ * EV_NO_ACTION_STRUCT is the structure of an EV_NO_ACTION event.
+ * Described in TCG PCClient PFP section 9.4.5.
+ * The Signature identifies which arm of the union applies.
+ */
+typedef struct {
+    BYTE Signature16;
+    union {
+        BYTE StartupLocality;
+    } Cases;
+} PACKED EV_NO_ACTION_STRUCT;
+
+static const BYTE STARTUP_LOCALITY_SIGNATURE16 = {0x53, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x4C,
+    0x6F, 0x63, 0x61, 0x6C, 0x69, 0x74, 0x79, 0};
+
 #endif

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/files.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/files.c Changed

@@ -16,6 +16,7 @@
 #include "log.h"
 #include "tpm2.h"
 #include "tpm2_tool.h"
+#include "tpm2_util.h"
 
 /**
  * This is the magic for the file header. The header is organized
@@ -163,7 +164,7 @@
     return true;
 }
 
-bool files_load_bytes_from_path(const char *path, UINT8 *buf, UINT16 *size) {
+TEST_WEAK bool files_load_bytes_from_path(const char *path, UINT8 *buf, UINT16 *size) {
 
     if (!buf || !size || !path) {
         return false;
@@ -199,7 +200,7 @@
 
     bool result = files_write_bytes(fp, buf, size);
     if (!result) {
-        LOG_ERR("Could not write data to file \"%s\"", path);
+        LOG_ERR("Could not write data to file \"%s\"", path ? path : "<stdout>");
     }
 
     if (fp != stdout) {
@@ -494,7 +495,7 @@
     return false;
 }
 
-bool files_get_file_size_path(const char *path, unsigned long *file_size) {
+TEST_WEAK bool files_get_file_size_path(const char *path, unsigned long *file_size) {
 
     bool result = false;
 
@@ -564,6 +565,15 @@
     return (readx(out, bytes, len) == len);
 }
 
+bool files_read_bytes_chunk(FILE *out, UINT8 bytes, size_t len, size_t *read_len) {
+
+    BAIL_ON_NULL("FILE", out);
+    BAIL_ON_NULL("bytes", bytes);
+    size_t chunk_len = readx(out, bytes, len);
+    *read_len += chunk_len;
+    return (chunk_len == len);
+}
+
 bool files_write_bytes(FILE *out, uint8_t bytes, size_t len) {
 
     BAIL_ON_NULL("FILE", out);

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/files.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/files.h Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/object.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/object.c Changed

@@ -5,13 +5,334 @@
 #include "log.h"
 #include "object.h"
 #include "tool_rc.h"
+#include "tpm2.h"
 #include "tpm2_auth_util.h"
+#include "tpm2_util.h"
 
 #define NULL_OBJECT "null"
 #define NULL_OBJECT_LEN (sizeof(NULL_OBJECT) - 1)
 
-static tool_rc do_ctx_file(ESYS_CONTEXT *ctx, const char *objectstr, FILE *f,
-        tpm2_loaded_object *outobject) {
+TPM2B_PRIVATE tpm2_util_object_tsspem_priv = { 0 };
+TPM2B_PUBLIC tpm2_util_object_tsspem_pub = { 0 };
+
+ASN1_SEQUENCE(TSSPRIVKEY_OBJ) = {
+    ASN1_SIMPLE(TSSPRIVKEY_OBJ, type, ASN1_OBJECT),
+    ASN1_EXP_OPT(TSSPRIVKEY_OBJ, emptyAuth, ASN1_BOOLEAN, 0),
+    ASN1_SIMPLE(TSSPRIVKEY_OBJ, parent, ASN1_INTEGER),
+    ASN1_SIMPLE(TSSPRIVKEY_OBJ, pubkey, ASN1_OCTET_STRING),
+    ASN1_SIMPLE(TSSPRIVKEY_OBJ, privkey, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END(TSSPRIVKEY_OBJ)
+
+IMPLEMENT_ASN1_FUNCTIONS(TSSPRIVKEY_OBJ);
+IMPLEMENT_PEM_write_bio(TSSPRIVKEY_OBJ, TSSPRIVKEY_OBJ, TSSPRIVKEY_OBJ_PEM_STRING,
+    TSSPRIVKEY_OBJ);
+IMPLEMENT_PEM_read_bio(TSSPRIVKEY_OBJ, TSSPRIVKEY_OBJ, TSSPRIVKEY_OBJ_PEM_STRING,
+    TSSPRIVKEY_OBJ);
+
+static tool_rc tpm2_util_object_select_primary_template_alg(
+    ESYS_CONTEXT *esys_ctx, TPM2_ALG_ID *alg_id) {
+
+    tool_rc rc = tool_rc_success;
+    TPMS_CAPABILITY_DATA *capability_data = NULL;
+    TSS2_RC r = Esys_GetCapability(esys_ctx, ESYS_TR_NONE, ESYS_TR_NONE,
+        ESYS_TR_NONE, TPM2_CAP_ALGS, 0, TPM2_MAX_CAP_ALGS, NULL,
+        &capability_data);
+    if (r != TSS2_RC_SUCCESS) {
+        LOG_ERR("Unable to fetch TPM supported algorithms");
+        rc = tool_rc_general_error;
+        goto ret;
+    }
+
+    TPM2_ALG_ID id = TPM2_ALG_NULL;
+    for (uint32_t index = 0; index < capability_data->data.algorithms.count;
+        index++) {
+        if (capability_data->data.algorithms.algPropertiesindex.alg ==
+        TPM2_ALG_ECC) {
+            id = TPM2_ALG_ECC;
+            break;
+        }
+    }
+
+    if (id == TPM2_ALG_NULL) {
+        id = TPM2_ALG_RSA;
+    }
+    *alg_id = id;
+
+ret:
+    Esys_Free(capability_data);
+    return rc;
+}
+
+static tool_rc tpm2_util_object_setup_primary(ESYS_CONTEXT *esys_ctx,
+    ESYS_TR *parent) {
+
+    const TPM2B_PUBLIC *primary_template = NULL;
+
+    const TPM2B_SENSITIVE_CREATE primary_sensitive = { 0 };
+
+    const TPM2B_DATA all_outside_info = {
+        .size = 0,
+    };
+
+    const TPML_PCR_SELECTION all_creation_PCR = {
+        .count = 0,
+    };
+
+    static const TPM2B_PUBLIC primary_rsa_template = {
+        .publicArea = {
+            .type = TPM2_ALG_RSA,
+            .nameAlg = TPM2_ALG_SHA256,
+            .objectAttributes = (TPMA_OBJECT_USERWITHAUTH |
+                                TPMA_OBJECT_RESTRICTED |
+                                TPMA_OBJECT_DECRYPT |
+                                TPMA_OBJECT_NODA |
+                                TPMA_OBJECT_FIXEDTPM |
+                                TPMA_OBJECT_FIXEDPARENT |
+                                TPMA_OBJECT_SENSITIVEDATAORIGIN),
+            .authPolicy = {
+                .size = 0,
+            },
+            .parameters.rsaDetail = {
+                .symmetric = {
+                    .algorithm = TPM2_ALG_AES,
+                    .keyBits.aes = 128,
+                    .mode.aes = TPM2_ALG_CFB,
+                },
+                .scheme = {
+                    .scheme = TPM2_ALG_NULL,
+                    .details = {}
+                },
+                .keyBits = 2048,
+                .exponent = 0,
+            },
+            .unique.rsa = {
+                .size = 0,
+            }
+        }
+    };
+
+    static const TPM2B_PUBLIC primary_ecc_template = {
+        .publicArea = {
+            .type = TPM2_ALG_ECC,
+            .nameAlg = TPM2_ALG_SHA256,
+            .objectAttributes = (TPMA_OBJECT_USERWITHAUTH |
+                                TPMA_OBJECT_RESTRICTED |
+                                TPMA_OBJECT_DECRYPT |
+                                TPMA_OBJECT_NODA |
+                                TPMA_OBJECT_FIXEDTPM |
+                                TPMA_OBJECT_FIXEDPARENT |
+                                TPMA_OBJECT_SENSITIVEDATAORIGIN),
+            .authPolicy = {
+                .size = 0,
+            },
+            .parameters.eccDetail = {
+                .symmetric = {
+                    .algorithm = TPM2_ALG_AES,
+                    .keyBits.aes = 128,
+                    .mode.aes = TPM2_ALG_CFB,
+                },
+                .scheme = {
+                    .scheme = TPM2_ALG_NULL,
+                    .details = {}
+                },
+                .curveID = TPM2_ECC_NIST_P256,
+                .kdf = {
+                    .scheme = TPM2_ALG_NULL,
+                    .details = {}
+                },
+            },
+            .unique.ecc = {
+                .x.size = 0,
+                .y.size = 0
+            }
+        }
+    };
+
+    TPM2_ALG_ID alg_id;
+    tool_rc rc = tpm2_util_object_select_primary_template_alg(esys_ctx, &alg_id);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Unable to correctly select primary template");
+        goto ret;
+    }
+
+    if (alg_id == TPM2_ALG_ECC) {
+        primary_template = &primary_ecc_template;
+    } else {
+        primary_template = &primary_rsa_template;
+    }
+
+    TSS2_RC r = Esys_CreatePrimary(esys_ctx, ESYS_TR_RH_OWNER, ESYS_TR_PASSWORD,
+        ESYS_TR_NONE, ESYS_TR_NONE, &primary_sensitive, primary_template,
+        &all_outside_info, &all_creation_PCR, parent, NULL, NULL, NULL, NULL);
+    if (r != TSS2_RC_SUCCESS) {
+        LOG_ERR("Unable to run create primary");
+        rc = tool_rc_general_error;
+        goto ret;
+    }
+
+ret:
+    return rc;
+}
+
+__attribute__((weak))
+tool_rc tpm2_util_object_fetch_tssprivkey_from_file(const char *objectstr,
+    BIO **input_bio, TSSPRIVKEY_OBJ **tpk) {
+
+    tool_rc rc = tool_rc_general_error;
+    *input_bio = BIO_new_file(objectstr, "rb");
+    if (!*input_bio) {
+        LOG_ERR("Unable to read as BIO file");
+        goto ret;
+    }
+
+    *tpk = PEM_read_bio_TSSPRIVKEY_OBJ(*input_bio, NULL, NULL,
+        NULL);
+    if (*tpk == NULL) {
+        LOG_ERR("Unable to read PEM from provided BIO/file");
+        goto ret;
+    }
+    rc = tool_rc_success;
+
+ret:
+    return rc;
+}
+
+tool_rc tpm2_util_object_fetch_parent_from_tpk(const char *objectstr,
+    uint64_t *val) {
+
+    BIO *input_bio = 0;
+    TSSPRIVKEY_OBJ *tpk = 0;
+    BIGNUM *bn_parent = 0;
+    tool_rc rc = tpm2_util_object_fetch_tssprivkey_from_file(objectstr, &input_bio, &tpk);
+    if (rc != tool_rc_success) {
+        goto ret;
+    }
+
+    rc = tool_rc_general_error;
+    bn_parent = ASN1_INTEGER_to_BN(tpk->parent, NULL);
+    if (!bn_parent) {
+        goto ret;
+    }
+
+    TPM2_HANDLE parent = 0;
+    bool is_bn_parent_negative = BN_is_negative(bn_parent);
+    if (is_bn_parent_negative) {
+        parent = ASN1_INTEGER_get(tpk->parent);
+    } else {
+        parent = BN_get_word(bn_parent);
+    }
+
+    if (parent == 0) {
+        LOG_ERR("Unable to convert parent to integer/value too large");
+        goto ret;
+    }
+    *val = parent;
+    rc = tool_rc_success;
+
+ret:
+    BN_free(bn_parent);
+    if (input_bio) {
+        BIO_free(input_bio);
+    }
+    if (tpk) {
+        TSSPRIVKEY_OBJ_free(tpk);
+    }
+    return rc;
+}
+
+tool_rc tpm2_util_object_fetch_priv_pub_from_tpk(const char *objectstr,
+        TPM2B_PUBLIC *pub, TPM2B_PRIVATE *priv) {
+
+    tool_rc rc = tool_rc_general_error;
+    BIO *input_bio = 0;
+    TSSPRIVKEY_OBJ *tpk = 0;
+    tpm2_util_object_fetch_tssprivkey_from_file(objectstr, &input_bio, &tpk);
+    if (!input_bio || !tpk) {
+        goto ret;
+    }
+
+    int pub_len = tpk->pubkey->length;
+    int priv_len = tpk->privkey->length;
+    if (pub_len < 1 || priv_len < 1) {
+        LOG_ERR("Error deserializing TSS Privkey Object");
+        goto ret;
+    }
+            
+    rc = Tss2_MU_TPM2B_PUBLIC_Unmarshal(tpk->pubkey->data, pub_len,
+        NULL, pub);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Error deserializing public portion of object");
+        goto ret;
+    }
+
+    rc = Tss2_MU_TPM2B_PRIVATE_Unmarshal(tpk->privkey->data, priv_len,
+        NULL, priv);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Error deserializing private portion of object");
+    }
+
+ret:
+    if (input_bio) {
+        BIO_free(input_bio);
+    }
+    if (tpk) {
+        TSSPRIVKEY_OBJ_free(tpk);
+    }
+    return rc;
+}
+
+static tool_rc tpm2_util_object_load_tsspem(ESYS_CONTEXT *ctx,
+        const char *objectstr, tpm2_loaded_object *outobject) {
+
+    /*
+     * fetch out the various parts of the PEM file using openssl API
+     */
+    tool_rc rc = tpm2_util_object_fetch_priv_pub_from_tpk(objectstr,
+        &tpm2_util_object_tsspem_pub, &tpm2_util_object_tsspem_priv);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Unable to fetch public/private portions of TSS PRIVKEY");
+        return rc;
+    }
+
+    uint64_t val;
+    rc = tpm2_util_object_fetch_parent_from_tpk(objectstr, &val);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    bool is_persistent_parent = (val != TPM2_RH_OWNER && val != 0);
+    if (!is_persistent_parent) {
+        ESYS_TR obj_parent = ESYS_TR_NONE;
+        rc = tpm2_util_object_setup_primary(ctx, &obj_parent);
+        if (rc != tool_rc_success) {
+            LOG_ERR("Unable to create parent using createprimary");
+            return rc;
+        }
+
+        outobject->tr_handle = obj_parent;
+        rc = Esys_TR_GetTpmHandle(ctx, obj_parent,
+            &outobject->handle);
+        if (rc != TSS2_RC_SUCCESS) {
+            LOG_ERR("Unable to fetch TPM handle from ESYS TR handle");
+            return rc;
+        }
+    } else {
+        ESYS_TR tr_parent = ESYS_TR_NONE;
+        rc = tpm2_from_tpm_public(ctx, val, ESYS_TR_NONE, ESYS_TR_NONE,
+            ESYS_TR_NONE, &tr_parent);
+        if (rc != tool_rc_success) {
+            LOG_ERR("Unable to fetch TR Handle for persistent parent");
+            return rc;
+        }
+
+        outobject->tr_handle = tr_parent;
+    }
+
+    return rc;
+}
+
+static tool_rc tpm2_util_object_do_ctx_file(ESYS_CONTEXT *ctx,
+    const char *objectstr, FILE *f, tpm2_loaded_object *outobject) {
     /* assign a dummy transient handle */
     outobject->handle = TPM2_TRANSIENT_FIRST;
     outobject->path = objectstr;
@@ -19,15 +340,14 @@
 }
 
 static tool_rc tpm2_util_object_load2(ESYS_CONTEXT *ctx, const char *objectstr,
-        const char *auth,
-        bool do_auth, tpm2_loaded_object *outobject,
+        const char *auth, bool do_auth, tpm2_loaded_object *outobject,
         bool is_restricted_pswd_session, tpm2_handle_flags flags) {
 
-    ESYS_CONTEXT *tmp_ctx = is_restricted_pswd_session ? NULL : ctx;
-
+    tool_rc rc = tool_rc_success;
     if (do_auth) {
+        ESYS_CONTEXT *tmp_ctx = is_restricted_pswd_session ? NULL : ctx;
         tpm2_session *s = NULL;
-        tool_rc rc = tpm2_auth_util_from_optarg(tmp_ctx, auth, &s,
+        rc = tpm2_auth_util_from_optarg(tmp_ctx, auth, &s,
                 is_restricted_pswd_session);
         if (rc != tool_rc_success) {
             return rc;
@@ -41,34 +361,40 @@
         return tool_rc_general_error;
     }
 
-    // 1. Always attempt file
+    // 1. Attempt objectstr as a file path for context file.
     FILE *f = fopen(objectstr, "rb");
     if (f) {
-        tool_rc rc = do_ctx_file(ctx, objectstr, f, outobject);
+        rc = tpm2_util_object_do_ctx_file(ctx, objectstr, f, outobject);
         fclose(f);
-        return rc;
+        if (rc == tool_rc_success) {
+            return rc;
+        }
     }
 
-    // 2. Try to convert a hierarchy or raw handle
+    // 2. Attempt converting objectstr to a hierarchy or raw handle
     TPMI_RH_PROVISION handle;
     bool result = tpm2_util_handle_from_optarg(objectstr, &handle, flags);
     if (result) {
         outobject->handle = handle;
         outobject->path = NULL;
         return tpm2_util_sys_handle_to_esys_handle(ctx, outobject->handle,
-                &outobject->tr_handle);
+            &outobject->tr_handle);
     }
 
-    LOG_ERR("Cannot make sense of object context \"%s\"", objectstr);
+    // 3. Attempt objectstr as a file path for TSSPEM/ TSS-PRIVATE-KEY
+    rc = tpm2_util_object_load_tsspem(ctx, objectstr, outobject);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Cannot make sense of object context \"%s\"", objectstr);
+    }
 
-    return tool_rc_general_error;
+    return rc;
 }
 
 tool_rc tpm2_util_object_load(ESYS_CONTEXT *ctx, const char *objectstr,
         tpm2_loaded_object *outobject, tpm2_handle_flags flags) {
 
     return tpm2_util_object_load2(ctx, objectstr, NULL, false, outobject,
-    false, flags);
+        false, flags);
 }
 
 tool_rc tpm2_util_object_load_auth(ESYS_CONTEXT *ctx, const char *objectstr,

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/object.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/object.h Changed

@@ -5,6 +5,12 @@
 #include "tpm2_session.h"
 #include "tpm2_util.h"
 
+#include <openssl/pem.h>
+#include <openssl/bio.h>
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
+#include <tss2/tss2_mu.h>
+
 typedef struct tpm2_loaded_object tpm2_loaded_object;
 struct tpm2_loaded_object {
     TPM2_HANDLE handle;
@@ -13,6 +19,27 @@
     tpm2_session *session;
 };
 
+typedef struct {
+    ASN1_OBJECT *type;
+    ASN1_BOOLEAN emptyAuth;
+    ASN1_INTEGER *parent;
+    ASN1_OCTET_STRING *pubkey;
+    ASN1_OCTET_STRING *privkey;
+} TSSPRIVKEY_OBJ;
+
+#define OID_loadableKey "2.23.133.10.1.3"
+#define TSSPRIVKEY_OBJ_PEM_STRING "TSS2 PRIVATE KEY"
+
+DECLARE_ASN1_FUNCTIONS(TSSPRIVKEY_OBJ);
+DECLARE_PEM_write_bio(TSSPRIVKEY_OBJ, TSSPRIVKEY_OBJ);
+DECLARE_PEM_read_bio(TSSPRIVKEY_OBJ, TSSPRIVKEY_OBJ);
+
+/*
+ * TPM2B_PRIVATE and TPM2B_PUBLIC parsed from a TSSPEM/ tssprivkey
+ */
+extern TPM2B_PRIVATE tpm2_util_object_tsspem_priv;
+extern TPM2B_PUBLIC tpm2_util_object_tsspem_pub;
+
 /**
  * Parses a string representation of a context object, either a file or handle,
  * and loads the context object ensuring the handle member of the out object is
@@ -61,4 +88,33 @@
         const char *auth, tpm2_loaded_object *outobject,
         bool is_restricted_pswd_session, tpm2_handle_flags flags);
 
+/**
+ * Fetches the unmarshalled public and private portions of the
+ * TSS Privkey object.
+ * 
+ * @param objectstr
+ * Path to file containing the TSS PRIVKEY object.
+ * @param pub
+ * The unmarshalled public portion of TSS Private Key.
+ * @param priv
+ * The unmarshalled private portion of TSS Private Key.
+ * @return
+ *  tool_rc indicating the status.
+ */
+tool_rc tpm2_util_object_fetch_priv_pub_from_tpk(const char *objectstr,
+        TPM2B_PUBLIC *pub, TPM2B_PRIVATE *priv);
+
+/**
+ * Fetch TPK parent value as a long int
+ * 
+ * @param objectstr
+ * Path to file containing the TSS PRIVKEY object.
+ * @param val
+ * Parent value in long int
+ * @return
+ *  tool_rc indicating the status.
+ */
+tool_rc tpm2_util_object_fetch_parent_from_tpk(const char *objectstr,
+        uint64_t *val);
+
 #endif /* LIB_OBJECT_H_ */

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/pcr.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/pcr.c Changed

@@ -54,6 +54,13 @@
         pcr_select->pcrSelect2 = 0xff;
         return true;
     }
+    
+    if (!strncmp(str, "none", 4)) {
+        pcr_select->pcrSelect0 = 0x00;
+        pcr_select->pcrSelect1 = 0x00;
+        pcr_select->pcrSelect2 = 0x00;
+        return true;
+    }
 
     do {
         current_string = str;
@@ -230,30 +237,119 @@
     return result;
 }
 
-bool pcr_print_pcr_struct(TPML_PCR_SELECTION *pcr_select, tpm2_pcrs *pcrs) {
+bool pcr_fwrite_serialized(const TPML_PCR_SELECTION *pcr_select,
+    const tpm2_pcrs *ppcrs, FILE *output_file) {
 
-    UINT32 vi = 0, di = 0, i;
-    bool result = true;
+    TPML_PCR_SELECTION pcr_selection = *pcr_select;
+    for (UINT32 i = 0; i < pcr_selection.count; i++) {
+        TPMS_PCR_SELECTION *p = &pcr_selection.pcrSelectionsi;
+        p->hash = htole16(p->hash);
+    }
+    pcr_selection.count = htole32(pcr_selection.count);
 
-    tpm2_tool_output("pcrs:\n");
+    // Export TPML_PCR_SELECTION structure to pcr outfile
+    size_t fwrite_len = fwrite(&pcr_selection, sizeof(TPML_PCR_SELECTION),
+        1, output_file);
+    if (fwrite_len != 1) {
+        LOG_ERR("write to output file failed: %s", strerror(errno));
+        return false;
+    }
+
+    // Export PCR digests to pcr outfile
+    UINT32 count = htole32(ppcrs->count);
+    fwrite_len = fwrite(&count, sizeof(UINT32), 1, output_file);
+    if (fwrite_len != 1) {
+        LOG_ERR("write to output file failed: %s", strerror(errno));
+        return false;
+    }
+
+    tpm2_pcrs pcrs = *ppcrs;
+    for (size_t j = 0; j < pcrs.count; j++) {
+        TPML_DIGEST *pcr_value = &pcrs.pcr_valuesj;
+
+        for (size_t k = 0; k < pcr_value->count; k++) {
+            TPM2B_DIGEST *p = &pcr_value->digestsk;
+            p->size = htole16(p->size);
+        }
+        pcr_value->count = htole32(pcr_value->count);
+        fwrite_len = fwrite(pcr_value, sizeof(TPML_DIGEST), 1, output_file);
+        if (fwrite_len != 1) {
+            LOG_ERR("write to output file failed: %s", strerror(errno));
+            return false;
+        }
+    }
+
+    return true;
+}
+
+bool pcr_fwrite_values(const TPML_PCR_SELECTION *pcr_select,
+    const tpm2_pcrs *pcrs, FILE *output_file) {
 
+    size_t vi = 0;  /* value index */
+    UINT32 di = 0;  /* digest index */
     // Loop through all PCR/hash banks
-    for (i = 0; i < pcr_select->count; i++) {
-        const char *alg_name = tpm2_alg_util_algtostr(
-                pcr_select->pcrSelectionsi.hash, tpm2_alg_util_flags_hash);
+    for (UINT32 i = 0; i < pcr_select->count; i++) {
+        const TPMS_PCR_SELECTION *pcr_selection = &pcr_select->pcrSelectionsi;
+        // Loop through all PCRs in this bank
+        for (unsigned int pcr_id = 0; pcr_id < pcr_selection->sizeofSelect * 8u;
+            pcr_id++) {
+
+            bool is_pcr_select_bit_set = tpm2_util_is_pcr_select_bit_set(
+                pcr_selection, pcr_id);
+            if (! is_pcr_select_bit_set) {
+                // skip non-selected banks
+                continue;
+            }
+            const TPML_DIGEST *pcr_value = &pcrs->pcr_valuesvi;
+            if (vi >= pcrs->count || di >= pcr_value->count) {
+                LOG_ERR("Something wrong, trying to print but nothing more");
+                return false;
+            }
+
+            // Print out current PCR digest value
+            const TPM2B_DIGEST *digest = &pcr_value->digestsdi;
+            size_t fwrite_len = fwrite(digest->buffer, digest->size, 1,
+                output_file);
+            if (fwrite_len != 1) {
+                LOG_ERR("write to output file failed: %s", strerror(errno));
+                return false;
+            }
+
+            if (++di >= pcr_value->count) {
+                di = 0;
+                ++vi;
+            }
+        } /* end looping through all PCRs in a bank */
+    }  /* end looping through all PCR banks */
+
+    return true;
+}
+
+bool pcr_print_values(const TPML_PCR_SELECTION *pcr_select,
+    const tpm2_pcrs *pcrs) {
+
+    size_t vi = 0;  /* value index */
+    UINT32 di = 0;  /* digest index */
+    // Loop through all PCR/hash banks
+    for (UINT32 i = 0; i < pcr_select->count; i++) {
+        const TPMS_PCR_SELECTION *pcr_selection = &pcr_select->pcrSelectionsi;
+        const char *alg_name = tpm2_alg_util_algtostr(pcr_selection->hash,
+            tpm2_alg_util_flags_hash);
 
         tpm2_tool_output("  %s:\n", alg_name);
 
         // Loop through all PCRs in this bank
-        unsigned int pcr_id;
-        for (pcr_id = 0; pcr_id < pcr_select->pcrSelectionsi.sizeofSelect * 8u;
-                pcr_id++) {
-            if (!tpm2_util_is_pcr_select_bit_set(&pcr_select->pcrSelectionsi,
-                    pcr_id)) {
+        for (unsigned int pcr_id = 0; pcr_id < pcr_selection->sizeofSelect * 8u;
+            pcr_id++) {
+
+            bool is_pcr_select_bit_set = tpm2_util_is_pcr_select_bit_set(
+                pcr_selection, pcr_id);
+            if (! is_pcr_select_bit_set) {
                 // skip non-selected banks
                 continue;
             }
-            if (vi >= pcrs->count || di >= pcrs->pcr_valuesvi.count) {
+            const TPML_DIGEST *pcr_value = &pcrs->pcr_valuesvi;
+            if (vi >= pcrs->count || di >= pcr_value->count) {
                 LOG_ERR("Something wrong, trying to print but nothing more");
                 return false;
             }
@@ -262,25 +358,25 @@
             tpm2_tool_output("    %-2d: 0x", pcr_id);
 
             // Print out current PCR digest value
-            TPM2B_DIGEST *b = &pcrs->pcr_valuesvi.digestsdi;
-            int k;
-            for (k = 0; k < b->size; k++) {
-                tpm2_tool_output("%02X", b->bufferk);
+            const TPM2B_DIGEST *digest = &pcr_value->digestsdi;
+            for (int k = 0; k < digest->size; k++) {
+                tpm2_tool_output("%02X", digest->bufferk);
             }
             tpm2_tool_output("\n");
 
-            if (++di < pcrs->pcr_valuesvi.count) {
-                continue;
+            if (++di >= pcr_value->count) {
+                di = 0;
+                ++vi;
             }
+        } /* end looping through all PCRs in a bank */
+    }  /* end looping through all PCR banks */
 
-            di = 0;
-            if (++vi < pcrs->count) {
-                continue;
-            }
-        }
-    }
+    return true;
+}
 
-    return result;
+bool pcr_print_pcr_struct(TPML_PCR_SELECTION *pcr_select, tpm2_pcrs *pcrs) {
+    tpm2_tool_output("pcrs:\n");
+    return pcr_print_values(pcr_select, pcrs);
 }
 
 bool pcr_print_pcr_selections(TPML_PCR_SELECTION *pcr_selections) {
@@ -453,7 +549,8 @@
 }
 
 tool_rc pcr_read_pcr_values(ESYS_CONTEXT *esys_context,
-        TPML_PCR_SELECTION *pcr_select, tpm2_pcrs *pcrs) {
+        TPML_PCR_SELECTION *pcr_select, tpm2_pcrs *pcrs, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm) {
 
     TPML_PCR_SELECTION pcr_selection_tmp;
     TPML_PCR_SELECTION *pcr_selection_out;
@@ -468,9 +565,9 @@
         TPML_DIGEST *v;
         tool_rc rc = tpm2_pcr_read(esys_context, ESYS_TR_NONE, ESYS_TR_NONE,
                 ESYS_TR_NONE, &pcr_selection_tmp, &pcr_update_counter,
-                &pcr_selection_out, &v);
+                &pcr_selection_out, &v, cp_hash, parameter_hash_algorithm);
 
-        if (rc != tool_rc_success) {
+        if (rc != tool_rc_success || (cp_hash && cp_hash->size)) {
             return rc;
         }

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/pcr.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/pcr.h Changed

@@ -3,6 +3,8 @@
 #ifndef SRC_PCR_H_
 #define SRC_PCR_H_
 
+#include <errno.h>
+#include <stdio.h>
 #include <stdbool.h>
 
 #include <tss2/tss2_esys.h>
@@ -57,6 +59,37 @@
 
 bool pcr_print_pcr_selections(TPML_PCR_SELECTION *pcr_selections);
 
+/**
+ * Prints the selected PCR values.
+ *
+ * @param pcr_select the selected pcrs to be printed
+ * @param pcrs the pcrs digests
+ * @return true on success; false otherwise
+ */
+bool pcr_print_values(const TPML_PCR_SELECTION *pcr_select,
+    const tpm2_pcrs *pcrs);
+
+/**
+ * Writes the selected PCR values to a file.
+ *
+ * @param pcr_select the selected pcrs to be written
+ * @param pcrs the pcrs digests
+ * @param output_file file to output the pcr values
+ * @return true on success; false otherwise
+ */
+bool pcr_fwrite_values(const TPML_PCR_SELECTION *pcr_select,
+    const tpm2_pcrs *pcrs, FILE *output_file);
+/**
+ * Writes the selected PCR values to a file in serialized format.
+ *
+ * @param pcr_select the selected pcrs to be written
+ * @param pcrs the pcrs digests
+ * @param output_file file to output the pcr values in serialized format
+ * @return true on success; false otherwise
+ */
+bool pcr_fwrite_serialized(const TPML_PCR_SELECTION *pcr_select,
+    const tpm2_pcrs *pcrs, FILE *output_file);
+
 bool pcr_parse_selections(const char *arg, TPML_PCR_SELECTION *pcr_selections);
 
 tool_rc pcr_get_banks(ESYS_CONTEXT *esys_context,
@@ -69,6 +102,7 @@
         TPML_PCR_SELECTION *pcr_selections);
 
 tool_rc pcr_read_pcr_values(ESYS_CONTEXT *esys_context,
-        TPML_PCR_SELECTION *pcr_selections, tpm2_pcrs *pcrs);
+        TPML_PCR_SELECTION *pcr_selections, tpm2_pcrs *pcrs,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 #endif /* SRC_PCR_H_ */

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tool_rc.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tool_rc.c Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2.c Changed

@@ -98,18 +98,83 @@
     return tool_rc_success;
 }
 
-tool_rc tpm2_nv_readpublic(ESYS_CONTEXT *esys_context, ESYS_TR nv_index,
-        TPM2B_NV_PUBLIC **nv_public, TPM2B_NAME **nv_name) {
+tool_rc tpm2_nv_readpublic(ESYS_CONTEXT *esys_context, TPMI_RH_NV_INDEX nv_index,
+    TPM2B_NAME *precalc_nvname, TPM2B_NV_PUBLIC **nv_public,
+    TPM2B_NAME **nv_name, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle1, ESYS_TR shandle2,
+    ESYS_TR shandle3) {
+
+    /*
+     * If command is to be dispatched the NV index must exist.
+     * In this case get the NV index name by reading its public information.
+     * If rpHash size is non zero then command is always dispatched.
+     */
+    ESYS_TR esys_tr_nv_handle = ESYS_TR_NONE;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    bool is_name_specified = precalc_nvname ? precalc_nvname->size : false;
+    if (!is_name_specified) {
+        rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
+                ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_TR_FromTPMPublic, rval);
+            return tool_rc_from_tpm(rval);
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    TSS2_SYS_CONTEXT *sys_context = 0;
+    if ((cp_hash && cp_hash->size) || (rp_hash && rp_hash->size)) {
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire SAPI context.");
+            return rc;
+        }
+    }
 
-    TSS2_RC rval = Esys_NV_ReadPublic(esys_context, nv_index,
-            ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, nv_public, nv_name);
+    if (cp_hash && cp_hash->size) {
+        rval = Tss2_Sys_NV_ReadPublic_Prepare(sys_context, nv_index);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_NV_ReadPublic_Prepare, rval);
+            return tool_rc_general_error;
+        }
 
+        TPM2B_NAME *name1 = 0;
+        if (is_name_specified) {
+            name1 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name1);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvreadpublic_free_name1;
+            }
+        }
+
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
+
+tpm2_nvreadpublic_free_name1:
+        if (!is_name_specified) {
+            Esys_Free(name1);
+        }
+
+        if (rc != tool_rc_success || (rp_hash && !rp_hash->size)) {
+            goto tpm2_nvreadpublic_skip_esapi_call;
+        }
+    }
+
+    rval = Esys_NV_ReadPublic(esys_context, esys_tr_nv_handle, shandle1,
+        shandle2, shandle3, nv_public, nv_name);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_NV_ReadPublic, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+    if (rp_hash && rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
+tpm2_nvreadpublic_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_getcap(ESYS_CONTEXT *esys_context, TPM2_CAP capability,
@@ -127,37 +192,40 @@
 }
 
 tool_rc tpm2_nv_read(ESYS_CONTEXT *esys_context,
-    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index, UINT16 size,
-    UINT16 offset, TPM2B_MAX_NV_BUFFER **data, TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR esys_tr_nv_handle;
-    TSS2_RC rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
-            ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
-    if (rval != TPM2_RC_SUCCESS) {
-        LOG_PERR(Esys_TR_FromTPMPublic, rval);
-        return tool_rc_from_tpm(rval);
-    }
-
-    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
-            &auth_hierarchy_obj_session_handle);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to get shandle");
-        return rc;
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_NAME *precalc_nvname, UINT16 size, UINT16 offset,
+    TPM2B_MAX_NV_BUFFER **data, TPM2B_DIGEST *cp_hash,  TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2,
+    ESYS_TR shandle3) {
+
+    /*
+     * If command is to be dispatched the NV index must exist.
+     * In this case get the NV index name by reading its public information.
+     * If rpHash size is non zero then command is always dispatched.
+     */
+    ESYS_TR esys_tr_nv_handle = ESYS_TR_NONE;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    bool is_name_specified = precalc_nvname ? precalc_nvname->size : false;
+    if (!is_name_specified) {
+        rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
+                ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_TR_FromTPMPublic, rval);
+            return tool_rc_from_tpm(rval);
+        }
     }
 
-        if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         rval = Tss2_Sys_NV_Read_Prepare(sys_context, auth_hierarchy_obj->handle,
             nv_index, size, offset);
         if (rval != TPM2_RC_SUCCESS) {
@@ -165,39 +233,81 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle, &name1);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvread_free_name1;
+        /*
+         * We need this to use precalc-name for parent authorization when the
+         * NV index itself is the authorization parent AND
+         * we don't need/have the NV index defined when simply calculating cpHash.
+         */
+        bool is_auth_hierarchy_nv_index =
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_OWNER) &&
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_PLATFORM);
+        /*
+         * We need this to avoid requiring an NV-index be defined when simply
+         * calculating cpHash.
+         */
+        TPM2B_NAME *name1 = 0;
+        if (is_auth_hierarchy_nv_index && is_name_specified) {
+            name1 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
+                &name1);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvread_free_name1;
+            }
         }
 
-        TPM2B_NAME *name2 = NULL;
-        rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvread_free_name1_name2;
+        TPM2B_NAME *name2 = 0;
+        if (is_name_specified) {
+            name2 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvread_free_name1_name2;
+            }
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
+
+tpm2_nvread_free_name1_name2:
+        if (!(is_name_specified)) {
+            Esys_Free(name2);
+        }
+tpm2_nvread_free_name1:
+        if (!is_name_specified) {
+            Esys_Free(name1);
+        }
+
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
-tpm2_nvread_free_name1_name2:
-        Esys_Free(name2);
-tpm2_nvread_free_name1:
-        Esys_Free(name1);
-        goto tpm2_nvread_skip_esapi_call;
+        if (!rp_hash->size) {
+            goto tpm2_nvread_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context,
+            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
+            &auth_hierarchy_obj_session_handle);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to get shandle");
+        return rc;
     }
 
     rval = Esys_NV_Read(esys_context, auth_hierarchy_obj->tr_handle,
-        esys_tr_nv_handle, auth_hierarchy_obj_session_handle, ESYS_TR_NONE,
-        ESYS_TR_NONE, size, offset, data);
+        esys_tr_nv_handle, auth_hierarchy_obj_session_handle, shandle2,
+        shandle3, size, offset, data);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_NV_Read, rval);
         return tool_rc_from_tpm(rval);
     }
+
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_nvread_skip_esapi_call:
     return rc;
 }
@@ -226,26 +336,94 @@
     return tool_rc_success;
 }
 
-tool_rc tpm2_flush_context(ESYS_CONTEXT *esys_context, ESYS_TR flush_handle) {
+tool_rc tpm2_flush_context(ESYS_CONTEXT *esys_context, ESYS_TR flush_handle,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
+
+   tool_rc rc = tool_rc_success;
+   TSS2_RC rval = TSS2_RC_SUCCESS;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_FlushContext_Prepare SAPI context.");
+            return rc;
+        }
+
+        TPM2_HANDLE sapi_flush_handle = 0;
+        rval = Esys_TR_GetTpmHandle(esys_context, flush_handle,
+            &sapi_flush_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to acquire SAPI handle");
+            return tool_rc_general_error;
+        }
+
+        TSS2_RC rval = Tss2_Sys_FlushContext_Prepare(
+        sys_context, sapi_flush_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_FlushContext_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        /*
+         * There is a bug in SAPI where in the flush handle is placed in the
+         * handle area instead of the parameter area.
+         * Ref: https://github.com/tpm2-software/tpm2-tss/issues/2382
+         *
+         * We determine this scenario by reading the parameter size in the
+         * cpBuffer which is returned as zero due to the bug. 
+         *
+         * When calculating the cpHash, the workaround for this scenario is to
+         * provide the flush handle as a name.
+         */
+        const uint8_t *command_parameters;
+        size_t command_parameters_size;
+        rval = Tss2_Sys_GetCpBuffer(sys_context, &command_parameters_size,
+            &command_parameters);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_GetCpBuffer, rval);
+            return tool_rc_general_error;
+        }
 
-    TSS2_RC rval = Esys_FlushContext(esys_context, flush_handle);
+        TPM2B_NAME name1 = { 0 };
+        if (!command_parameters_size) {
+            name1.size = sizeof(TPM2_HANDLE);
+            rval = Tss2_MU_TPM2_HANDLE_Marshal(sapi_flush_handle, name1.name,
+                name1.size, 0);
+            if (rval != TPM2_RC_SUCCESS) {
+                LOG_ERR("Failed to populate SAPI handle");
+                return tool_rc_general_error;
+            }
+        }
+
+        rc = tpm2_sapi_getcphash(sys_context, name1.size ? &name1 : NULL, NULL,
+            NULL, parameter_hash_algorithm, cp_hash);
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        goto tpm2_flushcontext_skip_esapi_call;
+    }
+
+    rval = Esys_FlushContext(esys_context, flush_handle);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_FlushContext, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_flushcontext_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_start_auth_session(ESYS_CONTEXT *esys_context, ESYS_TR tpm_key,
-        ESYS_TR bind, ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
-        const TPM2B_NONCE *nonce_caller, TPM2_SE session_type,
+        ESYS_TR bind, const TPM2B_NONCE *nonce_caller, TPM2_SE session_type,
         const TPMT_SYM_DEF *symmetric, TPMI_ALG_HASH auth_hash,
         ESYS_TR *session_handle) {
 
-    TSS2_RC rval = Esys_StartAuthSession(esys_context, tpm_key, bind, shandle1,
-            shandle2, shandle3, nonce_caller, session_type, symmetric,
-            auth_hash, session_handle);
+    TSS2_RC rval = Esys_StartAuthSession(esys_context, tpm_key, bind,
+    ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, nonce_caller, session_type,
+    symmetric, auth_hash, session_handle);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_StartAuthSession, rval);
         return tool_rc_from_tpm(rval);
@@ -292,16 +470,63 @@
 }
 
 tool_rc tpm2_policy_restart(ESYS_CONTEXT *esys_context, ESYS_TR session_handle,
-        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3) {
+        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
 
-    TSS2_RC rval = Esys_PolicyRestart(esys_context, session_handle, shandle1,
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_PolicyRestart_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_PolicyRestart_Prepare(
+        sys_context, session_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_PolicyRestart_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2_HANDLE sapi_policy_session = 0;
+        rval = Esys_TR_GetTpmHandle(esys_context, session_handle,
+            &sapi_policy_session);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to acquire SAPI handle");
+            return tool_rc_general_error;
+        }
+              
+        TPM2B_NAME name1 = { 0 };
+        name1.size = sizeof(TPM2_HANDLE);
+        rval = Tss2_MU_TPM2_HANDLE_Marshal(sapi_policy_session, name1.name,
+            name1.size, 0);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to populate SAPI handle");
+            return tool_rc_general_error;
+        }
+        rc = tpm2_sapi_getcphash(sys_context, &name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+
+        goto tpm2_policyrestart_skip_esapi_call;
+    }
+
+    rval = Esys_PolicyRestart(esys_context, session_handle, shandle1,
             shandle2, shandle3);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_PolicyRestart, rval);
         return tool_rc_from_tpm(rval);
     }
-
-    return tool_rc_success;
+tpm2_policyrestart_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_get_capability(ESYS_CONTEXT *esys_context, ESYS_TR shandle1,
@@ -319,18 +544,64 @@
     return tool_rc_success;
 }
 
-tool_rc tpm2_create_primary(ESYS_CONTEXT *esys_context, ESYS_TR primary_handle,
-        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
-        const TPM2B_SENSITIVE_CREATE *in_sensitive, const TPM2B_PUBLIC *in_public,
-        const TPM2B_DATA *outside_info, const TPML_PCR_SELECTION *creation_pcr,
-        ESYS_TR *object_handle, TPM2B_PUBLIC **out_public,
-        TPM2B_CREATION_DATA **creation_data, TPM2B_DIGEST **creation_hash,
-        TPMT_TK_CREATION **creation_ticket) {
+tool_rc tpm2_create_primary(ESYS_CONTEXT *esys_context,
+    tpm2_loaded_object *auth_hierarchy_obj,
+    const TPM2B_SENSITIVE_CREATE *in_sensitive, const TPM2B_PUBLIC *in_public,
+    const TPM2B_DATA *outside_info, const TPML_PCR_SELECTION *creation_pcr,
+    ESYS_TR *object_handle, TPM2B_PUBLIC **out_public,
+    TPM2B_CREATION_DATA **creation_data, TPM2B_DIGEST **creation_hash,
+    TPMT_TK_CREATION **creation_ticket, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
-    TSS2_RC rval = Esys_CreatePrimary(esys_context, primary_handle, shandle1,
-            shandle2, shandle3, in_sensitive, in_public, outside_info, creation_pcr,
-            object_handle, out_public, creation_data, creation_hash,
-            creation_ticket);
+    ESYS_TR shandle1 = ESYS_TR_NONE;
+    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
+        auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session, &shandle1);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Couldn't get shandle for hierarchy");
+        return rc;
+    }
+
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_CreatePrimary_Prepare(sys_context,
+            auth_hierarchy_obj->handle, in_sensitive, in_public, outside_info,
+            creation_pcr);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_CreatePrimary_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME *name1 = 0;
+        rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
+            &name1);
+        if (rc != tool_rc_success) {
+            goto tpm2_create_free_name1;
+        }
+
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+tpm2_create_free_name1:
+        Esys_Free(name1);
+        return rc;
+    }
+
+    TSS2_RC rval = Esys_CreatePrimary(esys_context, auth_hierarchy_obj->tr_handle, shandle1,
+        ESYS_TR_NONE, ESYS_TR_NONE, in_sensitive, in_public, outside_info,
+        creation_pcr, object_handle, out_public, creation_data, creation_hash,
+        creation_ticket);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_CreatePrimary, rval);
         return tool_rc_from_tpm(rval);
@@ -342,24 +613,100 @@
 tool_rc tpm2_pcr_read(ESYS_CONTEXT *esys_context, ESYS_TR shandle1,
         ESYS_TR shandle2, ESYS_TR shandle3,
         const TPML_PCR_SELECTION *pcr_selection_in, UINT32 *pcr_update_counter,
-        TPML_PCR_SELECTION **pcr_selection_out, TPML_DIGEST **pcr_values) {
+        TPML_PCR_SELECTION **pcr_selection_out, TPML_DIGEST **pcr_values,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
+
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_PCR_Read_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_PCR_Read_Prepare(
+        sys_context, pcr_selection_in);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_PCR_Read_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        rc = tpm2_sapi_getcphash(sys_context, NULL, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
 
-    TSS2_RC rval = Esys_PCR_Read(esys_context, shandle1, shandle2, shandle3,
+        goto tpm2_pcrread_skip_esapi_call;
+    }
+    
+    rval = Esys_PCR_Read(esys_context, shandle1, shandle2, shandle3,
             pcr_selection_in, pcr_update_counter, pcr_selection_out, pcr_values);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_PCR_Read, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_pcrread_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_policy_authorize(ESYS_CONTEXT *esys_context, ESYS_TR policy_session,
         ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
         const TPM2B_DIGEST *approved_policy, const TPM2B_NONCE *policy_ref,
-        const TPM2B_NAME *key_sign, const TPMT_TK_VERIFIED *check_ticket) {
+        const TPM2B_NAME *key_sign, const TPMT_TK_VERIFIED *check_ticket,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
+
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_PolicyAuthorize_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_PolicyAuthorize_Prepare(
+        sys_context, policy_session, approved_policy, policy_ref, key_sign,
+            check_ticket);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_PolicyAuthorize_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2_HANDLE sapi_policy_session = 0;
+        rval = Esys_TR_GetTpmHandle(esys_context, policy_session,
+            &sapi_policy_session);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to acquire SAPI handle");
+            return tool_rc_general_error;
+        }
 
-    TSS2_RC rval = Esys_PolicyAuthorize(esys_context, policy_session, shandle1,
+        TPM2B_NAME name1 = { 0 };
+        name1.size = sizeof(TPM2_HANDLE);
+        rval = Tss2_MU_TPM2_HANDLE_Marshal(sapi_policy_session, name1.name,
+            name1.size, 0);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to populate SAPI handle");
+            return tool_rc_general_error;
+        }
+        rc = tpm2_sapi_getcphash(sys_context, &name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+
+        goto tpm2_policyauthorize_skip_esapi_call;
+    }
+
+    rval = Esys_PolicyAuthorize(esys_context, policy_session, shandle1,
             shandle2, shandle3, approved_policy, policy_ref, key_sign,
             check_ticket);
     if (rval != TSS2_RC_SUCCESS) {
@@ -367,7 +714,8 @@
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_policyauthorize_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_policy_or(ESYS_CONTEXT *esys_context, ESYS_TR policy_session,
@@ -438,16 +786,63 @@
 }
 
 tool_rc tpm2_policy_password(ESYS_CONTEXT *esys_context, ESYS_TR policy_session,
-        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3) {
+        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
 
-    TSS2_RC rval = Esys_PolicyPassword(esys_context, policy_session, shandle1,
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_PolicyPassword_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_PolicyPassword_Prepare(
+        sys_context, policy_session);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_PolicyPassword_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2_HANDLE sapi_policy_session = 0;
+        rval = Esys_TR_GetTpmHandle(esys_context, policy_session,
+            &sapi_policy_session);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to acquire SAPI handle");
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME name1 = { 0 };
+        name1.size = sizeof(TPM2_HANDLE);
+        rval = Tss2_MU_TPM2_HANDLE_Marshal(sapi_policy_session, name1.name,
+            name1.size, 0);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to populate SAPI handle");
+            return tool_rc_general_error;
+        }
+        rc = tpm2_sapi_getcphash(sys_context, &name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+
+        goto tpm2_policypassword_skip_esapi_call;
+    }
+
+    rval = Esys_PolicyPassword(esys_context, policy_session, shandle1,
             shandle2, shandle3);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_PolicyPassword, rval);
         return tool_rc_from_tpm(rval);
     }
-
-    return tool_rc_success;
+tpm2_policypassword_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_policy_signed(ESYS_CONTEXT *esys_context,
@@ -484,21 +879,68 @@
 
 tool_rc tpm2_policy_authvalue(ESYS_CONTEXT *esys_context,
         ESYS_TR policy_session, ESYS_TR shandle1, ESYS_TR shandle2,
-        ESYS_TR shandle3) {
+        ESYS_TR shandle3, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm) {
+
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_PolicyAuthValue_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_PolicyAuthValue_Prepare(
+        sys_context, policy_session);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_PolicyAuthValue_Prepare, rval);
+            return tool_rc_general_error;
+        }
 
-    TSS2_RC rval = Esys_PolicyAuthValue(esys_context, policy_session, shandle1,
+        TPM2_HANDLE sapi_policy_session = 0;
+        rval = Esys_TR_GetTpmHandle(esys_context, policy_session,
+            &sapi_policy_session);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to acquire SAPI handle");
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME name1 = { 0 };
+        name1.size = sizeof(TPM2_HANDLE);
+        rval = Tss2_MU_TPM2_HANDLE_Marshal(sapi_policy_session, name1.name,
+            name1.size, 0);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to populate SAPI handle");
+            return tool_rc_general_error;
+        }
+        rc = tpm2_sapi_getcphash(sys_context, &name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+
+        goto tpm2_policyauthvalue_skip_esapi_call;
+    }
+    rval = Esys_PolicyAuthValue(esys_context, policy_session, shandle1,
             shandle2, shandle3);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_PolicyAuthValue, rval);
         return tool_rc_from_tpm(rval);
     }
-
-    return tool_rc_success;
+tpm2_policyauthvalue_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_policy_authorize_nv(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-    ESYS_TR policy_session, TPM2B_DIGEST *cp_hash) {
+    ESYS_TR policy_session, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR esys_tr_nv_index;
     TSS2_RC rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
@@ -517,11 +959,11 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -535,29 +977,27 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
             &name1);
         if (rc != tool_rc_success) {
             goto tpm2_policyauthorizenv_free_name1;
         }
 
-        TPM2B_NAME *name2 = NULL;
+        TPM2B_NAME *name2 = 0;
         rc = tpm2_tr_get_name(esys_context, esys_tr_nv_index, &name2);
         if (rc != tool_rc_success) {
             goto tpm2_policyauthorizenv_free_name1_name2;
         }
 
-        TPM2B_NAME *name3 = NULL;
+        TPM2B_NAME *name3 = 0;
         rc = tpm2_tr_get_name(esys_context, policy_session, &name3);
         if (rc != tool_rc_success) {
             goto tpm2_policyauthorizenv_free_name1_name2_name3;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, name3,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -586,7 +1026,8 @@
 tool_rc tpm2_policy_nv(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
     ESYS_TR policy_session, const TPM2B_OPERAND *operand_b, UINT16 offset,
-    TPM2_EO operation, TPM2B_DIGEST *cp_hash) {
+    TPM2_EO operation, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR esys_tr_nv_index;
     TSS2_RC rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
@@ -605,11 +1046,11 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -624,29 +1065,27 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
             &name1);
         if (rc != tool_rc_success) {
             goto tpm2_policynv_free_name1;
         }
 
-        TPM2B_NAME *name2 = NULL;
+        TPM2B_NAME *name2 = 0;
         rc = tpm2_tr_get_name(esys_context, esys_tr_nv_index, &name2);
         if (rc != tool_rc_success) {
             goto tpm2_policynv_free_name1_name2;
         }
 
-        TPM2B_NAME *name3 = NULL;
+        TPM2B_NAME *name3 = 0;
         rc = tpm2_tr_get_name(esys_context, policy_session, &name3);
         if (rc != tool_rc_success) {
             goto tpm2_policynv_free_name1_name2_name3;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, name3,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -674,25 +1113,71 @@
 
 tool_rc tpm2_policy_countertimer(ESYS_CONTEXT *esys_context,
     ESYS_TR policy_session, const TPM2B_OPERAND *operand_b, UINT16 offset,
-    TPM2_EO operation) {
+    TPM2_EO operation, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
+
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_PolicyCounterTimer_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_PolicyCounterTimer_Prepare(
+        sys_context, policy_session, operand_b, offset, operation);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_PolicyCounterTimer_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2_HANDLE sapi_policy_session = 0;
+        rval = Esys_TR_GetTpmHandle(esys_context, policy_session,
+            &sapi_policy_session);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to acquire SAPI handle");
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME name1 = { 0 };
+        name1.size = sizeof(TPM2_HANDLE);
+        rval = Tss2_MU_TPM2_HANDLE_Marshal(sapi_policy_session, name1.name,
+            name1.size, 0);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to populate SAPI handle");
+            return tool_rc_general_error;
+        }
+        rc = tpm2_sapi_getcphash(sys_context, &name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
 
-    TSS2_RC rval = Esys_PolicyCounterTimer(esys_context, policy_session,
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+
+        goto tpm2_policycountertimer_skip_esapi_call;
+    }
+
+    rval = Esys_PolicyCounterTimer(esys_context, policy_session,
         ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, operand_b, offset, operation);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_PolicyCounterTimer, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_policycountertimer_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_policy_secret(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_entity_obj, ESYS_TR policy_session,
-        INT32 expiration, TPMT_TK_AUTH **policy_ticket,
-        TPM2B_TIMEOUT **timeout, TPM2B_NONCE *nonce_tpm,
-        TPM2B_NONCE *policy_qualifier, TPM2B_DIGEST *cp_hash) {
-
-    const TPM2B_DIGEST *cphash = NULL;
+    tpm2_loaded_object *auth_entity_obj, ESYS_TR policy_session,
+    INT32 expiration, TPMT_TK_AUTH **policy_ticket, TPM2B_TIMEOUT **timeout,
+    TPM2B_NONCE *nonce_tpm, TPM2B_NONCE *policy_qualifier,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR auth_entity_obj_session_handle = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
@@ -703,11 +1188,12 @@
         return rc;
     }
 
-    if (cp_hash) {
+    const TPM2B_DIGEST *cmd_input_cphash = 0;
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -715,30 +1201,28 @@
         }
 
         TSS2_RC rval = Tss2_Sys_PolicySecret_Prepare(sys_context,
-            auth_entity_obj->handle, policy_session, nonce_tpm, cphash,
+            auth_entity_obj->handle, policy_session, nonce_tpm, cmd_input_cphash,
             policy_qualifier, expiration);
         if (rval != TPM2_RC_SUCCESS) {
             LOG_PERR(Tss2_Sys_PolicySecret_Prepare, rval);
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, auth_entity_obj->tr_handle,
             &name1);
         if (rc != tool_rc_success) {
             goto tpm2_policysecret_free_name1;
         }
 
-        TPM2B_NAME *name2 = NULL;
+        TPM2B_NAME *name2 = 0;
         rc = tpm2_tr_get_name(esys_context, policy_session, &name2);
         if (rc != tool_rc_success) {
             goto tpm2_policysecret_free_name1_name2;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_entity_obj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(auth_entity_obj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, name2, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -751,9 +1235,9 @@
     }
 
     TSS2_RC rval = Esys_PolicySecret(esys_context, auth_entity_obj->tr_handle,
-            policy_session, auth_entity_obj_session_handle, ESYS_TR_NONE,
-            ESYS_TR_NONE, nonce_tpm, cphash, policy_qualifier, expiration, timeout,
-            policy_ticket);
+        policy_session, auth_entity_obj_session_handle, ESYS_TR_NONE,
+        ESYS_TR_NONE, nonce_tpm, cmd_input_cphash, policy_qualifier,
+        expiration, timeout, policy_ticket);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_PolicySecret, rval);
         return tool_rc_from_tpm(rval);
@@ -764,31 +1248,125 @@
 }
 
 tool_rc tpm2_policy_getdigest(ESYS_CONTEXT *esys_context, ESYS_TR policy_session,
-        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
-        TPM2B_DIGEST **policy_digest) {
+    ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
+    TPM2B_DIGEST **policy_digest, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
-    TSS2_RC rval = Esys_PolicyGetDigest(esys_context, policy_session, shandle1,
-            shandle2, shandle3, policy_digest);
+    tool_rc rc = tool_rc_success;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire SAPI context.");
+            return rc;
+        }
+
+        TPM2_HANDLE sapi_session_handle = 0;
+        rval = Esys_TR_GetTpmHandle(esys_context, policy_session,
+            &sapi_session_handle);
+        if (rval != TSS2_RC_SUCCESS) {
+            LOG_ERR("Failed to read session handle in sapi");
+            return tool_rc_general_error;
+        }
+
+        TSS2_RC rval = Tss2_Sys_PolicyGetDigest_Prepare(sys_context,
+            sapi_session_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_LoadExternal_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME sapi_session_handle_name = {
+            .size = sizeof(TPM2_HANDLE),
+        };
+        UINT32 sapi_session_handle_be = tpm2_util_hton_32(sapi_session_handle);
+        memcpy(&sapi_session_handle_name.name, &sapi_session_handle_be,
+            sizeof(sapi_session_handle_be));
+
+        cp_hash->size = tpm2_alg_util_get_hash_size(parameter_hash_algorithm);
+        rc = tpm2_sapi_getcphash(sys_context, &sapi_session_handle_name, 0, 0,
+            parameter_hash_algorithm, cp_hash);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        goto tpm2_policy_getdigest_skip_esapi_call;
+    }
+
+    rval = Esys_PolicyGetDigest(esys_context, policy_session, shandle1,
+        shandle2, shandle3, policy_digest);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_PolicyGetDigest, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_policy_getdigest_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_policy_command_code(ESYS_CONTEXT *esys_context,
         ESYS_TR policy_session, ESYS_TR shandle1, ESYS_TR shandle2,
-        ESYS_TR shandle3, TPM2_CC code) {
+        ESYS_TR shandle3, TPM2_CC code, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm) {
+
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_PolicyCommandCode_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_PolicyCommandCode_Prepare(
+        sys_context, policy_session, code);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_PolicyCommandCode_Prepare, rval);
+            return tool_rc_general_error;
+        }
 
-    TSS2_RC rval = Esys_PolicyCommandCode(esys_context, policy_session, shandle1,
+        TPM2_HANDLE sapi_policy_session = 0;
+        rval = Esys_TR_GetTpmHandle(esys_context, policy_session,
+            &sapi_policy_session);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to acquire SAPI handle");
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME name1 = { 0 };
+        name1.size = sizeof(TPM2_HANDLE);
+        rval = Tss2_MU_TPM2_HANDLE_Marshal(sapi_policy_session, name1.name,
+            name1.size, 0);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to populate SAPI handle");
+            return tool_rc_general_error;
+        }
+        rc = tpm2_sapi_getcphash(sys_context, &name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+
+        goto tpm2_policycommandcode_skip_esapi_call;
+    }
+
+    rval = Esys_PolicyCommandCode(esys_context, policy_session, shandle1,
             shandle2, shandle3, code);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_PolicyCommandCode, rval);
         return tool_rc_from_tpm(rval);
     }
-
-    return tool_rc_success;
+tpm2_policycommandcode_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_setcommandcodeaudit(ESYS_CONTEXT *esys_context,
@@ -913,30 +1491,126 @@
 
 tool_rc tpm2_policy_nv_written(ESYS_CONTEXT *esys_context,
         ESYS_TR policy_session, ESYS_TR shandle1, ESYS_TR shandle2,
-        ESYS_TR shandle3, TPMI_YES_NO written_set) {
+        ESYS_TR shandle3, TPMI_YES_NO written_set, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm) {
+
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_PolicyNvWritten_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_PolicyNvWritten_Prepare(
+        sys_context, policy_session, written_set);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_PolicyNvWritten_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2_HANDLE sapi_policy_session = 0;
+        rval = Esys_TR_GetTpmHandle(esys_context, policy_session,
+            &sapi_policy_session);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to acquire SAPI handle");
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME name1 = { 0 };
+        name1.size = sizeof(TPM2_HANDLE);
+        rval = Tss2_MU_TPM2_HANDLE_Marshal(sapi_policy_session, name1.name,
+            name1.size, 0);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to populate SAPI handle");
+            return tool_rc_general_error;
+        }
+        rc = tpm2_sapi_getcphash(sys_context, &name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+
+        goto tpm2_policynvwritten_skip_esapi_call;
+    }
 
-    TSS2_RC rval = Esys_PolicyNvWritten(esys_context, policy_session, shandle1,
+    rval = Esys_PolicyNvWritten(esys_context, policy_session, shandle1,
             shandle2, shandle3, written_set);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_PolicyNVWritten, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_policynvwritten_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_policy_locality(ESYS_CONTEXT *esys_context, ESYS_TR policy_session,
         ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
-        TPMA_LOCALITY locality) {
+        TPMA_LOCALITY locality, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm) {
+
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_PolicyLocality_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_PolicyLocality_Prepare(
+        sys_context, policy_session, locality);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_PolicyLocality_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2_HANDLE sapi_policy_session = 0;
+        rval = Esys_TR_GetTpmHandle(esys_context, policy_session,
+            &sapi_policy_session);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to acquire SAPI handle");
+            return tool_rc_general_error;
+        }
 
-    TSS2_RC rval = Esys_PolicyLocality(esys_context, policy_session, shandle1,
+        TPM2B_NAME name1 = { 0 };
+        name1.size = sizeof(TPM2_HANDLE);
+        rval = Tss2_MU_TPM2_HANDLE_Marshal(sapi_policy_session, name1.name,
+            name1.size, 0);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_ERR("Failed to populate SAPI handle");
+            return tool_rc_general_error;
+        }
+        rc = tpm2_sapi_getcphash(sys_context, &name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+
+        goto tpm2_policylocality_skip_esapi_call;
+    }
+
+    rval = Esys_PolicyLocality(esys_context, policy_session, shandle1,
             shandle2, shandle3, locality);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_PolicyLocality, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_policylocality_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_policy_duplication_select(ESYS_CONTEXT *esys_context,
@@ -981,10 +1655,10 @@
 }
 
 tool_rc tpm2_evictcontrol(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj,
-        tpm2_loaded_object *to_persist_key_obj,
-        TPMI_DH_PERSISTENT persistent_handle, ESYS_TR *new_object_handle,
-        TPM2B_DIGEST *cp_hash) {
+    tpm2_loaded_object *auth_hierarchy_obj,
+    tpm2_loaded_object *to_persist_key_obj,
+    TPMI_DH_PERSISTENT persistent_handle, ESYS_TR *new_object_handle,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR shandle1 = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
@@ -995,11 +1669,11 @@
     }
 
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -1014,23 +1688,21 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
             &name1);
         if (rc != tool_rc_success) {
             goto tpm2_evictcontrol_free_name1;
         }
 
-        TPM2B_NAME *name2 = NULL;
+        TPM2B_NAME *name2 = 0;
         rc = tpm2_tr_get_name(esys_context, to_persist_key_obj->tr_handle, &name2);
         if (rc != tool_rc_success) {
             goto tpm2_evictcontrol_free_name1_name2;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, name2, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -1065,7 +1737,7 @@
  */
 TSS2_RC fix_esys_hierarchy(uint32_t in, uint32_t *out)
 {
-#if defined(ESYS_3_0)
+#if !defined(ESYS_2_3)
     switch (in) {
         case ESYS_TR_RH_NULL:
             /* FALLTHRU */
@@ -1097,12 +1769,10 @@
             LOG_ERR("An unknown hierarchy handle was passed: 0x%08x", in);
             return TSS2_ESYS_RC_BAD_VALUE;
     }
-#elif defined(ESYS_2_3)
-    *out = in;
-    return TSS2_RC_SUCCESS;
 #else
-#error "Need to define either ESYS_3_0 or ESYS_2_3"
+    *out = in;
 #endif
+    return TSS2_RC_SUCCESS;
 }
 
 tool_rc tpm2_hash(ESYS_CONTEXT *esys_context, ESYS_TR shandle1, ESYS_TR shandle2,
@@ -1208,37 +1878,23 @@
 }
 
 tool_rc tpm2_activatecredential(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *activatehandleobj, tpm2_loaded_object *keyhandleobj,
-        const TPM2B_ID_OBJECT *credential_blob,
-        const TPM2B_ENCRYPTED_SECRET *secret, TPM2B_DIGEST **cert_info,
-        TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR keyobj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            keyhandleobj->tr_handle, keyhandleobj->session,
-            &keyobj_session_handle); //shandle1
-    if (rc != tool_rc_success) {
-        return rc;
-    }
-
-    ESYS_TR activateobj_session_handle = ESYS_TR_NONE;
-    rc = tpm2_auth_util_get_shandle(esys_context, activatehandleobj->tr_handle,
-            activatehandleobj->session, &activateobj_session_handle);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
+    tpm2_loaded_object *activatehandleobj, tpm2_loaded_object *keyhandleobj,
+    const TPM2B_ID_OBJECT *credential_blob, const TPM2B_ENCRYPTED_SECRET *secret,
+    TPM2B_DIGEST **cert_info, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle3) {
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
+
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         TSS2_RC rval = Tss2_Sys_ActivateCredential_Prepare(sys_context,
             activatehandleobj->handle, keyhandleobj->handle, credential_blob,
             secret);
@@ -1260,31 +1916,51 @@
             goto tpm2_activatecredential_free_name1_name2;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(activatehandleobj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(activatehandleobj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
-        /*
-         * Exit here without making the ESYS call since we just need the cpHash
-         */
 tpm2_activatecredential_free_name1_name2:
         Esys_Free(name2);
 tpm2_activatecredential_free_name1:
         Esys_Free(name1);
-        goto tpm2_activatecredential_skip_esapi_call;
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        if (!rp_hash->size) {
+            goto tpm2_activatecredential_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR keyobj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context,
+            keyhandleobj->tr_handle, keyhandleobj->session,
+            &keyobj_session_handle); //shandle1
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    ESYS_TR activateobj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context, activatehandleobj->tr_handle,
+            activatehandleobj->session, &activateobj_session_handle);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     TSS2_RC rval = Esys_ActivateCredential(esys_context,
-            activatehandleobj->tr_handle, keyhandleobj->tr_handle,
-            activateobj_session_handle, keyobj_session_handle, ESYS_TR_NONE,
-            credential_blob, secret, cert_info);
+        activatehandleobj->tr_handle, keyhandleobj->tr_handle,
+        activateobj_session_handle, keyobj_session_handle, shandle3,
+        credential_blob, secret, cert_info);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_ActivateCredential, rval);
         rc = tool_rc_from_tpm(rval);
         return rc;
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_activatecredential_skip_esapi_call:
     return rc;
 }
@@ -1294,26 +1970,22 @@
         const TPM2B_DATA *outside_info, const TPML_PCR_SELECTION *creation_pcr,
         TPM2B_PRIVATE **out_private, TPM2B_PUBLIC **out_public,
         TPM2B_CREATION_DATA **creation_data, TPM2B_DIGEST **creation_hash,
-        TPMT_TK_CREATION **creation_ticket, TPM2B_DIGEST *cp_hash) {
+        TPMT_TK_CREATION **creation_ticket, TPM2B_DIGEST *cp_hash,
+        TPM2B_DIGEST *rp_hash, TPMI_ALG_HASH parameter_hash_algorithm,
+        ESYS_TR shandle2, ESYS_TR shandle3) {
 
-    ESYS_TR shandle1 = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context, parent_obj->tr_handle,
-            parent_obj->session, &shandle1);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
-
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
+
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         TSS2_RC rval = Tss2_Sys_Create_Prepare(sys_context, parent_obj->handle,
             in_sensitive, in_public, outside_info, creation_pcr);
         if (rval != TPM2_RC_SUCCESS) {
@@ -1328,21 +2000,31 @@
             goto tpm2_create_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(parent_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(parent_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
+tpm2_create_free_name1:
+        Esys_Free(name1);
+        if (rc != tool_rc_success) {
+            return rc;
+        }
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
-tpm2_create_free_name1:
-        Esys_Free(name1);
-        goto tpm2_create_skip_esapi_call;
+        if (!rp_hash->size) {
+            goto tpm2_create_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR shandle1 = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context, parent_obj->tr_handle,
+        parent_obj->session, &shandle1);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     TSS2_RC rval = Esys_Create(esys_context, parent_obj->tr_handle, shandle1,
-            ESYS_TR_NONE, ESYS_TR_NONE, in_sensitive, in_public, outside_info,
+            shandle2, shandle3, in_sensitive, in_public, outside_info,
             creation_pcr, out_private, out_public, creation_data, creation_hash,
             creation_ticket);
     if (rval != TSS2_RC_SUCCESS) {
@@ -1350,6 +2032,11 @@
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_create_skip_esapi_call:
     return rc;
 }
@@ -1359,26 +2046,22 @@
         const TPM2B_SENSITIVE_CREATE *in_sensitive,
         const TPM2B_TEMPLATE *in_public, ESYS_TR *object_handle,
         TPM2B_PRIVATE **out_private, TPM2B_PUBLIC **out_public,
-        TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR shandle1 = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context, parent_obj->tr_handle,
-            parent_obj->session, &shandle1);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
+        TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2,
+        ESYS_TR shandle3) {
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
+
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         TSS2_RC rval = Tss2_Sys_CreateLoaded_Prepare(sys_context,
             parent_obj->handle, in_sensitive, in_public);
         if (rval != TPM2_RC_SUCCESS) {
@@ -1393,53 +2076,65 @@
             goto tpm2_createloaded_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(parent_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(parent_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
+tpm2_createloaded_free_name1:
+        Esys_Free(name1);
+        if (rc != tool_rc_success) {
+            return rc;
+        }
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
-tpm2_createloaded_free_name1:
-        Esys_Free(name1);
-        goto tpm2_createloaded_skip_esapi_call;
+        if (!rp_hash->size) {
+            goto tpm2_createloaded_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR shandle1 = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context, parent_obj->tr_handle,
+        parent_obj->session, &shandle1);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     TSS2_RC rval = Esys_CreateLoaded(esys_context, parent_obj->tr_handle,
-            shandle1, ESYS_TR_NONE, ESYS_TR_NONE, in_sensitive, in_public,
+            shandle1, shandle2, shandle3, in_sensitive, in_public,
             object_handle, out_private, out_public);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_CreateLoaded, rval);
         return tool_rc_from_tpm(rval);
     }
+
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_createloaded_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_object_change_auth(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *parent_object, tpm2_loaded_object *object,
-        const TPM2B_AUTH *new_auth, TPM2B_PRIVATE **out_private,
-        TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR shandle1 = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context, object->tr_handle,
-            object->session, &shandle1);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
+    tpm2_loaded_object *parent_object, tpm2_loaded_object *object,
+    const TPM2B_AUTH *new_auth, TPM2B_PRIVATE **out_private,
+    TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2,
+    ESYS_TR shandle3) {
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
+
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         TSS2_RC rval = Tss2_Sys_ObjectChangeAuth_Prepare(sys_context,
             object->handle, parent_object->handle, new_auth);
         if (rval != TPM2_RC_SUCCESS) {
@@ -1448,8 +2143,7 @@
         }
 
         TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(esys_context, object->tr_handle,
-            &name1);
+        rc = tpm2_tr_get_name(esys_context, object->tr_handle, &name1);
         if (rc != tool_rc_success) {
             goto tpm2_objectchangeauth_free_name1;
         }
@@ -1461,53 +2155,59 @@
             goto tpm2_objectchangeauth_free_name1_name2;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(object->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(object->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
-        /*
-         * Exit here without making the ESYS call since we just need the cpHash
-         */
 tpm2_objectchangeauth_free_name1_name2:
         Esys_Free(name2);
 tpm2_objectchangeauth_free_name1:
         Esys_Free(name1);
-        goto tpm2_objectchangeauth_skip_esapi_call;
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        if (!rp_hash->size || rc != tool_rc_success) {
+            goto tpm2_objectchangeauth_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR shandle1 = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context, object->tr_handle,
+        object->session, &shandle1);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     TSS2_RC rval = Esys_ObjectChangeAuth(esys_context, object->tr_handle,
-            parent_object->tr_handle, shandle1, ESYS_TR_NONE, ESYS_TR_NONE,
+            parent_object->tr_handle, shandle1, shandle2, shandle3,
             new_auth, out_private);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_ObjectChangeAuth, rval);
         return tool_rc_from_tpm(rval);
     }
+
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_objectchangeauth_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_nv_change_auth(ESYS_CONTEXT *esys_context, tpm2_loaded_object *nv,
-        const TPM2B_AUTH *new_auth, TPM2B_DIGEST *cp_hash) {
+    const TPM2B_AUTH *new_auth, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2,
+    ESYS_TR shandle3) {
 
-    ESYS_TR shandle1 = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context, nv->tr_handle,
-            nv->session, &shandle1);
-    if (rc != tool_rc_success) {
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = (cp_hash->size || rp_hash->size) ?
+    tpm2_getsapicontext(esys_context, &sys_context) : tool_rc_success;
+    if(rc != tool_rc_success) {
+        LOG_ERR("Failed to acquire SAPI context.");
         return rc;
     }
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
-        rc = tpm2_getsapicontext(esys_context, &sys_context);
-        if(rc != tool_rc_success) {
-            LOG_ERR("Failed to acquire SAPI context.");
-            return rc;
-        }
-
+    if (cp_hash->size) {
         TSS2_RC rval = Tss2_Sys_NV_ChangeAuth_Prepare(sys_context, nv->handle,
             new_auth);
         if (rval != TPM2_RC_SUCCESS) {
@@ -1521,52 +2221,57 @@
             goto tpm2_nvchangeauth_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(nv->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(nv->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
+tpm2_nvchangeauth_free_name1:
+        Esys_Free(name1);
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
-tpm2_nvchangeauth_free_name1:
-        Esys_Free(name1);
-        goto tpm2_nvchangeauth_skip_esapi_call;
+        if (!rp_hash->size || rc != tool_rc_success) {
+            goto tpm2_nvchangeauth_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR shandle1 = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context, nv->tr_handle, nv->session,
+        &shandle1);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     TSS2_RC rval = Esys_NV_ChangeAuth(esys_context, nv->tr_handle, shandle1,
-            ESYS_TR_NONE, ESYS_TR_NONE, new_auth);
+            shandle2, shandle3, new_auth);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_NV_ChangeAuth, rval);
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_nvchangeauth_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_hierarchy_change_auth(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *hierarchy, const TPM2B_AUTH *new_auth,
-        TPM2B_DIGEST *cp_hash) {
+    tpm2_loaded_object *hierarchy, const TPM2B_AUTH *new_auth,
+    TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2,
+    ESYS_TR shandle3) {
 
-    ESYS_TR shandle1 = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context, hierarchy->tr_handle,
-            hierarchy->session, &shandle1);
-    if (rc != tool_rc_success) {
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = (cp_hash->size || rp_hash->size) ?
+    tpm2_getsapicontext(esys_context, &sys_context) : tool_rc_success;
+    if(rc != tool_rc_success) {
+        LOG_ERR("Failed to acquire SAPI context.");
         return rc;
     }
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
-        rc = tpm2_getsapicontext(esys_context, &sys_context);
-        if(rc != tool_rc_success) {
-            LOG_ERR("Failed to acquire SAPI context.");
-            return rc;
-        }
-
+    if (cp_hash->size) {
         TSS2_RC rval = Tss2_Sys_HierarchyChangeAuth_Prepare(sys_context,
             hierarchy->handle, new_auth);
         if (rval != TPM2_RC_SUCCESS) {
@@ -1580,64 +2285,63 @@
             goto tpm2_hierarchychangeauth_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(hierarchy->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(hierarchy->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
+tpm2_hierarchychangeauth_free_name1:
+        Esys_Free(name1);
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
-tpm2_hierarchychangeauth_free_name1:
-        Esys_Free(name1);
-        goto tpm2_hierarchychangeauth_skip_esapi_call;
+        if (!rp_hash->size || rc != tool_rc_success) {
+            goto tpm2_hierarchychangeauth_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR shandle1 = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context, hierarchy->tr_handle,
+        hierarchy->session, &shandle1);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     TSS2_RC rval = Esys_HierarchyChangeAuth(esys_context, hierarchy->tr_handle,
-            shandle1, ESYS_TR_NONE, ESYS_TR_NONE, new_auth);
+            shandle1, shandle2, shandle3, new_auth);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_HierarchyChangeAuth, rval);
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_hierarchychangeauth_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_certify(ESYS_CONTEXT *ectx, tpm2_loaded_object *certifiedkey_obj,
-        tpm2_loaded_object *signingkey_obj, TPM2B_DATA *qualifying_data,
-        TPMT_SIG_SCHEME *scheme, TPM2B_ATTEST **certify_info,
-        TPMT_SIGNATURE **signature, TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR certifiedkey_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(ectx, certifiedkey_obj->tr_handle,
-            certifiedkey_obj->session, &certifiedkey_session_handle);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to get session handle for TPM object");
-        return rc;
-    }
-
-    ESYS_TR signingkey_session_handle = ESYS_TR_NONE;
-    rc = tpm2_auth_util_get_shandle(ectx, signingkey_obj->tr_handle,
-            signingkey_obj->session, &signingkey_session_handle);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to get session handle for key");
-        return rc;
-    }
+    tpm2_loaded_object *signingkey_obj, TPM2B_DATA *qualifying_data,
+    TPMT_SIG_SCHEME *scheme, TPM2B_ATTEST **certify_info,
+    TPMT_SIGNATURE **signature, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle3) {
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(ectx, &sys_context);
+
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         TSS2_RC rval = Tss2_Sys_Certify_Prepare(sys_context,
-        certifiedkey_obj->handle, signingkey_obj->handle, qualifying_data, scheme);
+            certifiedkey_obj->handle, signingkey_obj->handle, qualifying_data,
+            scheme);
         if (rval != TPM2_RC_SUCCESS) {
             LOG_PERR(Tss2_Sys_Certify_Prepare, rval);
             return tool_rc_general_error;
@@ -1655,52 +2359,74 @@
             goto tpm2_certify_free_name1_name2;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(certifiedkey_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(certifiedkey_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
-        /*
-         * Exit here without making the ESYS call since we just need the cpHash
-         */
 tpm2_certify_free_name1_name2:
         Esys_Free(name2);
 tpm2_certify_free_name1:
         Esys_Free(name1);
-        goto tpm2_certify_skip_esapi_call;
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        if (!rp_hash->size || rc != tool_rc_success) {
+            goto tpm2_certify_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR certifiedkey_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(ectx, certifiedkey_obj->tr_handle,
+        certifiedkey_obj->session, &certifiedkey_session_handle);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to get session handle for TPM object");
+        return rc;
+    }
+
+    ESYS_TR signingkey_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(ectx, signingkey_obj->tr_handle,
+        signingkey_obj->session, &signingkey_session_handle);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to get session handle for key");
+        return rc;
     }
 
     TSS2_RC rval = Esys_Certify(ectx, certifiedkey_obj->tr_handle,
             signingkey_obj->tr_handle, certifiedkey_session_handle,
-            signingkey_session_handle, ESYS_TR_NONE, qualifying_data, scheme,
+            signingkey_session_handle, shandle3, qualifying_data, scheme,
             certify_info, signature);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Eys_Certify, rval);
         rc = tool_rc_from_tpm(rval);
+
         return rc;
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_certify_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_rsa_decrypt(ESYS_CONTEXT *ectx, tpm2_loaded_object *keyobj,
-        const TPM2B_PUBLIC_KEY_RSA *cipher_text, const TPMT_RSA_DECRYPT *scheme,
-        const TPM2B_DATA *label, TPM2B_PUBLIC_KEY_RSA **message,
-        TPM2B_DIGEST *cp_hash) {
+    const TPM2B_PUBLIC_KEY_RSA *cipher_text, const TPMT_RSA_DECRYPT *in_scheme,
+    const TPM2B_DATA *label, TPM2B_PUBLIC_KEY_RSA **message,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR keyobj_session_handle = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(ectx, keyobj->tr_handle,
-            keyobj->session, &keyobj_session_handle);
+        keyobj->session, &keyobj_session_handle);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(ectx, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -1708,22 +2434,20 @@
         }
 
         TSS2_RC rval = Tss2_Sys_RSA_Decrypt_Prepare(sys_context, keyobj->handle,
-        cipher_text, scheme, label);
+            cipher_text, in_scheme, label);
         if (rval != TPM2_RC_SUCCESS) {
             LOG_PERR(Tss2_Sys_RSA_Decrypt_Prepare, rval);
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(ectx, keyobj->tr_handle, &name1);
         if (rc != tool_rc_success) {
             goto tpm2_rsadecrypt_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(keyobj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(keyobj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -1734,8 +2458,8 @@
     }
 
     TSS2_RC rval = Esys_RSA_Decrypt(ectx, keyobj->tr_handle,
-            keyobj_session_handle, ESYS_TR_NONE, ESYS_TR_NONE, cipher_text,
-            scheme, label, message);
+        keyobj_session_handle, ESYS_TR_NONE, ESYS_TR_NONE, cipher_text,
+        in_scheme, label, message);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_RSA_Decrypt, rval);
         return tool_rc_from_tpm(rval);
@@ -1761,8 +2485,9 @@
 }
 
 tool_rc tpm2_load(ESYS_CONTEXT *esys_context, tpm2_loaded_object *parentobj,
-        const TPM2B_PRIVATE *in_private, const TPM2B_PUBLIC *in_public,
-        ESYS_TR *object_handle, TPM2B_DIGEST *cp_hash) {
+    const TPM2B_PRIVATE *in_private, const TPM2B_PUBLIC *in_public,
+    ESYS_TR *object_handle, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR parent_object_session_handle = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context, parentobj->tr_handle,
@@ -1772,11 +2497,11 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -1790,17 +2515,15 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, parentobj->tr_handle,
             &name1);
         if (rc != tool_rc_success) {
             goto tpm2_load_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(parentobj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(parentobj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -1823,7 +2546,8 @@
 }
 
 tool_rc tpm2_clear(ESYS_CONTEXT *esys_context,
-tpm2_loaded_object *auth_hierarchy, TPM2B_DIGEST *cp_hash) {
+    tpm2_loaded_object *auth_hierarchy, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR shandle1 = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
@@ -1833,7 +2557,7 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
@@ -1858,10 +2582,8 @@
             goto tpm2_clear_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(auth_hierarchy->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -1884,8 +2606,8 @@
 }
 
 tool_rc tpm2_clearcontrol(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy, TPMI_YES_NO disable_clear,
-        TPM2B_DIGEST *cp_hash) {
+    tpm2_loaded_object *auth_hierarchy, TPMI_YES_NO disable_clear,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR shandle = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
@@ -1894,7 +2616,7 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
@@ -1919,10 +2641,8 @@
             goto tpm2_clearcontrol_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(auth_hierarchy->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -1943,9 +2663,9 @@
 }
 
 tool_rc tpm2_dictionarylockout_setup(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy, UINT32 max_tries,
-        UINT32 recovery_time, UINT32 lockout_recovery_time,
-        TPM2B_DIGEST *cp_hash) {
+    tpm2_loaded_object *auth_hierarchy, UINT32 max_tries, UINT32 recovery_time,
+    UINT32 lockout_recovery_time, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR shandle1 = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
@@ -1955,7 +2675,7 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
@@ -1981,10 +2701,8 @@
             goto tpm2_dictionary_parameters_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(auth_hierarchy->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -2008,7 +2726,8 @@
 }
 
 tool_rc tpm2_dictionarylockout_reset(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy, TPM2B_DIGEST *cp_hash) {
+    tpm2_loaded_object *auth_hierarchy, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR shandle1 = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
@@ -2018,7 +2737,7 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
@@ -2043,10 +2762,8 @@
             goto tpm2_dictionary_attack_reset_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(auth_hierarchy->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -2070,10 +2787,11 @@
 }
 
 tool_rc tpm2_duplicate(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *duplicable_key, tpm2_loaded_object *new_parent,
-        const TPM2B_DATA *in_key, const TPMT_SYM_DEF_OBJECT *sym_alg,
-        TPM2B_DATA **out_key, TPM2B_PRIVATE **duplicate,
-        TPM2B_ENCRYPTED_SECRET **encrypted_seed, TPM2B_DIGEST *cp_hash) {
+    tpm2_loaded_object *duplicable_key, tpm2_loaded_object *new_parent,
+    const TPM2B_DATA *in_key, const TPMT_SYM_DEF_OBJECT *sym_alg,
+    TPM2B_DATA **out_key, TPM2B_PRIVATE **duplicate,
+    TPM2B_ENCRYPTED_SECRET **encrypted_seed, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR shandle1 = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
@@ -2083,11 +2801,11 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -2101,22 +2819,20 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, duplicable_key->tr_handle, &name1);
         if (rc != tool_rc_success) {
             goto tpm2_duplicate_free_name1;
         }
 
-        TPM2B_NAME *name2 = NULL;
+        TPM2B_NAME *name2 = 0;
         rc = tpm2_tr_get_name(esys_context, new_parent->tr_handle, &name2);
         if (rc != tool_rc_success) {
             goto tpm2_duplicate_free_name1_name2;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(duplicable_key->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(duplicable_key->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, name2, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -2141,11 +2857,16 @@
 }
 
 tool_rc tpm2_encryptdecrypt(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *encryption_key_obj, TPMI_YES_NO decrypt,
-        TPMI_ALG_SYM_MODE mode, const TPM2B_IV *iv_in,
-        const TPM2B_MAX_BUFFER *input_data, TPM2B_MAX_BUFFER **output_data,
-        TPM2B_IV **iv_out, TPM2B_DIGEST *cp_hash) {
-
+    tpm2_loaded_object *encryption_key_obj, TPMI_YES_NO decrypt,
+    TPMI_ALG_SYM_MODE mode, const TPM2B_IV *iv_in,
+    const TPM2B_MAX_BUFFER *input_data, TPM2B_MAX_BUFFER **output_data,
+    TPM2B_IV **iv_out, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
+
+    /*
+     * try EncryptDecrypt2 first, and if the command is not supported by the TPM
+     * fall back to EncryptDecrypt.
+     */
     ESYS_TR shandle1 = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
     encryption_key_obj->tr_handle, encryption_key_obj->session, &shandle1);
@@ -2157,11 +2878,11 @@
     /* Keep track of which version you ran for error reporting.*/
     unsigned version = 2;
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -2185,17 +2906,15 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, encryption_key_obj->tr_handle,
             &name1);
         if (rc != tool_rc_success) {
             goto tpm2_encryptdecrypt_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(encryption_key_obj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(encryption_key_obj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -2229,8 +2948,9 @@
 }
 
 tool_rc tpm2_hierarchycontrol(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy, TPMI_RH_ENABLES enable,
-        TPMI_YES_NO state, TPM2B_DIGEST *cp_hash) {
+    tpm2_loaded_object *auth_hierarchy, TPMI_RH_ENABLES enable,
+    TPMI_YES_NO state, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR shandle = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
@@ -2240,11 +2960,11 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -2258,17 +2978,15 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, auth_hierarchy->tr_handle,
             &name1);
         if (rc != tool_rc_success) {
             goto tpm2_hierarchycontrol_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(auth_hierarchy->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -2296,23 +3014,23 @@
 }
 
 tool_rc tpm2_hmac(ESYS_CONTEXT *esys_context, tpm2_loaded_object *hmac_key_obj,
-        TPMI_ALG_HASH halg, const TPM2B_MAX_BUFFER *input_buffer,
-        TPM2B_DIGEST **out_hmac, TPM2B_DIGEST *cp_hash) {
+    TPMI_ALG_HASH halg, const TPM2B_MAX_BUFFER *input_buffer,
+    TPM2B_DIGEST **out_hmac, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR hmac_key_obj_shandle = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            hmac_key_obj->tr_handle, hmac_key_obj->session,
-            &hmac_key_obj_shandle);
+        hmac_key_obj->tr_handle, hmac_key_obj->session, &hmac_key_obj_shandle);
     if (rc != tool_rc_success) {
         LOG_ERR("Failed to get hmac_key_obj_shandle");
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -2320,23 +3038,20 @@
         }
 
         TSS2_RC rval = Tss2_Sys_HMAC_Prepare(sys_context, hmac_key_obj->handle,
-        input_buffer, halg);
+            input_buffer, halg);
         if (rval != TPM2_RC_SUCCESS) {
             LOG_PERR(Tss2_Sys_HMAC_Prepare, rval);
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(esys_context, hmac_key_obj->tr_handle,
-            &name1);
+        TPM2B_NAME *name1 = 0;
+        rc = tpm2_tr_get_name(esys_context, hmac_key_obj->tr_handle, &name1);
         if (rc != tool_rc_success) {
             goto tpm2_hmac_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(hmac_key_obj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(hmac_key_obj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -2347,8 +3062,8 @@
     }
 
     TPM2_RC rval = Esys_HMAC(esys_context, hmac_key_obj->tr_handle,
-            hmac_key_obj_shandle, ESYS_TR_NONE, ESYS_TR_NONE, input_buffer,
-            halg, out_hmac);
+        hmac_key_obj_shandle, ESYS_TR_NONE, ESYS_TR_NONE, input_buffer, halg,
+        out_hmac);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_HMAC, rval);
         return tool_rc_from_tpm(rval);
@@ -2440,10 +3155,10 @@
 }
 
 tool_rc tpm2_import(ESYS_CONTEXT *esys_context, tpm2_loaded_object *parent_obj,
-        const TPM2B_DATA *encryption_key, const TPM2B_PUBLIC *object_public,
-        const TPM2B_PRIVATE *duplicate, const TPM2B_ENCRYPTED_SECRET *in_sym_seed,
-        const TPMT_SYM_DEF_OBJECT *symmetric_alg, TPM2B_PRIVATE **out_private,
-        TPM2B_DIGEST *cp_hash) {
+    const TPM2B_DATA *encryption_key, const TPM2B_PUBLIC *object_public,
+    const TPM2B_PRIVATE *duplicate, const TPM2B_ENCRYPTED_SECRET *in_sym_seed,
+    const TPMT_SYM_DEF_OBJECT *symmetric_alg, TPM2B_PRIVATE **out_private,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR parentobj_shandle = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context, parent_obj->tr_handle,
@@ -2453,11 +3168,11 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -2472,16 +3187,14 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, parent_obj->tr_handle, &name1);
         if (rc != tool_rc_success) {
             goto tpm2_import_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(parent_obj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(parent_obj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -2504,31 +3217,23 @@
 }
 
 tool_rc tpm2_nv_definespace(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, const TPM2B_AUTH *auth,
-        const TPM2B_NV_PUBLIC *public_info, TPM2B_DIGEST *cp_hash) {
+    tpm2_loaded_object *auth_hierarchy_obj, const TPM2B_AUTH *auth,
+    const TPM2B_NV_PUBLIC *public_info, TPM2B_DIGEST *cp_hash,
+    TPM2B_DIGEST *rp_hash, TPMI_ALG_HASH parameter_hash_algorithm,
+    ESYS_TR shandle2, ESYS_TR shandle3) {
 
-    ESYS_TR shandle1 = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
-            &shandle1);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to get shandle");
-        return rc;
-    }
-
-    ESYS_TR nvHandle;
-
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
+
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         TSS2_RC rval = Tss2_Sys_NV_DefineSpace_Prepare(sys_context,
             auth_hierarchy_obj->handle, auth, public_info);
         if (rval != TPM2_RC_SUCCESS) {
@@ -2543,22 +3248,31 @@
             goto tpm2_nvdefinespace_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
+tpm2_nvdefinespace_free_name1:
+        Esys_Free(name1);
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
-tpm2_nvdefinespace_free_name1:
-        Esys_Free(name1);
-        goto tpm2_nvdefinespace_skip_esapi_call;
+        if (!rp_hash->size) {
+            goto tpm2_nvdefinespace_skip_esapi_call;
+        }
     }
 
+    ESYS_TR shandle1 = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context, auth_hierarchy_obj->tr_handle,
+        auth_hierarchy_obj->session, &shandle1);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to get shandle");
+        return rc;
+    }
+
+    ESYS_TR nvHandle;
     TSS2_RC rval = Esys_NV_DefineSpace(esys_context,
-            auth_hierarchy_obj->tr_handle, shandle1, ESYS_TR_NONE, ESYS_TR_NONE,
-            auth, public_info, &nvHandle);
+    auth_hierarchy_obj->tr_handle, shandle1, shandle2, shandle3, auth,
+    public_info, &nvHandle);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_ERR("Failed to define NV area at index 0x%X",
                 public_info->nvPublic.nvIndex);
@@ -2566,43 +3280,48 @@
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_nvdefinespace_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_nv_increment(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
-            &auth_hierarchy_obj_session_handle);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to get shandle");
-        return rc;
-    }
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_NAME *precalc_nvname, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2, ESYS_TR shandle3) {
 
-    // Convert TPM2_HANDLE ctx.nv_index to an ESYS_TR
-    ESYS_TR esys_tr_nv_index;
-    TSS2_RC rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
-            ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_index);
-    if (rval != TPM2_RC_SUCCESS) {
-        LOG_PERR(Esys_TR_FromTPMPublic, rval);
-        return tool_rc_from_tpm(rval);
+    /*
+     * If command is to be dispatched the NV index must exist.
+     * In this case get the NV index name by reading its public information.
+     * If rpHash size is non zero then command is always dispatched.
+     */
+    ESYS_TR esys_tr_nv_handle = ESYS_TR_NONE;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    bool is_name_specified = precalc_nvname ? precalc_nvname->size : false;
+    if (!is_name_specified) {
+        rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
+                ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_TR_FromTPMPublic, rval);
+            return tool_rc_from_tpm(rval);
+        }
     }
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         rval = Tss2_Sys_NV_Increment_Prepare(sys_context,
             auth_hierarchy_obj->handle, nv_index);
         if (rval != TPM2_RC_SUCCESS) {
@@ -2610,71 +3329,120 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
-            &name1);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvincrement_free_name1;
+        /*
+         * We need this to use precalc-name for parent authorization when the
+         * NV index itself is the authorization parent AND
+         * we don't need/have the NV index defined when simply calculating cpHash.
+         */
+        bool is_auth_hierarchy_nv_index =
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_OWNER) &&
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_PLATFORM);
+        /*
+         * We need this to avoid requiring an NV-index be defined when simply
+         * calculating cpHash.
+         */
+        TPM2B_NAME *name1 = 0;
+        if (is_auth_hierarchy_nv_index && is_name_specified) {
+            name1 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
+                &name1);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvincrement_free_name1;
+            }
         }
 
-        TPM2B_NAME *name2 = NULL;
-        rc = tpm2_tr_get_name(esys_context, esys_tr_nv_index, &name2);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvincrement_free_name1_name2;
+        TPM2B_NAME *name2 = 0;
+        if (is_name_specified) {
+            name2 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvincrement_free_name1_name2;
+            }
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
 tpm2_nvincrement_free_name1_name2:
-        Esys_Free(name2);
+        if (!is_name_specified) {
+            Esys_Free(name2);
+        }
 tpm2_nvincrement_free_name1:
-        Esys_Free(name1);
-        goto tpm2_nvincrement_skip_esapi_call;
+        if (!is_name_specified) {
+            Esys_Free(name1);
+        }
+        if (!rp_hash->size) {
+            goto tpm2_nvincrement_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context, auth_hierarchy_obj->tr_handle,
+    auth_hierarchy_obj->session, &auth_hierarchy_obj_session_handle);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to get shandle");
+        return rc;
     }
 
     rval = Esys_NV_Increment(esys_context, auth_hierarchy_obj->tr_handle,
-            esys_tr_nv_index, auth_hierarchy_obj_session_handle, ESYS_TR_NONE,
-            ESYS_TR_NONE);
+            esys_tr_nv_handle, auth_hierarchy_obj_session_handle, shandle2,
+            shandle3);
     if (rval != TPM2_RC_SUCCESS) {
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_nvincrement_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_nvreadlock(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR esys_tr_nv_handle;
-    TSS2_RC rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
-            ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
-    if (rval != TPM2_RC_SUCCESS) {
-        LOG_PERR(Esys_TR_FromTPMPublic, rval);
-        return tool_rc_from_tpm(rval);
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_NAME *precalc_nvname, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2,
+    ESYS_TR shandle3) {
+
+    /*
+     * If command is to be dispatched the NV index must exist.
+     * In this case get the NV index name by reading its public information.
+     * If rpHash size is non zero then command is always dispatched.
+     */
+    ESYS_TR esys_tr_nv_handle = ESYS_TR_NONE;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    bool is_name_specified = precalc_nvname ? precalc_nvname->size : false;
+    if (!is_name_specified) {
+        rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
+                ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_TR_FromTPMPublic, rval);
+            return tool_rc_from_tpm(rval);
+        }
     }
 
-    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
-            &auth_hierarchy_obj_session_handle);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to get shandle");
-        return rc;
+    tool_rc rc = tool_rc_success;
+    TSS2_SYS_CONTEXT *sys_context = 0;
+    if (cp_hash->size || rp_hash->size) {
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire SAPI context.");
+            return rc;
+        }
     }
 
-    if (cp_hash) {
+    if (cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -2688,78 +3456,119 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
-            &name1);
-        if (rc != tool_rc_success) {
-            goto tpm2_readlock_free_name1;
+        /*
+         * We need this to use precalc-name for parent authorization when the
+         * NV index itself is the authorization parent AND
+         * we don't need/have the NV index defined when simply calculating cpHash.
+         */
+        bool is_auth_hierarchy_nv_index =
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_OWNER) &&
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_PLATFORM);
+
+        /*
+         * We need this to avoid requiring an NV-index be defined when simply
+         * calculating cpHash.
+         */
+        TPM2B_NAME *name1 = 0;
+        if (is_auth_hierarchy_nv_index && is_name_specified) {
+            name1 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
+                &name1);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvreadlock_free_name1;
+            }
         }
 
-        TPM2B_NAME *name2 = NULL;
-        rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvreadlock_free_name1_name2;
+        TPM2B_NAME *name2 = 0;
+        if (is_name_specified) {
+            name2 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvreadlock_free_name1_name2;
+            }
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, name2, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
 tpm2_nvreadlock_free_name1_name2:
-        Esys_Free(name2);
-tpm2_readlock_free_name1:
-        Esys_Free(name1);
-        goto tpm2_nvreadlock_skip_esapi_call;
+        if (!is_name_specified) {
+            Esys_Free(name2);
+        }
+tpm2_nvreadlock_free_name1:
+        if (!is_name_specified) {
+            Esys_Free(name1);
+        }
+
+        if (!rp_hash->size) {
+            goto tpm2_nvreadlock_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context, auth_hierarchy_obj->tr_handle,
+        auth_hierarchy_obj->session, &auth_hierarchy_obj_session_handle);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to get shandle");
+        return rc;
     }
 
     rval = Esys_NV_ReadLock(esys_context, auth_hierarchy_obj->tr_handle,
-            esys_tr_nv_handle, auth_hierarchy_obj_session_handle, ESYS_TR_NONE,
-            ESYS_TR_NONE);
+        esys_tr_nv_handle, auth_hierarchy_obj_session_handle, shandle2,
+        shandle3);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_NV_ReadLock, rval);
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_nvreadlock_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_nvwritelock(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR esys_tr_nv_handle;
-    TSS2_RC rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
-            ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
-    if (rval != TPM2_RC_SUCCESS) {
-        LOG_PERR(Esys_TR_FromTPMPublic, rval);
-        return tool_rc_from_tpm(rval);
-    }
-
-    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
-            &auth_hierarchy_obj_session_handle);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to get shandle");
-        return rc;
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_NAME *precalc_nvname, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2,
+    ESYS_TR shandle3) {
+
+    /*
+     * If command is to be dispatched the NV index must exist.
+     * In this case get the NV index name by reading its public information.
+     * If rpHash size is non zero then command is always dispatched.
+     */
+    ESYS_TR esys_tr_nv_handle = ESYS_TR_NONE;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    bool is_name_specified = precalc_nvname ? precalc_nvname->size : false;
+    if (!is_name_specified) {
+        rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
+                ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_TR_FromTPMPublic, rval);
+            return tool_rc_from_tpm(rval);
+        }
     }
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    TSS2_SYS_CONTEXT *sys_context = 0;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         rval = Tss2_Sys_NV_WriteLock_Prepare(sys_context,
             auth_hierarchy_obj->handle, nv_index);
         if (rval != TPM2_RC_SUCCESS) {
@@ -2767,70 +3576,100 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
-            &name1);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvwritelock_free_name1;
+        /*
+         * We need this to use precalc-name for parent authorization when the
+         * NV index itself is the authorization parent AND
+         * we don't need/have the NV index defined when simply calculating cpHash.
+         */
+        bool is_auth_hierarchy_nv_index =
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_OWNER) &&
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_PLATFORM);
+        /*
+         * We need this to avoid requiring an NV-index be defined when simply
+         * calculating cpHash.
+         */
+        TPM2B_NAME *name1 = 0;
+        if (is_auth_hierarchy_nv_index && is_name_specified) {
+            name1 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
+                &name1);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvwritelock_free_name1;
+            }
         }
 
-        TPM2B_NAME *name2 = NULL;
-        rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvwritelock_free_name1_name2;
+        TPM2B_NAME *name2 = 0;
+        if (is_name_specified) {
+            name2 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvwritelock_free_name1_name2;
+            }
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
 tpm2_nvwritelock_free_name1_name2:
-        Esys_Free(name2);
+        if (!is_name_specified) {
+            Esys_Free(name2);
+        }
 tpm2_nvwritelock_free_name1:
-        Esys_Free(name1);
-        goto tpm2_nvwritelock_skip_esapi_call;
+        if (!is_name_specified) {
+            Esys_Free(name1);
+        }
+
+        if (!rp_hash->size) {
+            goto tpm2_nvwritelock_skip_esapi_call;
+        }
     }
 
+    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context, auth_hierarchy_obj->tr_handle,
+        auth_hierarchy_obj->session, &auth_hierarchy_obj_session_handle);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to get shandle");
+        return rc;
+    }
 
     rval = Esys_NV_WriteLock(esys_context, auth_hierarchy_obj->tr_handle,
-            esys_tr_nv_handle, auth_hierarchy_obj_session_handle, ESYS_TR_NONE,
-            ESYS_TR_NONE);
+        esys_tr_nv_handle, auth_hierarchy_obj_session_handle, shandle2,
+        shandle3);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_NV_WriteLock, rval);
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_nvwritelock_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_nvglobalwritelock(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
-            &auth_hierarchy_obj_session_handle);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to get shandle");
-        return rc;
-    }
-
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2B_DIGEST *cp_hash,
+    TPM2B_DIGEST *rp_hash, TPMI_ALG_HASH parameter_hash_algorithm,
+    ESYS_TR shandle2, ESYS_TR shandle3) {
+
+    tool_rc rc = tool_rc_success;
+    TSS2_SYS_CONTEXT *sys_context = 0;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         TSS2_RC rval = Tss2_Sys_NV_GlobalWriteLock_Prepare(sys_context,
             auth_hierarchy_obj->handle);
         if (rval != TPM2_RC_SUCCESS) {
@@ -2838,33 +3677,48 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
             &name1);
         if (rc != tool_rc_success) {
             goto tpm2_globalnvwritelock_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
 tpm2_globalnvwritelock_free_name1:
         Esys_Free(name1);
-        goto tpm2_globalnvwritelock_skip_esapi_call;
+        if (!rp_hash->size) {
+            goto tpm2_globalnvwritelock_skip_esapi_call;
+        }
     }
 
-    TSS2_RC rval = Esys_NV_GlobalWriteLock(esys_context, auth_hierarchy_obj->tr_handle,
-            auth_hierarchy_obj_session_handle, ESYS_TR_NONE, ESYS_TR_NONE);
+    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context,
+        auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
+        &auth_hierarchy_obj_session_handle);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to get shandle");
+        return rc;
+    }
+
+    TSS2_RC rval = Esys_NV_GlobalWriteLock(esys_context,
+        auth_hierarchy_obj->tr_handle, auth_hierarchy_obj_session_handle,
+        shandle2, shandle3);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_NV_GlobalWriteLock, rval);
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_globalnvwritelock_skip_esapi_call:
     return rc;
 }
@@ -2882,37 +3736,40 @@
 }
 
 tool_rc tpm2_nvsetbits(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        UINT64 bits, TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR esys_tr_nv_handle;
-    TSS2_RC rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
-        ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
-    if (rval != TPM2_RC_SUCCESS) {
-        LOG_PERR(Esys_TR_FromTPMPublic, rval);
-        return tool_rc_from_tpm(rval);
-    }
-
-    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-        auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
-        &auth_hierarchy_obj_session_handle);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to get shandle");
-        return rc;
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    UINT64 bits, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, TPM2B_NAME *precalc_nvname,
+    ESYS_TR shandle2, ESYS_TR shandle3) {
+
+    /*
+     * If command is to be dispatched the NV index must exist.
+     * In this case get the NV index name by reading its public information.
+     * If rpHash size is non zero then command is always dispatched.
+     */
+    ESYS_TR esys_tr_nv_handle = ESYS_TR_NONE;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    bool is_name_specified = precalc_nvname ? precalc_nvname->size : false;
+    if (!is_name_specified) {
+        rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
+            ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_TR_FromTPMPublic, rval);
+            return tool_rc_from_tpm(rval);
+        }
     }
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
+
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         rval = Tss2_Sys_NV_SetBits_Prepare(sys_context,
             auth_hierarchy_obj->handle, nv_index, bits);
         if (rval != TPM2_RC_SUCCESS) {
@@ -2920,78 +3777,116 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
-            &name1);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvsetbits_free_name1;
+        /*
+         * We need this to use precalc-name for parent authorization when the
+         * NV index itself is the authorization parent AND
+         * we don't need/have the NV index defined when simply calculating cpHash.
+         */
+        bool is_auth_hierarchy_nv_index =
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_OWNER) &&
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_PLATFORM);
+
+        TPM2B_NAME *name1 = 0;
+        if (is_auth_hierarchy_nv_index && is_name_specified) {
+            name1 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
+                &name1);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvsetbits_free_name1;
+            }
         }
 
-        TPM2B_NAME *name2 = NULL;
-        rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvsetbits_free_name1_name2;
+        TPM2B_NAME *name2 = 0;
+        if (is_name_specified) {
+            name2 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvsetbits_free_name1_name2;
+            }
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
+tpm2_nvsetbits_free_name1_name2:
+        if (!is_name_specified) {
+            Esys_Free(name2);
+        }
+tpm2_nvsetbits_free_name1:
+        if (!is_name_specified) {
+            Esys_Free(name1);
+        }
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
-tpm2_nvsetbits_free_name1_name2:
-        Esys_Free(name2);
-tpm2_nvsetbits_free_name1:
-        Esys_Free(name1);
-        goto tpm2_nvsetbits_skip_esapi_call;
+        if (!rp_hash->size) {
+            goto tpm2_nvsetbits_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context,
+        auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
+        &auth_hierarchy_obj_session_handle);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to get shandle");
+        return rc;
     }
 
     rval = Esys_NV_SetBits(esys_context, auth_hierarchy_obj->tr_handle,
-            esys_tr_nv_handle, auth_hierarchy_obj_session_handle, ESYS_TR_NONE,
-            ESYS_TR_NONE, bits);
+            esys_tr_nv_handle, auth_hierarchy_obj_session_handle, shandle2,
+            shandle3, bits);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_NV_SetBits, rval);
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_nvsetbits_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_nvextend(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        TPM2B_MAX_NV_BUFFER *data, TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR esys_tr_nv_handle;
-    TSS2_RC rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_MAX_NV_BUFFER *data, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, TPM2B_NAME *precalc_nvname,
+    ESYS_TR shandle2, ESYS_TR shandle3) {
+
+    /*
+     * If command is to be dispatched the NV index must exist.
+     * In this case get the NV index name by reading its public information.
+     * If rpHash size is non zero then command is always dispatched.
+     */
+    ESYS_TR esys_tr_nv_handle = ESYS_TR_NONE;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    bool is_name_specified = precalc_nvname ? precalc_nvname->size : false;
+    if (!is_name_specified) {
+        rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
             ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
-    if (rval != TPM2_RC_SUCCESS) {
-        LOG_PERR(Esys_TR_FromTPMPublic, rval);
-        return tool_rc_from_tpm(rval);
-    }
-
-    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
-            &auth_hierarchy_obj_session_handle);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to get shandle");
-        return rc;
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_TR_FromTPMPublic, rval);
+            return tool_rc_from_tpm(rval);
+        }
     }
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
+
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         rval = Tss2_Sys_NV_Extend_Prepare(sys_context,
             auth_hierarchy_obj->handle, nv_index, data);
         if (rval != TPM2_RC_SUCCESS) {
@@ -2999,78 +3894,114 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
-            &name1);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvextend_free_name1;
+        /*
+         * We need this to use precalc-name for parent authorization when the
+         * NV index itself is the authorization parent AND
+         * we don't need/have the NV index defined when simply calculating cpHash.
+         */
+        bool is_auth_hierarchy_nv_index =
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_OWNER) &&
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_PLATFORM);
+
+        TPM2B_NAME *name1 = 0;
+        if (is_auth_hierarchy_nv_index && is_name_specified) {
+            name1 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
+                &name1);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvextend_free_name1;
+            }
         }
 
-        TPM2B_NAME *name2 = NULL;
-        rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvextend_free_name1_name2;
+        TPM2B_NAME *name2 = 0;
+        if (is_name_specified) {
+            name2 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvextend_free_name1_name2;
+            }
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
+tpm2_nvextend_free_name1_name2:
+        if (!is_name_specified) {
+            Esys_Free(name2);
+        }
+tpm2_nvextend_free_name1:
+        if (!is_name_specified) {
+            Esys_Free(name1);
+        }
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
-tpm2_nvextend_free_name1_name2:
-        Esys_Free(name2);
-tpm2_nvextend_free_name1:
-        Esys_Free(name1);
-        goto tpm2_nvextend_skip_esapi_call;
+        if (!rp_hash->size) {
+            goto tpm2_nvextend_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context,
+            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
+            &auth_hierarchy_obj_session_handle);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to get shandle");
+        return rc;
     }
 
     rval = Esys_NV_Extend(esys_context, auth_hierarchy_obj->tr_handle,
-            esys_tr_nv_handle, auth_hierarchy_obj_session_handle, ESYS_TR_NONE,
-            ESYS_TR_NONE, data);
+            esys_tr_nv_handle, auth_hierarchy_obj_session_handle, shandle2,
+            shandle3, data);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_NV_Extend, rval);
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_nvextend_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_nvundefine(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR esys_tr_nv_handle;
-    TSS2_RC rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
-            ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
-    if (rval != TPM2_RC_SUCCESS) {
-        LOG_PERR(Esys_TR_FromTPMPublic, rval);
-        return tool_rc_from_tpm(rval);
-    }
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_NAME *precalc_nvname, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2, ESYS_TR shandle3) {
 
-    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
-            &auth_hierarchy_obj_session_handle);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Couldn't get shandle");
-        return rc;
+    /*
+     * If command is to be dispatched the NV index must exist.
+     * In this case get the NV index name by reading its public information.
+     * If rpHash size is non zero then command is always dispatched.
+     */
+    ESYS_TR esys_tr_nv_handle = ESYS_TR_NONE;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    bool is_name_specified = precalc_nvname ? precalc_nvname->size : false;
+    if (!is_name_specified) {
+        rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
+                ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_TR_FromTPMPublic, rval);
+            return tool_rc_from_tpm(rval);
+        }
     }
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    TSS2_SYS_CONTEXT *sys_context = 0;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         rval = Tss2_Sys_NV_UndefineSpace_Prepare(sys_context,
             auth_hierarchy_obj->handle, nv_index);
         if (rval != TPM2_RC_SUCCESS) {
@@ -3078,83 +4009,107 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
             &name1);
         if (rc != tool_rc_success) {
             goto tpm2_nvundefine_free_name1;
         }
 
-        TPM2B_NAME *name2 = NULL;
-        rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvundefine_free_name1_name2;
+        if (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_PLATFORM &&
+        auth_hierarchy_obj->tr_handle != ESYS_TR_RH_OWNER) {
+            LOG_ERR("Auth hierarchy must be platform to continue.");
+            goto tpm2_nvundefine_free_name1;
+        }
+        TPM2B_NAME *name2 = 0;
+        if (is_name_specified) {
+            name2 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvundefine_free_name1_name2;
+            }
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, name2, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
 tpm2_nvundefine_free_name1_name2:
-        Esys_Free(name2);
+        if (!is_name_specified) {
+            Esys_Free(name2);
+        }
 tpm2_nvundefine_free_name1:
         Esys_Free(name1);
-        goto tpm2_nvundefine_skip_esapi_call;
+        if (rc != tool_rc_success || !rp_hash->size) {
+            goto tpm2_nvundefine_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context,
+            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
+            &auth_hierarchy_obj_session_handle);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Couldn't get shandle");
+        return rc;
     }
 
     rval = Esys_NV_UndefineSpace(esys_context, auth_hierarchy_obj->tr_handle,
-            esys_tr_nv_handle, auth_hierarchy_obj_session_handle, ESYS_TR_NONE,
-            ESYS_TR_NONE);
+        esys_tr_nv_handle, auth_hierarchy_obj_session_handle, shandle2,
+        shandle3);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_ERR("Failed to release NV area at index 0x%X", nv_index);
         LOG_PERR(Esys_NV_UndefineSpace, rval);
         return tool_rc_from_tpm(rval);
     }
-
     LOG_INFO("Success to release NV area at index 0x%x.", nv_index);
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_nvundefine_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_nvundefinespecial(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        tpm2_session *policy_session, TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR esys_tr_nv_handle;
-    TSS2_RC rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
-            ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
-    if (rval != TPM2_RC_SUCCESS) {
-        LOG_PERR(Esys_TR_FromTPMPublic, rval);
-        return tool_rc_from_tpm(rval);
-    }
-
-    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
-            &auth_hierarchy_obj_session_handle);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Couldn't get shandle");
-        return rc;
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_NAME *precalc_nvname, tpm2_session *policy_session,
+    TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle3) {
+
+    /*
+     * If command is to be dispatched the NV index must exist.
+     * In this case get the NV index name by reading its public information.
+     * If rpHash size is non zero then command is always dispatched.
+     */
+    ESYS_TR esys_tr_nv_handle = ESYS_TR_NONE;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    bool is_name_specified = precalc_nvname ? precalc_nvname->size : false;
+    if (!is_name_specified) {
+        rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
+                ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_TR_FromTPMPublic, rval);
+            return tool_rc_from_tpm(rval);
+        }
     }
 
-    ESYS_TR policy_session_handle = tpm2_session_get_handle(policy_session);
-
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    TSS2_SYS_CONTEXT *sys_context = 0;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         rval = Tss2_Sys_NV_UndefineSpaceSpecial_Prepare(sys_context, nv_index,
             auth_hierarchy_obj->handle);
         if (rval != TPM2_RC_SUCCESS) {
@@ -3162,23 +4117,29 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name1);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvundefinespecial_free_name1;
+        TPM2B_NAME *name1 = 0;
+        if (is_name_specified) {
+            name1 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name1);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvundefinespecial_free_name1;
+            }
         }
 
-        TPM2B_NAME *name2 = NULL;
+        if (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_PLATFORM) {
+            LOG_ERR("Auth hierarchy must be platform to continue.");
+            goto tpm2_nvundefinespecial_free_name1;
+        }
+        TPM2B_NAME *name2 = 0;
         rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
             &name2);
         if (rc != tool_rc_success) {
             goto tpm2_nvundefinespecial_free_name1_name2;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, name2, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -3186,61 +4147,82 @@
 tpm2_nvundefinespecial_free_name1_name2:
         Esys_Free(name2);
 tpm2_nvundefinespecial_free_name1:
-        Esys_Free(name1);
-        goto tpm2_nvundefinespecial_skip_esapi_call;
+        if (!is_name_specified) {
+            Esys_Free(name1);
+        }
+        if (rc != tool_rc_success || !rp_hash->size) {
+            goto tpm2_nvundefinespecial_skip_esapi_call;
+        }
     }
 
+    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context,
+            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
+            &auth_hierarchy_obj_session_handle);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Couldn't get shandle");
+        return rc;
+    }
+
+    ESYS_TR policy_session_handle = tpm2_session_get_handle(policy_session);
+
     rval = Esys_NV_UndefineSpaceSpecial(esys_context,
             esys_tr_nv_handle,
             auth_hierarchy_obj->tr_handle,
             policy_session_handle, // policy session
             auth_hierarchy_obj_session_handle, // auth session for hierarchy
-            ESYS_TR_NONE);
+            shandle3); //aux session for enc/ audit
     if (rval != TPM2_RC_SUCCESS) {
         LOG_ERR("Failed to release NV area at index 0x%X", nv_index);
         LOG_PERR(Esys_NV_UndefineSpaceSpecial, rval);
         return tool_rc_from_tpm(rval);
     }
-
     LOG_INFO("Success to release NV area at index 0x%x.", nv_index);
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_nvundefinespecial_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_nvwrite(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nvindex,
-        const TPM2B_MAX_NV_BUFFER *data, UINT16 offset, TPM2B_DIGEST *cp_hash) {
-
-    // Convert TPM2_HANDLE ctx.nv_index to an ESYS_TR
-    ESYS_TR esys_tr_nv_index;
-    TSS2_RC rval = Esys_TR_FromTPMPublic(esys_context, nvindex, ESYS_TR_NONE,
-            ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_index);
-    if (rval != TPM2_RC_SUCCESS) {
-        LOG_PERR(Esys_TR_FromTPMPublic, rval);
-        return tool_rc_from_tpm(rval);
-    }
-
-    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
-            &auth_hierarchy_obj_session_handle);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to get shandle");
-        return rc;
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nvindex,
+    TPM2B_NAME *precalc_nvname, const TPM2B_MAX_NV_BUFFER *data, UINT16 offset,
+    TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2,
+    ESYS_TR shandle3) {
+
+    /*
+     * If command is to be dispatched the NV index must exist.
+     * In this case get the NV index name by reading its public information.
+     * If rpHash size is non zero then command is always dispatched.
+     */
+    ESYS_TR esys_tr_nv_handle = ESYS_TR_NONE;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    bool is_name_specified = precalc_nvname ? precalc_nvname->size : false;
+    if (!is_name_specified) {
+        rval = Esys_TR_FromTPMPublic(esys_context, nvindex, ESYS_TR_NONE,
+                ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_TR_FromTPMPublic, rval);
+            return tool_rc_from_tpm(rval);
+        }
     }
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         rval = Tss2_Sys_NV_Write_Prepare(sys_context, auth_hierarchy_obj->handle,
             nvindex, data, offset);
         if (rval != TPM2_RC_SUCCESS) {
@@ -3248,35 +4230,71 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle, &name1);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvwrite_free_name1;
+        /*
+         * We need this to use precalc-name for parent authorization when the
+         * NV index itself is the authorization parent AND
+         * we don't need/have the NV index defined when simply calculating cpHash.
+         */
+        bool is_auth_hierarchy_nv_index =
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_OWNER) &&
+            (auth_hierarchy_obj->tr_handle != ESYS_TR_RH_PLATFORM);
+        /*
+         * We need this to avoid requiring an NV-index be defined when simply
+         * calculating cpHash.
+         */
+        TPM2B_NAME *name1 = 0;
+        if (is_auth_hierarchy_nv_index && is_name_specified) {
+            name1 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
+                &name1);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvwrite_free_name1;
+            }
         }
 
-        TPM2B_NAME *name2 = NULL;
-        rc = tpm2_tr_get_name(esys_context, esys_tr_nv_index, &name2);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvwrite_free_name1_name2;
+        TPM2B_NAME *name2 = 0;
+        if (is_name_specified) {
+            name2 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, esys_tr_nv_handle, &name2);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvwrite_free_name1_name2;
+            }
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(auth_hierarchy_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(auth_hierarchy_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
 tpm2_nvwrite_free_name1_name2:
-        Esys_Free(name2);
+        if (!is_name_specified) {
+            Esys_Free(name2);
+        }
+
 tpm2_nvwrite_free_name1:
-        Esys_Free(name1);
-        goto tpm2_nvwrite_skip_esapi_call;
+        if (!is_name_specified) {
+            Esys_Free(name1);
+        }
+
+        if (!rp_hash->size) {
+            goto tpm2_nvwrite_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context,
+            auth_hierarchy_obj->tr_handle, auth_hierarchy_obj->session,
+            &auth_hierarchy_obj_session_handle);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to get shandle");
+        return rc;
     }
 
     rval = Esys_NV_Write(esys_context, auth_hierarchy_obj->tr_handle,
-            esys_tr_nv_index, auth_hierarchy_obj_session_handle, ESYS_TR_NONE,
-            ESYS_TR_NONE, data, offset);
+            esys_tr_nv_handle, auth_hierarchy_obj_session_handle, shandle2,
+            shandle3, data, offset);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_ERR("Failed to write NV area at index 0x%X", nvindex);
         LOG_PERR(Tss2_Sys_NV_Write, rval);
@@ -3286,22 +4304,67 @@
     LOG_INFO("Success to write NV area at index 0x%x offset 0x%x.", nvindex,
             offset);
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_nvwrite_skip_esapi_call:
     return rc;
 }
 
 tool_rc tpm2_pcr_allocate(ESYS_CONTEXT *esys_context,
         tpm2_loaded_object *auth_hierarchy_obj,
-        const TPML_PCR_SELECTION *pcr_allocation) {
+        const TPML_PCR_SELECTION *pcr_allocation, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm) {
 
-    TSS2_RC rval;
     TPMI_YES_NO allocation_success;
     UINT32 max_pcr;
     UINT32 size_needed;
     UINT32 size_available;
 
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_PCR_Allocate_Prepare SAPI context.");
+            return rc;
+        }
+
+        TPM2_HANDLE h = auth_hierarchy_obj->handle;
+        TSS2_RC rval = Tss2_Sys_PCR_Allocate_Prepare(
+            sys_context, h, pcr_allocation);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_PCR_Allocate_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME *name1 = NULL;
+        rc = tpm2_tr_get_name(esys_context, auth_hierarchy_obj->tr_handle,
+            &name1);
+        if (rc != tool_rc_success) {
+            goto tpm2_pcrallocate_free_name1;
+        }
+
+        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+
+tpm2_pcrallocate_free_name1:
+        Esys_Free(name1);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        goto tpm2_pcrallocate_skip_esapi_call;
+    }
+
     ESYS_TR auth_hierarchy_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context, ESYS_TR_RH_PLATFORM,
+    rc = tpm2_auth_util_get_shandle(esys_context, ESYS_TR_RH_PLATFORM,
             auth_hierarchy_obj->session, &auth_hierarchy_obj_session_handle);
     if (rc != tool_rc_success) {
         LOG_ERR("Couldn't get shandle for lockout hierarchy");
@@ -3325,13 +4388,14 @@
         return tool_rc_general_error;
     }
 
-    return tool_rc_success;
+tpm2_pcrallocate_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_sign(ESYS_CONTEXT *esys_context, tpm2_loaded_object *signingkey_obj,
-        TPM2B_DIGEST *digest, TPMT_SIG_SCHEME *in_scheme,
-        TPMT_TK_HASHCHECK *validation, TPMT_SIGNATURE **signature,
-        TPM2B_DIGEST *cp_hash) {
+    TPM2B_DIGEST *digest, TPMT_SIG_SCHEME *in_scheme,
+    TPMT_TK_HASHCHECK *validation, TPMT_SIGNATURE **signature,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR signingkey_obj_session_handle = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
@@ -3341,11 +4405,11 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -3359,17 +4423,15 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, signingkey_obj->tr_handle,
             &name1);
         if (rc != tool_rc_success) {
             goto tpm2_sign_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(signingkey_obj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(signingkey_obj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -3393,46 +4455,41 @@
 
 tool_rc tpm2_nvcertify(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *signingkey_obj, tpm2_loaded_object *nvindex_authobj,
-    TPM2_HANDLE nv_index, UINT16 offset, UINT16 size,
+    TPM2_HANDLE nv_index, TPM2B_NAME *precalc_nvname,
+    TPM2B_NAME *precalc_signername, UINT16 offset, UINT16 size,
     TPMT_SIG_SCHEME *in_scheme, TPM2B_ATTEST **certify_info,
     TPMT_SIGNATURE **signature, TPM2B_DATA *policy_qualifier,
-    TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR signingkey_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            signingkey_obj->tr_handle, signingkey_obj->session,
-            &signingkey_obj_session_handle);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
-
-    ESYS_TR nvindex_authobj_session_handle = ESYS_TR_NONE;
-    rc = tpm2_auth_util_get_shandle(esys_context,
-        nvindex_authobj->tr_handle, nvindex_authobj->session,
-        &nvindex_authobj_session_handle);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
+    TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle3) {
 
-    ESYS_TR esys_tr_nv_index;
-    TSS2_RC rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
+    ESYS_TR esys_tr_nv_index = ESYS_TR_NONE;
+    /*
+     * If command is to be dispatched the NV index must exist.
+     * In this case get the NV index name by reading its public information.
+     * If rpHash size is non zero then command is always dispatched.
+     */
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    bool is_nvname_specified = precalc_nvname ? precalc_nvname->size : false;
+    if (!is_nvname_specified) {
+        rval = Esys_TR_FromTPMPublic(esys_context, nv_index, ESYS_TR_NONE,
             ESYS_TR_NONE, ESYS_TR_NONE, &esys_tr_nv_index);
-    if (rval != TPM2_RC_SUCCESS) {
-        LOG_PERR(Esys_TR_FromTPMPublic, rval);
-        return tool_rc_from_tpm(rval);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_TR_FromTPMPublic, rval);
+            return tool_rc_from_tpm(rval);
+        }
     }
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         rval = Tss2_Sys_NV_Certify_Prepare(sys_context, signingkey_obj->handle,
             nvindex_authobj->handle, nv_index, policy_qualifier, in_scheme,
             size, offset);
@@ -3441,51 +4498,104 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(esys_context, signingkey_obj->tr_handle, &name1);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvcertify_free_name1;
+        bool is_signername_specified = precalc_signername ?
+            precalc_signername->size : false;
+        TPM2B_NAME *name1 = 0;
+        if (is_signername_specified) {
+            name1 = precalc_signername;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, signingkey_obj->tr_handle, &name1);
+                if (rc != tool_rc_success) {
+                goto tpm2_nvcertify_free_name1;
+            }
         }
 
-        TPM2B_NAME *name2 = NULL;
-        rc = tpm2_tr_get_name(esys_context, nvindex_authobj->tr_handle, &name2);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvcertify_free_name1_name2;
+        /*
+         * We need this to use precalc-name for parent authorization when the
+         * NV index itself is the authorization parent AND
+         * we don't need/have the NV index defined when simply calculating cpHash.
+         */
+        bool is_auth_hierarchy_nv_index =
+            (nvindex_authobj->tr_handle != ESYS_TR_RH_OWNER) &&
+            (nvindex_authobj->tr_handle != ESYS_TR_RH_PLATFORM);
+        /*
+         * We need this to avoid requiring an NV-index be defined when simply
+         * calculating cpHash.
+         */
+        TPM2B_NAME *name2 = 0;
+        if (is_auth_hierarchy_nv_index && is_nvname_specified) {
+            name2 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, nvindex_authobj->tr_handle,
+                &name2);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvcertify_free_name1_name2;
+            }
         }
 
-        TPM2B_NAME *name3 = NULL;
-        rc = tpm2_tr_get_name(esys_context, esys_tr_nv_index, &name3);
-        if (rc != tool_rc_success) {
-            goto tpm2_nvcertify_free_name1_name2_name3;
+        TPM2B_NAME *name3 = 0;
+        if (is_nvname_specified) {
+            name3 = precalc_nvname;
+        } else {
+            rc = tpm2_tr_get_name(esys_context, esys_tr_nv_index, &name3);
+            if (rc != tool_rc_success) {
+                goto tpm2_nvcertify_free_name1_name2_name3;
+            }
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(signingkey_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, name3,
-            tpm2_session_get_authhash(signingkey_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
 tpm2_nvcertify_free_name1_name2_name3:
-        Esys_Free(name3);
+        if (!is_nvname_specified) {
+            Esys_Free(name3);
+        }
 tpm2_nvcertify_free_name1_name2:
-        Esys_Free(name2);
+            Esys_Free(name2);
 tpm2_nvcertify_free_name1:
-        Esys_Free(name1);
-        goto tpm2_nvcertify_skip_esapi_call;
+        if (!is_signername_specified) {
+            Esys_Free(name1);
+        }
+
+        if (!rp_hash->size) {
+            goto tpm2_nvcertify_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR signingkey_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context,
+        signingkey_obj->tr_handle, signingkey_obj->session,
+        &signingkey_obj_session_handle);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    ESYS_TR nvindex_authobj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context,
+        nvindex_authobj->tr_handle, nvindex_authobj->session,
+        &nvindex_authobj_session_handle);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     rval = Esys_NV_Certify(esys_context, signingkey_obj->tr_handle,
         nvindex_authobj->tr_handle, esys_tr_nv_index,
         signingkey_obj_session_handle, nvindex_authobj_session_handle,
-        ESYS_TR_NONE, policy_qualifier, in_scheme, size, offset, certify_info,
+        shandle3, policy_qualifier, in_scheme, size, offset, certify_info,
         signature);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_NV_Certify, rval);
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_nvcertify_skip_esapi_call:
     return rc;
 }
@@ -3495,27 +4605,21 @@
     TPM2B_DIGEST *creation_hash, TPMT_SIG_SCHEME *in_scheme,
     TPMT_TK_CREATION *creation_ticket, TPM2B_ATTEST **certify_info,
     TPMT_SIGNATURE **signature, TPM2B_DATA *policy_qualifier,
-    TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR signingkey_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
-            signingkey_obj->tr_handle, signingkey_obj->session,
-            &signingkey_obj_session_handle);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
+    TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2, ESYS_TR shandle3) {
 
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
+
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         TSS2_RC rval = Tss2_Sys_CertifyCreation_Prepare(sys_context,
         signingkey_obj->handle, certifiedkey_obj->handle, policy_qualifier,
         creation_hash, in_scheme, creation_ticket);
@@ -3536,52 +4640,65 @@
             goto tpm2_certifycreation_free_name1_name2;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(signingkey_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(signingkey_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
-        /*
-         * Exit here without making the ESYS call since we just need the cpHash
-         */
 tpm2_certifycreation_free_name1_name2:
         Esys_Free(name2);
 tpm2_certifycreation_free_name1:
         Esys_Free(name1);
-        goto tpm2_certifycreation_skip_esapi_call;
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        if (!rp_hash->size || rc != tool_rc_success) {
+            goto tpm2_certifycreation_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR signingkey_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context, signingkey_obj->tr_handle,
+        signingkey_obj->session, &signingkey_obj_session_handle);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     TSS2_RC rval = Esys_CertifyCreation(esys_context, signingkey_obj->tr_handle,
         certifiedkey_obj->tr_handle, signingkey_obj_session_handle,
-        ESYS_TR_NONE, ESYS_TR_NONE, policy_qualifier, creation_hash, in_scheme,
+        shandle2, shandle3, policy_qualifier, creation_hash, in_scheme,
         creation_ticket, certify_info, signature);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_CertifyCreation, rval);
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_certifycreation_skip_esapi_call:
     return rc;
 }
 
-tool_rc tpm2_setprimarypolicy(ESYS_CONTEXT *esys_context,
+tool_rc tpm2_setprimarypolicy(ESYS_CONTEXT *ectx,
     tpm2_loaded_object *hierarchy_object, TPM2B_DIGEST *auth_policy,
-    TPMI_ALG_HASH hash_algorithm, TPM2B_DIGEST *cp_hash) {
+    TPMI_ALG_HASH hash_algorithm, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR hierarchy_object_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
+    tool_rc rc = tpm2_auth_util_get_shandle(ectx,
             hierarchy_object->tr_handle, hierarchy_object->session,
             &hierarchy_object_session_handle);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
-        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(ectx, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
@@ -3594,17 +4711,15 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(esys_context, hierarchy_object->tr_handle,
+        TPM2B_NAME *name1 = 0;
+        rc = tpm2_tr_get_name(ectx, hierarchy_object->tr_handle,
             &name1);
         if (rc != tool_rc_success) {
             goto tpm2_setprimarypolicy_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(hierarchy_object->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(hierarchy_object->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -3614,7 +4729,7 @@
         goto tpm2_setprimarypolicy_skip_esapi_call;
     }
 
-    TSS2_RC rval = Esys_SetPrimaryPolicy(esys_context,
+    TSS2_RC rval = Esys_SetPrimaryPolicy(ectx,
         hierarchy_object->tr_handle, hierarchy_object_session_handle,
         ESYS_TR_NONE, ESYS_TR_NONE, auth_policy, hash_algorithm);
     if (rval != TPM2_RC_SUCCESS) {
@@ -3626,9 +4741,10 @@
 }
 
 tool_rc tpm2_quote(ESYS_CONTEXT *esys_context, tpm2_loaded_object *quote_obj,
-        TPMT_SIG_SCHEME *in_scheme, TPM2B_DATA *qualifying_data,
-        TPML_PCR_SELECTION *pcr_select, TPM2B_ATTEST **quoted,
-        TPMT_SIGNATURE **signature, TPM2B_DIGEST *cp_hash) {
+    TPMT_SIG_SCHEME *in_scheme, TPM2B_DATA *qualifying_data,
+    TPML_PCR_SELECTION *pcr_select, TPM2B_ATTEST **quoted,
+    TPMT_SIGNATURE **signature, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR quote_obj_session_handle = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(esys_context, quote_obj->tr_handle,
@@ -3638,11 +4754,11 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(esys_context, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -3656,16 +4772,14 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(esys_context, quote_obj->tr_handle, &name1);
         if (rc != tool_rc_success) {
             goto tpm2_quote_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(quote_obj->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(quote_obj->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -3687,66 +4801,151 @@
 }
 
 tool_rc tpm2_changeeps(ESYS_CONTEXT *ectx,
-    tpm2_session *platform_hierarchy_session) {
+    tpm2_session *platform_hierarchy_session, TPM2B_DIGEST *cp_hash,
+    TPM2B_DIGEST *rp_hash, TPMI_ALG_HASH parameter_hash_algorithm,
+    ESYS_TR shandle2, ESYS_TR shandle3) {
+
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
+        rc = tpm2_getsapicontext(ectx, &sys_context);
+
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire SAPI context.");
+            return rc;
+        }
+    }
+
+    if (cp_hash->size) {
+        TSS2_RC rval = Tss2_Sys_ChangeEPS_Prepare(sys_context, TPM2_RH_PLATFORM);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_ObjectChangeAuth_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME *name1 = NULL;
+        rc = tpm2_tr_get_name(ectx, ESYS_TR_RH_PLATFORM ,&name1);
+        if (rc != tool_rc_success) {
+            goto tpm2_changeeps_free_name1;
+        }
+
+        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+
+tpm2_changeeps_free_name1:
+        Esys_Free(name1);
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        if (!rp_hash->size || rc != tool_rc_success) {
+            goto tpm2_changeeps_skip_esapi_call;
+        }
+    }
 
     ESYS_TR platform_hierarchy_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(ectx, ESYS_TR_RH_PLATFORM,
+    rc = tpm2_auth_util_get_shandle(ectx, ESYS_TR_RH_PLATFORM,
         platform_hierarchy_session, &platform_hierarchy_session_handle);
     if (rc != tool_rc_success) {
         return rc;
     }
 
     TSS2_RC rval = Esys_ChangeEPS(ectx, ESYS_TR_RH_PLATFORM,
-        platform_hierarchy_session_handle, ESYS_TR_NONE, ESYS_TR_NONE);
+        platform_hierarchy_session_handle, shandle2, shandle3);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_ChangeEPS, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
+tpm2_changeeps_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_changepps(ESYS_CONTEXT *ectx,
-    tpm2_session *platform_hierarchy_session) {
+    tpm2_session *platform_hierarchy_session, TPM2B_DIGEST *cp_hash,
+    TPM2B_DIGEST *rp_hash, TPMI_ALG_HASH parameter_hash_algorithm,
+    ESYS_TR shandle2, ESYS_TR shandle3) {
+
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = (cp_hash->size || rp_hash->size) ?
+        tpm2_getsapicontext(ectx, &sys_context)
+        : tool_rc_success;
+    if(rc != tool_rc_success) {
+        LOG_ERR("Failed to acquire SAPI context.");
+        return rc;
+    }
+
+    if (cp_hash->size) {
+        TSS2_RC rval = Tss2_Sys_ChangePPS_Prepare(sys_context, TPM2_RH_PLATFORM);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_ObjectChangeAuth_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME *name1 = NULL;
+        rc = tpm2_tr_get_name(ectx, ESYS_TR_RH_PLATFORM ,&name1);
+        if (rc != tool_rc_success) {
+            goto tpm2_changepps_free_name1;
+        }
+
+        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+
+tpm2_changepps_free_name1:
+        Esys_Free(name1);
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        if (!rp_hash->size || rc != tool_rc_success) {
+            goto tpm2_changepps_skip_esapi_call;
+        }
+    }
 
     ESYS_TR platform_hierarchy_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(ectx, ESYS_TR_RH_PLATFORM,
+    rc = tpm2_auth_util_get_shandle(ectx, ESYS_TR_RH_PLATFORM,
         platform_hierarchy_session, &platform_hierarchy_session_handle);
     if (rc != tool_rc_success) {
         return rc;
     }
 
     TSS2_RC rval = Esys_ChangePPS(ectx, ESYS_TR_RH_PLATFORM,
-        platform_hierarchy_session_handle, ESYS_TR_NONE, ESYS_TR_NONE);
+        platform_hierarchy_session_handle, shandle2, shandle3);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_ChangePPS, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
+tpm2_changepps_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_unseal(ESYS_CONTEXT *esys_context, tpm2_loaded_object *sealkey_obj,
-        TPM2B_SENSITIVE_DATA **out_data, TPM2B_DIGEST *cp_hash) {
+    TPM2B_SENSITIVE_DATA **out_data, TPM2B_DIGEST *cp_hash,
+    TPM2B_DIGEST *rp_hash, TPMI_ALG_HASH parameter_hash_algorithm,
+    ESYS_TR shandle2, ESYS_TR shandle3) {
 
-    ESYS_TR sealkey_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context, sealkey_obj->tr_handle,
-            sealkey_obj->session, &sealkey_obj_session_handle);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
 
-        if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+    TSS2_SYS_CONTEXT *sys_context = NULL;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(esys_context, &sys_context);
+
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
+    }
 
+    if (cp_hash->size) {
         TSS2_RC rval = Tss2_Sys_Unseal_Prepare(sys_context,
             sealkey_obj->handle);
         if (rval != TPM2_RC_SUCCESS) {
@@ -3761,26 +4960,38 @@
             goto tpm2_unseal_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(sealkey_obj->session));
         rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(sealkey_obj->session), cp_hash);
+            parameter_hash_algorithm, cp_hash);
 
+tpm2_unseal_free_name1:
+        Esys_Free(name1);
         /*
          * Exit here without making the ESYS call since we just need the cpHash
          */
-tpm2_unseal_free_name1:
-        Esys_Free(name1);
-        goto tpm2_unseal_skip_esapi_call;
+        if (!rp_hash->size) {
+            goto tpm2_unseal_skip_esapi_call;
+        }
+    }
+
+    ESYS_TR sealkey_obj_session_handle = ESYS_TR_NONE;
+    rc = tpm2_auth_util_get_shandle(esys_context, sealkey_obj->tr_handle,
+            sealkey_obj->session, &sealkey_obj_session_handle);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     TSS2_RC rval = Esys_Unseal(esys_context, sealkey_obj->tr_handle,
-            sealkey_obj_session_handle, ESYS_TR_NONE, ESYS_TR_NONE, out_data);
+            sealkey_obj_session_handle, shandle2, shandle3, out_data);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_Unseal, rval);
         return tool_rc_from_tpm(rval);
     }
 
+    if (rp_hash->size) {
+        rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
+            parameter_hash_algorithm);
+    }
+
 tpm2_unseal_skip_esapi_call:
     return rc;
 }
@@ -3837,104 +5048,177 @@
 }
 
 tool_rc tpm2_loadexternal(ESYS_CONTEXT *ectx, const TPM2B_SENSITIVE *private,
-        const TPM2B_PUBLIC *public, TPMI_RH_HIERARCHY hierarchy,
-        ESYS_TR *object_handle) {
+    const TPM2B_PUBLIC *public, TPMI_RH_HIERARCHY hierarchy,
+    ESYS_TR *object_handle, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
-    TSS2_RC rval = fix_esys_hierarchy(hierarchy, &hierarchy);
+    tool_rc rc = tool_rc_success;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(ectx, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_LoadExternal_Prepare(sys_context, private,
+            public, hierarchy);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_LoadExternal_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        rc = tpm2_sapi_getcphash(sys_context, 0, 0, 0, parameter_hash_algorithm,
+            cp_hash);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        goto tpm2_loadexternal_skip_esapi_call;
+    }
+
+    rval = fix_esys_hierarchy(hierarchy, &hierarchy);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_ERR("Unknown hierarchy");
         return tool_rc_from_tpm(rval);
     }
 
-    rval = Esys_LoadExternal(ectx,
-            ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
-            private, public, hierarchy,
-            object_handle);
+    rval = Esys_LoadExternal(ectx, ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
+        private, public, hierarchy, object_handle);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_LoadExternal, rval);
         return tool_rc_from_tpm(rval);
     }
 
+tpm2_loadexternal_skip_esapi_call:
+    return rc;
+}
+
+tool_rc tpm2_pcr_extend(ESYS_CONTEXT *ectx, TPMI_DH_PCR pcr_index,
+    TPML_DIGEST_VALUES *digests) {
+
+    TSS2_RC rval = Esys_PCR_Extend(ectx, pcr_index, ESYS_TR_PASSWORD,
+        ESYS_TR_NONE, ESYS_TR_NONE, digests);
+    if (rval != TSS2_RC_SUCCESS) {
+        LOG_PERR(Esys_PCR_Extend, rval);
+        return tool_rc_from_tpm(rval);
+    }
+
     return tool_rc_success;
 }
 
-tool_rc tpm2_pcr_event(ESYS_CONTEXT *ectx,
-        ESYS_TR pcr, tpm2_session *session,
-        const TPM2B_EVENT *event_data,
-        TPML_DIGEST_VALUES **digests) {
+tool_rc tpm2_pcr_event(ESYS_CONTEXT *ectx, ESYS_TR pcr, tpm2_session *session,
+        const TPM2B_EVENT *event_data, TPML_DIGEST_VALUES **digests,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
+
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(ectx, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_PCR_Event_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_PCR_Event_Prepare(
+        sys_context, pcr, event_data);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_PCR_Event_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME *name1 = NULL;
+        rc = tpm2_tr_get_name(ectx, pcr, &name1);
+        if (rc != tool_rc_success) {
+            goto tpm2_pcrevent_free_name1;
+        }
+
+        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+
+tpm2_pcrevent_free_name1:
+        Esys_Free(name1);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        goto tpm2_pcrevent_skip_esapi_call;
+    }
 
     ESYS_TR shandle1 = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(ectx, pcr, session,
+    rc = tpm2_auth_util_get_shandle(ectx, pcr, session,
             &shandle1);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    TSS2_RC rval = Esys_PCR_Event(ectx, pcr, shandle1, ESYS_TR_NONE,
+    rval = Esys_PCR_Event(ectx, pcr, shandle1, ESYS_TR_NONE,
             ESYS_TR_NONE, event_data, digests);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_PCR_Event, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_pcrevent_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_getrandom(ESYS_CONTEXT *ectx, UINT16 count,
         TPM2B_DIGEST **random, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
-        ESYS_TR audit_session_handle, TPMI_ALG_HASH param_hash_algorithm) {
-
-    tool_rc rc = audit_session_handle == ESYS_TR_NONE ? tool_rc_success :
-    evaluate_sessions_for_audit(ectx, audit_session_handle);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
+        ESYS_TR session_handle_1, ESYS_TR session_handle_2,
+        ESYS_TR session_handle_3, TPMI_ALG_HASH parameter_hash_algorithm) {
 
     TSS2_SYS_CONTEXT *sys_context = NULL;
-    TSS2_RC rval;
-    if (cp_hash || rp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
+    tool_rc rc = tool_rc_success;
+    if (cp_hash->size || rp_hash->size) {
         rc = tpm2_getsapicontext(ectx, &sys_context);
-        if(rc != tool_rc_success) {
+
+        if (rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
             return rc;
         }
     }
 
-    if (cp_hash) {
-        rval = Tss2_Sys_GetRandom_Prepare(sys_context, count);
+    if (cp_hash->size) {
+        TSS2_RC rval = Tss2_Sys_GetRandom_Prepare(sys_context, count);
         if (rval != TPM2_RC_SUCCESS) {
             LOG_PERR(Tss2_Sys_GetRandom_Prepare, rval);
             return tool_rc_general_error;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(param_hash_algorithm);
         rc = tpm2_sapi_getcphash(sys_context, NULL, NULL, NULL,
-        param_hash_algorithm, cp_hash);
+            parameter_hash_algorithm, cp_hash);
         if (rc != tool_rc_success) {
             return rc;
         }
+
         /*
          * Exit here without making the ESYS call since if we only need cpHash
          */
-        if (!rp_hash) {
+        if (!rp_hash->size || rc != tool_rc_success) {
             goto tpm2_getrandom_skip_esapi_call;
         }
     }
 
-    rval = Esys_GetRandom(ectx, audit_session_handle, ESYS_TR_NONE,
-        ESYS_TR_NONE, count, random);
+    TSS2_RC rval = Esys_GetRandom(ectx, session_handle_1, session_handle_2,
+        session_handle_3, count, random);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_GetRandom, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    if (rp_hash) {
+    if (rp_hash->size) {
         rc = tpm2_sapi_getrphash(sys_context, rval, rp_hash,
-        param_hash_algorithm);
-    }
+            parameter_hash_algorithm);
+    } 
 
 tpm2_getrandom_skip_esapi_call:
     return rc;
@@ -3951,16 +5235,56 @@
     return tool_rc_success;
 }
 
-tool_rc tpm2_pcr_reset(ESYS_CONTEXT *ectx, ESYS_TR pcr_handle) {
+tool_rc tpm2_pcr_reset(ESYS_CONTEXT *ectx, ESYS_TR pcr_handle,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
+
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(ectx, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_PCR_Reset_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_PCR_Reset_Prepare(
+            sys_context, pcr_handle);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_PCR_Reset_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME *name1 = NULL;
+        rc = tpm2_tr_get_name(ectx, pcr_handle, &name1);
+        if (rc != tool_rc_success) {
+            goto tpm2_pcrreset_free_name1;
+        }
+
+        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
 
-    TSS2_RC rval = Esys_PCR_Reset(ectx, pcr_handle, ESYS_TR_PASSWORD,
+tpm2_pcrreset_free_name1:
+        Esys_Free(name1);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        goto tpm2_pcrreset_skip_esapi_call;
+    }
+
+    rval = Esys_PCR_Reset(ectx, pcr_handle, ESYS_TR_PASSWORD,
             ESYS_TR_NONE, ESYS_TR_NONE);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_PCR_Reset, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_pcrreset_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_makecredential(ESYS_CONTEXT *ectx, ESYS_TR handle,
@@ -4007,7 +5331,8 @@
 }
 
 tool_rc tpm2_setclock(ESYS_CONTEXT *ectx, tpm2_loaded_object *object,
-UINT64 new_time, TPM2B_DIGEST *cp_hash) {
+    UINT64 new_time, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR shandle1 = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(ectx,
@@ -4017,11 +5342,11 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(ectx, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -4035,17 +5360,15 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(ectx, object->tr_handle,
             &name1);
         if (rc != tool_rc_success) {
             goto tpm2_setclock_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(object->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(object->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -4069,7 +5392,8 @@
 }
 
 tool_rc tpm2_clockrateadjust(ESYS_CONTEXT *ectx, tpm2_loaded_object *object,
-        TPM2_CLOCK_ADJUST rate_adjust, TPM2B_DIGEST *cp_hash) {
+    TPM2_CLOCK_ADJUST rate_adjust, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR shandle1 = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(ectx,
@@ -4079,7 +5403,7 @@
         return rc;
     }
 
-    if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
@@ -4104,10 +5428,8 @@
             goto tpm2_clockrateadjust_free_name1;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(object->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(object->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -4143,14 +5465,11 @@
     return tool_rc_success;
 }
 
-tool_rc tpm2_gettime(ESYS_CONTEXT *ectx,
-        tpm2_loaded_object *privacy_admin,
-        tpm2_loaded_object *signing_object,
-        const TPM2B_DATA *qualifying_data,
-        const TPMT_SIG_SCHEME *scheme,
-        TPM2B_ATTEST **time_info,
-        TPMT_SIGNATURE **signature,
-        TPM2B_DIGEST *cp_hash) {
+tool_rc tpm2_gettime(ESYS_CONTEXT *ectx, tpm2_loaded_object *privacy_admin,
+    tpm2_loaded_object *signing_object, const TPM2B_DATA *qualifying_data,
+    const TPMT_SIG_SCHEME *scheme, TPM2B_ATTEST **time_info,
+    TPMT_SIGNATURE **signature, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR privacy_admin_session_handle = ESYS_TR_NONE;
     tool_rc rc = tpm2_auth_util_get_shandle(ectx,
@@ -4168,11 +5487,11 @@
         return rc;
     }
 
-       if (cp_hash) {
+    if (cp_hash && cp_hash->size) {
         /*
          * Need sys_context to be able to calculate CpHash
          */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
+        TSS2_SYS_CONTEXT *sys_context = 0;
         rc = tpm2_getsapicontext(ectx, &sys_context);
         if(rc != tool_rc_success) {
             LOG_ERR("Failed to acquire SAPI context.");
@@ -4186,22 +5505,20 @@
             return tool_rc_general_error;
         }
 
-        TPM2B_NAME *name1 = NULL;
+        TPM2B_NAME *name1 = 0;
         rc = tpm2_tr_get_name(ectx, privacy_admin->tr_handle, &name1);
         if (rc != tool_rc_success) {
             goto tpm2_gettime_free_name1;
         }
 
-        TPM2B_NAME *name2 = NULL;
+        TPM2B_NAME *name2 = 0;
         rc = tpm2_tr_get_name(ectx, signing_object->tr_handle, &name2);
         if (rc != tool_rc_success) {
             goto tpm2_gettime_free_name1_name2;
         }
 
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(signing_object->session));
-        rc = tpm2_sapi_getcphash(sys_context, name1, name2, NULL,
-            tpm2_session_get_authhash(signing_object->session), cp_hash);
+        rc = tpm2_sapi_getcphash(sys_context, name1, name2, 0,
+            parameter_hash_algorithm, cp_hash);
 
         /*
          * Exit here without making the ESYS call since we just need the cpHash
@@ -4213,17 +5530,10 @@
         goto tpm2_gettime_skip_esapi_call;
     }
 
-    TSS2_RC rval = Esys_GetTime(
-            ectx,
-            privacy_admin->tr_handle,
-            signing_object->tr_handle,
-            privacy_admin_session_handle,
-            sign_session_handle,
-            ESYS_TR_NONE,
-            qualifying_data,
-            scheme,
-            time_info,
-            signature);
+    TSS2_RC rval = Esys_GetTime(ectx, privacy_admin->tr_handle,
+        signing_object->tr_handle, privacy_admin_session_handle,
+        sign_session_handle, ESYS_TR_NONE, qualifying_data, scheme, time_info,
+        signature);
     if (rval != TPM2_RC_SUCCESS) {
         LOG_PERR(Esys_GetTime, rval);
         return tool_rc_from_tpm(rval);
@@ -4234,38 +5544,139 @@
 }
 
 tool_rc tpm2_geteccparameters(ESYS_CONTEXT *esys_context,
-    TPMI_ECC_CURVE curve_id, TPMS_ALGORITHM_DETAIL_ECC **parameters) {
+    TPMI_ECC_CURVE curve_id, TPMS_ALGORITHM_DETAIL_ECC **parameters,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
+
+   tool_rc rc = tool_rc_success;
+   TSS2_RC rval = TSS2_RC_SUCCESS;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_ECC_Parameters_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_ECC_Parameters_Prepare(
+        sys_context, curve_id);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_ECC_Parameters_Prepare, rval);
+            return tool_rc_general_error;
+        }
 
-    TSS2_RC rval = Esys_ECC_Parameters(esys_context, ESYS_TR_NONE, ESYS_TR_NONE,
+        rc = tpm2_sapi_getcphash(sys_context, NULL, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        goto tpm2_geteccparameters_skip_esapi_call;
+    }
+
+    rval = Esys_ECC_Parameters(esys_context, ESYS_TR_NONE, ESYS_TR_NONE,
         ESYS_TR_NONE, curve_id, parameters);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_ECC_Parameters, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_geteccparameters_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_ecephemeral(ESYS_CONTEXT *esys_context, TPMI_ECC_CURVE curve_id,
-    TPM2B_ECC_POINT **Q, uint16_t *counter) {
+    TPM2B_ECC_POINT **Q, uint16_t *counter, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
-    TSS2_RC rval = Esys_EC_Ephemeral(esys_context, ESYS_TR_NONE, ESYS_TR_NONE,
+    tool_rc rc = tool_rc_success;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire Tss2_Sys_EC_Ephemeral_Prepare SAPI context.");
+            return rc;
+        }
+
+        TSS2_RC rval = Tss2_Sys_EC_Ephemeral_Prepare(
+        sys_context, curve_id);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_EC_Ephemeral_Prepare, rval);
+            return tool_rc_general_error;
+        }
+       
+        rc = tpm2_sapi_getcphash(sys_context, NULL, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        goto tpm2_ecephemeral_skip_esapi_call;
+    }
+    
+    
+    rval = Esys_EC_Ephemeral(esys_context, ESYS_TR_NONE, ESYS_TR_NONE,
         ESYS_TR_NONE, curve_id, Q, counter);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_EC_Ephemeral, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_ecephemeral_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_commit(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *signing_key_object, TPM2B_ECC_POINT *P1,
     TPM2B_SENSITIVE_DATA *s2, TPM2B_ECC_PARAMETER *y2, TPM2B_ECC_POINT **K,
-    TPM2B_ECC_POINT **L, TPM2B_ECC_POINT **E, uint16_t *counter) {
+    TPM2B_ECC_POINT **L, TPM2B_ECC_POINT **E, uint16_t *counter,
+    TPM2B_DIGEST *cp_hash) {
+
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    tool_rc rc = tool_rc_success;
+    if (cp_hash) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire SAPI context.");
+            return rc;
+        }
+
+        rval = Tss2_Sys_Commit_Prepare(sys_context,
+            signing_key_object->handle, P1, s2, y2);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_LoadExternal_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME *name1 = 0;
+        rc = tpm2_tr_get_name(esys_context, signing_key_object->tr_handle,
+            &name1);
+        if (rc != tool_rc_success) {
+            goto tpm2_commit_free_name1;
+        }
+
+        cp_hash->size = tpm2_alg_util_get_hash_size(TPM2_ALG_SHA256);
+        rc = tpm2_sapi_getcphash(sys_context, name1, 0, 0, TPM2_ALG_SHA256,
+            cp_hash);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+tpm2_commit_free_name1:
+        Esys_Free(name1);
+        goto tpm2_commit_skip_esapi_call;
+    }
 
     ESYS_TR signing_key_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
+    rc = tpm2_auth_util_get_shandle(esys_context,
         signing_key_object->tr_handle, signing_key_object->session,
         &signing_key_obj_session_handle);
     if (rc != tool_rc_success) {
@@ -4273,7 +5684,7 @@
         return rc;
     }
 
-    TSS2_RC rval = Esys_Commit(esys_context, signing_key_object->tr_handle,
+    rval = Esys_Commit(esys_context, signing_key_object->tr_handle,
         signing_key_obj_session_handle, ESYS_TR_NONE, ESYS_TR_NONE, P1, s2, y2,
         K, L, E, counter);
     if (rval != TSS2_RC_SUCCESS) {
@@ -4281,29 +5692,113 @@
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_commit_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_ecdhkeygen(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *ecc_public_key, TPM2B_ECC_POINT **Z,
-    TPM2B_ECC_POINT **Q) {
+    TPM2B_ECC_POINT **Q, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
-    TSS2_RC rval = Esys_ECDH_KeyGen(esys_context, ecc_public_key->tr_handle,
+    tool_rc rc = tool_rc_success;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquire SAPI context.");
+            return rc;
+        }
+
+        TPM2_HANDLE h = ecc_public_key->handle;
+        TSS2_RC rval = Tss2_Sys_ECDH_KeyGen_Prepare(
+        sys_context, h);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_LoadExternal_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME *name1 = NULL;
+        rc = tpm2_tr_get_name(esys_context, ecc_public_key->tr_handle,
+            &name1);
+        if (rc != tool_rc_success) {
+            goto tpm2_ecdhkeygen_free_name1;
+        }
+
+        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
+
+tpm2_ecdhkeygen_free_name1:
+        Esys_Free(name1);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        goto tpm2_ecdhkeygen_skip_esapi_call;
+    }
+
+
+    rval = Esys_ECDH_KeyGen(esys_context, ecc_public_key->tr_handle,
         ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, Z, Q);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_ECDH_KeyGen, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_ecdhkeygen_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_ecdhzgen(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *ecc_key_object, TPM2B_ECC_POINT **Z,
-    TPM2B_ECC_POINT *Q) {
+    TPM2B_ECC_POINT *Q, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
+
+    tool_rc rc = tool_rc_success;
+    TSS2_RC rval = TSS2_RC_SUCCESS;
+    if (cp_hash && cp_hash->size) {
+        /*
+         * Need sys_context to be able to calculate CpHash
+         */
+        TSS2_SYS_CONTEXT *sys_context = 0;
+        rc = tpm2_getsapicontext(esys_context, &sys_context);
+        if(rc != tool_rc_success) {
+            LOG_ERR("Failed to acquireTss2_Sys_ECDH_ZGen_Prepare SAPI context.");
+            return rc;
+        }
+
+        TPM2_HANDLE h = ecc_key_object->handle;
+        TSS2_RC rval = Tss2_Sys_ECDH_ZGen_Prepare(
+        sys_context, h, Q);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Tss2_Sys_LoadExternal_Prepare, rval);
+            return tool_rc_general_error;
+        }
+
+        TPM2B_NAME *name1 = NULL;
+        rc = tpm2_tr_get_name(esys_context, ecc_key_object->tr_handle,
+            &name1);
+        if (rc != tool_rc_success) {
+            goto tpm2_ecdhzgen_free_name1;
+        }
+
+        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
+            parameter_hash_algorithm, cp_hash);
 
+tpm2_ecdhzgen_free_name1:
+        Esys_Free(name1);
+
+        /*
+         * Exit here without making the ESYS call since we just need the cpHash
+         */
+        goto tpm2_ecdhzgen_skip_esapi_call;
+    }
     ESYS_TR ecc_key_obj_session_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(esys_context,
+    rc = tpm2_auth_util_get_shandle(esys_context,
         ecc_key_object->tr_handle, ecc_key_object->session,
         &ecc_key_obj_session_handle);
     if (rc != tool_rc_success) {
@@ -4311,14 +5806,15 @@
         return rc;
     }
 
-    TSS2_RC rval = Esys_ECDH_ZGen(esys_context, ecc_key_object->tr_handle,
+    rval = Esys_ECDH_ZGen(esys_context, ecc_key_object->tr_handle,
     ecc_key_obj_session_handle, ESYS_TR_NONE, ESYS_TR_NONE, Q, Z);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_ECDH_ZGen, rval);
         return tool_rc_from_tpm(rval);
     }
 
-    return tool_rc_success;
+tpm2_ecdhzgen_skip_esapi_call:
+    return rc;
 }
 
 tool_rc tpm2_zgen2phase(ESYS_CONTEXT *esys_context,

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2.h Changed

@@ -20,8 +20,11 @@
 tool_rc tpm2_tr_serialize(ESYS_CONTEXT *esys_context, ESYS_TR object,
         uint8_t **buffer, size_t *buffer_size);
 
-tool_rc tpm2_nv_readpublic(ESYS_CONTEXT *esys_context, ESYS_TR nv_index,
-        TPM2B_NV_PUBLIC **nv_public, TPM2B_NAME **nv_name);
+tool_rc tpm2_nv_readpublic(ESYS_CONTEXT *esys_context, TPMI_RH_NV_INDEX nv_index,
+    TPM2B_NAME *precalc_nvname, TPM2B_NV_PUBLIC **nv_public,
+    TPM2B_NAME **nv_name, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle1, ESYS_TR shandle2,
+    ESYS_TR shandle3);
 
 tool_rc tpm2_readpublic(ESYS_CONTEXT *esys_context, ESYS_TR object_handle,
         TPM2B_PUBLIC **out_public, TPM2B_NAME **name,
@@ -32,8 +35,10 @@
         TPMS_CAPABILITY_DATA **capability_data);
 
 tool_rc tpm2_nv_read(ESYS_CONTEXT *esys_context,
-    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index, UINT16 size,
-    UINT16 offset, TPM2B_MAX_NV_BUFFER **data, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_NAME *precalc_nvname, UINT16 size, UINT16 offset,
+    TPM2B_MAX_NV_BUFFER **data, TPM2B_DIGEST *cp_hash,  TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_context_save(ESYS_CONTEXT *esys_context, ESYS_TR save_handle,
         TPMS_CONTEXT **context);
@@ -41,11 +46,11 @@
 tool_rc tpm2_context_load(ESYS_CONTEXT *esys_context,
         const TPMS_CONTEXT *context, ESYS_TR *loaded_handle);
 
-tool_rc tpm2_flush_context(ESYS_CONTEXT *esys_context, ESYS_TR flush_handle);
+tool_rc tpm2_flush_context(ESYS_CONTEXT *esys_context, ESYS_TR flush_handle,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_start_auth_session(ESYS_CONTEXT *esys_context, ESYS_TR tpm_key,
-        ESYS_TR bind, ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
-        const TPM2B_NONCE *nonce_caller, TPM2_SE session_type,
+        ESYS_TR bind, const TPM2B_NONCE *nonce_caller, TPM2_SE session_type,
         const TPMT_SYM_DEF *symmetric, TPMI_ALG_HASH auth_hash,
         ESYS_TR *session_handle);
 
@@ -59,30 +64,34 @@
     ESYS_TR session_handle, TPM2B_NONCE **nonce_tpm);
 
 tool_rc tpm2_policy_restart(ESYS_CONTEXT *esys_context, ESYS_TR session_handle,
-        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3);
+        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_get_capability(ESYS_CONTEXT *esys_context, ESYS_TR shandle1,
         ESYS_TR shandle2, ESYS_TR shandle3, TPM2_CAP capability,
         UINT32 property, UINT32 property_count, TPMI_YES_NO *more_data,
         TPMS_CAPABILITY_DATA **capability_data);
 
-tool_rc tpm2_create_primary(ESYS_CONTEXT *esys_context, ESYS_TR primary_handle,
-        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
-        const TPM2B_SENSITIVE_CREATE *in_sensitive, const TPM2B_PUBLIC *in_public,
-        const TPM2B_DATA *outside_info, const TPML_PCR_SELECTION *creation_pcr,
-        ESYS_TR *object_handle, TPM2B_PUBLIC **out_public,
-        TPM2B_CREATION_DATA **creation_data, TPM2B_DIGEST **creation_hash,
-        TPMT_TK_CREATION **creation_ticket);
+tool_rc tpm2_create_primary(ESYS_CONTEXT *esys_context,
+    tpm2_loaded_object *auth_hierarchy_obj,
+    const TPM2B_SENSITIVE_CREATE *in_sensitive, const TPM2B_PUBLIC *in_public,
+    const TPM2B_DATA *outside_info, const TPML_PCR_SELECTION *creation_pcr,
+    ESYS_TR *object_handle, TPM2B_PUBLIC **out_public,
+    TPM2B_CREATION_DATA **creation_data, TPM2B_DIGEST **creation_hash,
+    TPMT_TK_CREATION **creation_ticket, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_pcr_read(ESYS_CONTEXT *esys_context, ESYS_TR shandle1,
         ESYS_TR shandle2, ESYS_TR shandle3,
         const TPML_PCR_SELECTION *pcr_selection_in, UINT32 *pcr_update_counter,
-        TPML_PCR_SELECTION **pcr_selection_out, TPML_DIGEST **pcr_values);
+        TPML_PCR_SELECTION **pcr_selection_out, TPML_DIGEST **pcr_values,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_policy_authorize(ESYS_CONTEXT *esys_context, ESYS_TR policy_session,
         ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
         const TPM2B_DIGEST *approved_policy, const TPM2B_NONCE *policy_ref,
-        const TPM2B_NAME *key_sign, const TPMT_TK_VERIFIED *check_ticket);
+        const TPM2B_NAME *key_sign, const TPMT_TK_VERIFIED *check_ticket,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_policy_or(ESYS_CONTEXT *esys_context, ESYS_TR policy_session,
         ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
@@ -102,7 +111,8 @@
         const TPM2B_DIGEST *pcr_digest, const TPML_PCR_SELECTION *pcrs);
 
 tool_rc tpm2_policy_password(ESYS_CONTEXT *esys_context, ESYS_TR policy_session,
-        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3);
+        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_policy_signed(ESYS_CONTEXT *esys_context,
         tpm2_loaded_object *auth_entity_obj, ESYS_TR policy_session,
@@ -116,25 +126,29 @@
     const TPM2B_NAME *authname, const TPMT_TK_AUTH *ticket);
 
 tool_rc tpm2_policy_authvalue(ESYS_CONTEXT *esys_context, ESYS_TR policy_session,
-        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3);
+        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_policy_secret(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_entity_obj, ESYS_TR policy_session,
-        INT32 expiration, TPMT_TK_AUTH **policy_ticket,
-        TPM2B_TIMEOUT **timeout, TPM2B_NONCE *nonce_tpm,
-        TPM2B_NONCE *policy_qualifier, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_entity_obj, ESYS_TR policy_session,
+    INT32 expiration, TPMT_TK_AUTH **policy_ticket, TPM2B_TIMEOUT **timeout,
+    TPM2B_NONCE *nonce_tpm, TPM2B_NONCE *policy_qualifier,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_policy_getdigest(ESYS_CONTEXT *esys_context, ESYS_TR policy_session,
-        ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
-        TPM2B_DIGEST **policy_digest);
+    ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
+    TPM2B_DIGEST **policy_digest, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_policy_command_code(ESYS_CONTEXT *esys_context,
         ESYS_TR policy_session, ESYS_TR shandle1, ESYS_TR shandle2,
-        ESYS_TR shandle3, TPM2_CC code);
+        ESYS_TR shandle3, TPM2_CC code, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_policy_locality(ESYS_CONTEXT *esys_context, ESYS_TR policy_session,
         ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
-        TPMA_LOCALITY locality);
+        TPMA_LOCALITY locality, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_policy_duplication_select(ESYS_CONTEXT *esys_context,
         ESYS_TR policy_session, ESYS_TR shandle1, ESYS_TR shandle2,
@@ -151,10 +165,10 @@
         size_t buffer_size, size_t *offset);
 
 tool_rc tpm2_evictcontrol(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj,
-        tpm2_loaded_object *to_persist_key_obj,
-        TPMI_DH_PERSISTENT persistent_handle, ESYS_TR *new_object_handle,
-        TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy_obj,
+    tpm2_loaded_object *to_persist_key_obj,
+    TPMI_DH_PERSISTENT persistent_handle, ESYS_TR *new_object_handle,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_hash(ESYS_CONTEXT *esys_context, ESYS_TR shandle1, ESYS_TR shandle2,
         ESYS_TR shandle3, const TPM2B_MAX_BUFFER *data, TPMI_ALG_HASH hash_alg,
@@ -183,90 +197,110 @@
         tpm2_loaded_object *activatehandle, tpm2_loaded_object *keyhandle,
         const TPM2B_ID_OBJECT *credential_blob,
         const TPM2B_ENCRYPTED_SECRET *secret, TPM2B_DIGEST **cert_info,
-        TPM2B_DIGEST *cp_hash);
+        TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle3);
 
 tool_rc tpm2_create(ESYS_CONTEXT *esys_context, tpm2_loaded_object *parent_obj,
         const TPM2B_SENSITIVE_CREATE *in_sensitive, const TPM2B_PUBLIC *in_public,
         const TPM2B_DATA *outside_info, const TPML_PCR_SELECTION *creation_pcr,
         TPM2B_PRIVATE **out_private, TPM2B_PUBLIC **out_public,
         TPM2B_CREATION_DATA **creation_data, TPM2B_DIGEST **creation_hash,
-        TPMT_TK_CREATION **creation_ticket, TPM2B_DIGEST *cp_hash);
+        TPMT_TK_CREATION **creation_ticket, TPM2B_DIGEST *cp_hash,
+        TPM2B_DIGEST *rp_hash, TPMI_ALG_HASH parameter_hash_algorithm,
+        ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_create_loaded(ESYS_CONTEXT *esys_context,
         tpm2_loaded_object *parent_obj,
         const TPM2B_SENSITIVE_CREATE *in_sensitive,
         const TPM2B_TEMPLATE *in_public, ESYS_TR *object_handle,
         TPM2B_PRIVATE **out_private, TPM2B_PUBLIC **out_public,
-        TPM2B_DIGEST *cp_hash);
+        TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2,
+        ESYS_TR shandle3);
 
 tool_rc tpm2_object_change_auth(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *parent_object, tpm2_loaded_object *object,
-        const TPM2B_AUTH *new_auth, TPM2B_PRIVATE **out_private,
-        TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *parent_object, tpm2_loaded_object *object,
+    const TPM2B_AUTH *new_auth, TPM2B_PRIVATE **out_private,
+    TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2,
+    ESYS_TR shandle3);
 
 tool_rc tpm2_nv_change_auth(ESYS_CONTEXT *esys_context, tpm2_loaded_object *nv,
-        const TPM2B_AUTH *new_auth, TPM2B_DIGEST *cp_hash);
+    const TPM2B_AUTH *new_auth, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2,
+    ESYS_TR shandle3);
 
 tool_rc tpm2_hierarchy_change_auth(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *hierarchy, const TPM2B_AUTH *new_auth,
-        TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *hierarchy, const TPM2B_AUTH *new_auth,
+    TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2,
+    ESYS_TR shandle3);
 
 tool_rc tpm2_certify(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *certifiedkey_obj,
-        tpm2_loaded_object *signingkey_obj, TPM2B_DATA *qualifying_data,
-        TPMT_SIG_SCHEME *scheme, TPM2B_ATTEST **certify_info,
-        TPMT_SIGNATURE **signature, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *certifiedkey_obj,
+    tpm2_loaded_object *signingkey_obj, TPM2B_DATA *qualifying_data,
+    TPMT_SIG_SCHEME *scheme, TPM2B_ATTEST **certify_info,
+    TPMT_SIGNATURE **signature, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle3);
 
 tool_rc tpm2_rsa_decrypt(ESYS_CONTEXT *esys_context, tpm2_loaded_object *keyobj,
-        const TPM2B_PUBLIC_KEY_RSA *cipher_text,
-        const TPMT_RSA_DECRYPT *in_scheme, const TPM2B_DATA *label,
-        TPM2B_PUBLIC_KEY_RSA **message, TPM2B_DIGEST *cp_hash);
+    const TPM2B_PUBLIC_KEY_RSA *cipher_text, const TPMT_RSA_DECRYPT *in_scheme,
+    const TPM2B_DATA *label, TPM2B_PUBLIC_KEY_RSA **message,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_rsa_encrypt(ESYS_CONTEXT *ectx, tpm2_loaded_object *keyobj,
         const TPM2B_PUBLIC_KEY_RSA *message, const TPMT_RSA_DECRYPT *scheme,
         const TPM2B_DATA *label, TPM2B_PUBLIC_KEY_RSA **cipher_text);
 
 tool_rc tpm2_load(ESYS_CONTEXT *esys_context, tpm2_loaded_object *parentobj,
-        const TPM2B_PRIVATE *in_private, const TPM2B_PUBLIC *in_public,
-        ESYS_TR *object_handle, TPM2B_DIGEST *cp_hash);
+    const TPM2B_PRIVATE *in_private, const TPM2B_PUBLIC *in_public,
+    ESYS_TR *object_handle, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_clear(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_clearcontrol(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy, TPMI_YES_NO disable_clear,
-        TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy, TPMI_YES_NO disable_clear,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_clockrateadjust(ESYS_CONTEXT *ectx, tpm2_loaded_object *object,
-        TPM2_CLOCK_ADJUST rate_adjust, TPM2B_DIGEST *cp_hash);
+    TPM2_CLOCK_ADJUST rate_adjust, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_dictionarylockout_reset(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_dictionarylockout_setup(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy, UINT32 max_tries,
-        UINT32 recovery_time, UINT32 lockout_recovery_time,
-        TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy, UINT32 max_tries, UINT32 recovery_time,
+    UINT32 lockout_recovery_time, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_duplicate(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *duplicable_key, tpm2_loaded_object *new_parent_handle,
-        const TPM2B_DATA *in_key, const TPMT_SYM_DEF_OBJECT *sym_alg,
-        TPM2B_DATA **out_key, TPM2B_PRIVATE **duplicate,
-        TPM2B_ENCRYPTED_SECRET **encrypted_seed, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *duplicable_key, tpm2_loaded_object *new_parent_handle,
+    const TPM2B_DATA *in_key, const TPMT_SYM_DEF_OBJECT *sym_alg,
+    TPM2B_DATA **out_key, TPM2B_PRIVATE **duplicate,
+    TPM2B_ENCRYPTED_SECRET **encrypted_seed, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_encryptdecrypt(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *encryption_key_obj, TPMI_YES_NO decrypt,
-        TPMI_ALG_SYM_MODE mode, const TPM2B_IV *iv_in,
-        const TPM2B_MAX_BUFFER *input_data, TPM2B_MAX_BUFFER **output_data,
-        TPM2B_IV **iv_out, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *encryption_key_obj, TPMI_YES_NO decrypt,
+    TPMI_ALG_SYM_MODE mode, const TPM2B_IV *iv_in,
+    const TPM2B_MAX_BUFFER *input_data, TPM2B_MAX_BUFFER **output_data,
+    TPM2B_IV **iv_out, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_hierarchycontrol(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy, TPMI_RH_ENABLES enable,
-        TPMI_YES_NO state, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy, TPMI_RH_ENABLES enable,
+    TPMI_YES_NO state, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_hmac(ESYS_CONTEXT *esys_context, tpm2_loaded_object *hmac_key_obj,
-        TPMI_ALG_HASH halg, const TPM2B_MAX_BUFFER *input_buffer,
-        TPM2B_DIGEST **out_hmac, TPM2B_DIGEST *cp_hash);
+    TPMI_ALG_HASH halg, const TPM2B_MAX_BUFFER *input_buffer,
+    TPM2B_DIGEST **out_hmac, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_hmac_start(ESYS_CONTEXT *esys_context,
         tpm2_loaded_object *hmac_key_obj, TPMI_ALG_HASH halg,
@@ -282,79 +316,103 @@
         TPMT_TK_HASHCHECK **validation);
 
 tool_rc tpm2_import(ESYS_CONTEXT *esys_context, tpm2_loaded_object *parent_obj,
-        const TPM2B_DATA *encryption_key, const TPM2B_PUBLIC *object_public,
-        const TPM2B_PRIVATE *duplicate, const TPM2B_ENCRYPTED_SECRET *in_sym_seed,
-        const TPMT_SYM_DEF_OBJECT *symmetric_alg, TPM2B_PRIVATE **out_private,
-        TPM2B_DIGEST *cp_hash);
+    const TPM2B_DATA *encryption_key, const TPM2B_PUBLIC *object_public,
+    const TPM2B_PRIVATE *duplicate, const TPM2B_ENCRYPTED_SECRET *in_sym_seed,
+    const TPMT_SYM_DEF_OBJECT *symmetric_alg, TPM2B_PRIVATE **out_private,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_nv_definespace(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, const TPM2B_AUTH *auth,
-        const TPM2B_NV_PUBLIC *public_info, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy_obj, const TPM2B_AUTH *auth,
+    const TPM2B_NV_PUBLIC *public_info, TPM2B_DIGEST *cp_hash,
+    TPM2B_DIGEST *rp_hash, TPMI_ALG_HASH parameter_hash_algorithm,
+    ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_nvextend(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        TPM2B_MAX_NV_BUFFER *data, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_MAX_NV_BUFFER *data, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, TPM2B_NAME *precalc_nvname,
+    ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_nv_increment(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_NAME *precalc_nvname, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_nvreadlock(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_NAME *precalc_nvname, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_nvglobalwritelock(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2B_DIGEST *cp_hash,
+    TPM2B_DIGEST *rp_hash, TPMI_ALG_HASH parameter_hash_algorithm,
+    ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_nvwritelock(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_NAME *precalc_nvname, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_tr_from_tpm_public(ESYS_CONTEXT *esys_context,
         TPM2_HANDLE handle, ESYS_TR *tr_handle);
 
 tool_rc tpm2_nvsetbits(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        UINT64 bits, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    UINT64 bits, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, TPM2B_NAME *precalc_nvname,
+    ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_nvundefine(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-         TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
+    TPM2B_NAME *precalc_nvname, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2, ESYS_TR shandle3);
 
-tool_rc tpm2_nvundefinespecial(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nv_index,
-        tpm2_session *policy_session,  TPM2B_DIGEST *cp_hash);
+tool_rc tpm2_nvundefinespecial(ESYS_CONTEXT *esys_context, tpm2_loaded_object
+    *auth_hierarchy_obj, TPM2_HANDLE nv_index, TPM2B_NAME *precalc_nvname,
+    tpm2_session *policy_session,  TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle3);
 
 tool_rc tpm2_nvwrite(ESYS_CONTEXT *esys_context,
-        tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nvindex,
-        const TPM2B_MAX_NV_BUFFER *data, UINT16 offset, TPM2B_DIGEST *cp_hash);
+    tpm2_loaded_object *auth_hierarchy_obj, TPM2_HANDLE nvindex,
+    TPM2B_NAME *precalc_nvname, const TPM2B_MAX_NV_BUFFER *data, UINT16 offset,
+    TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_pcr_allocate(ESYS_CONTEXT *esys_context,
         tpm2_loaded_object *auth_hierarchy_obj,
-        const TPML_PCR_SELECTION *pcr_allocation);
+        const TPML_PCR_SELECTION *pcr_allocation, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_sign(ESYS_CONTEXT *esys_context, tpm2_loaded_object *signingkey_obj,
-        TPM2B_DIGEST *digest, TPMT_SIG_SCHEME *in_scheme,
-        TPMT_TK_HASHCHECK *validation, TPMT_SIGNATURE **signature,
-        TPM2B_DIGEST *cp_hash);
+    TPM2B_DIGEST *digest, TPMT_SIG_SCHEME *in_scheme,
+    TPMT_TK_HASHCHECK *validation, TPMT_SIGNATURE **signature,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_quote(ESYS_CONTEXT *esys_context, tpm2_loaded_object *quote_obj,
-        TPMT_SIG_SCHEME *in_scheme, TPM2B_DATA *qualifying_data,
-        TPML_PCR_SELECTION *PCRselect, TPM2B_ATTEST **quoted,
-        TPMT_SIGNATURE **signature, TPM2B_DIGEST *cp_hash);
+    TPMT_SIG_SCHEME *in_scheme, TPM2B_DATA *qualifying_data,
+    TPML_PCR_SELECTION *pcr_select, TPM2B_ATTEST **quoted,
+    TPMT_SIGNATURE **signature, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_changeeps(ESYS_CONTEXT *ectx,
-    tpm2_session *platform_hierarchy_session);
+    tpm2_session *platform_hierarchy_session, TPM2B_DIGEST *cp_hash,
+    TPM2B_DIGEST *rp_hash, TPMI_ALG_HASH parameter_hash_algorithm,
+    ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_changepps(ESYS_CONTEXT *ectx,
-    tpm2_session *platform_hierarchy_session);
+    tpm2_session *platform_hierarchy_session, TPM2B_DIGEST *cp_hash,
+    TPM2B_DIGEST *rp_hash, TPMI_ALG_HASH parameter_hash_algorithm,
+    ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_unseal(ESYS_CONTEXT *esys_context, tpm2_loaded_object *sealkey_obj,
-        TPM2B_SENSITIVE_DATA **out_data, TPM2B_DIGEST *cp_hash);
+    TPM2B_SENSITIVE_DATA **out_data, TPM2B_DIGEST *cp_hash,
+    TPM2B_DIGEST *rp_hash, TPMI_ALG_HASH parameter_hash_algorithm,
+    ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_policy_authorize_nv(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *auth_entity_obj, TPM2_HANDLE nv_index,
-    ESYS_TR policy_session, TPM2B_DIGEST *cp_hash);
+    ESYS_TR policy_session, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_incrementalselftest(ESYS_CONTEXT *ectx, const TPML_ALG *to_test,
         TPML_ALG **to_do_list);
@@ -367,19 +425,26 @@
         TPM2_RC *test_result);
 
 tool_rc tpm2_loadexternal(ESYS_CONTEXT *ectx, const TPM2B_SENSITIVE *private,
-        const TPM2B_PUBLIC *public, TPMI_RH_HIERARCHY hierarchy,
-        ESYS_TR *object_handle);
+    const TPM2B_PUBLIC *public, TPMI_RH_HIERARCHY hierarchy,
+    ESYS_TR *object_handle, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
+
+tool_rc tpm2_pcr_extend(ESYS_CONTEXT *ectx, TPMI_DH_PCR pcr_index,
+    TPML_DIGEST_VALUES *digests);
 
 tool_rc tpm2_pcr_event(ESYS_CONTEXT *ectx, ESYS_TR pcr, tpm2_session *session,
-        const TPM2B_EVENT *event_data, TPML_DIGEST_VALUES **digests);
+        const TPM2B_EVENT *event_data, TPML_DIGEST_VALUES **digests,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_getrandom(ESYS_CONTEXT *ectx, UINT16 count,
         TPM2B_DIGEST **random, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
-        ESYS_TR audit_session_handle, TPMI_ALG_HASH param_hash_algorithm) ;
+        ESYS_TR session_handle_1, ESYS_TR session_handle_2,
+        ESYS_TR session_handle_3, TPMI_ALG_HASH param_hash_algorithm) ;
 
 tool_rc tpm2_startup(ESYS_CONTEXT *ectx, TPM2_SU startup_type);
 
-tool_rc tpm2_pcr_reset(ESYS_CONTEXT *ectx, ESYS_TR pcr_handle);
+tool_rc tpm2_pcr_reset(ESYS_CONTEXT *ectx, ESYS_TR pcr_handle,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_makecredential(ESYS_CONTEXT *ectx, ESYS_TR handle,
         const TPM2B_DIGEST *credential, const TPM2B_NAME *object_name,
@@ -392,22 +457,26 @@
 tool_rc tpm2_readclock(ESYS_CONTEXT *ectx, TPMS_TIME_INFO **current_time);
 
 tool_rc tpm2_setclock(ESYS_CONTEXT *ectx, tpm2_loaded_object *object,
-UINT64 new_time, TPM2B_DIGEST *cp_hash);
+    UINT64 new_time, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_shutdown(ESYS_CONTEXT *ectx, TPM2_SU shutdown_type);
 
 tool_rc tpm2_policy_nv(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *auth_entity_obj, TPM2_HANDLE nv_index,
     ESYS_TR policy_session, const TPM2B_OPERAND *operand_b, UINT16 offset,
-    TPM2_EO operation, TPM2B_DIGEST *cp_hash);
+    TPM2_EO operation, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_policy_countertimer(ESYS_CONTEXT *esys_context,
     ESYS_TR policy_session, const TPM2B_OPERAND *operand_b, UINT16 offset,
-    TPM2_EO operation);
+    TPM2_EO operation, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_policy_nv_written(ESYS_CONTEXT *esys_context,
         ESYS_TR policy_session, ESYS_TR shandle1, ESYS_TR shandle2,
-        ESYS_TR shandle3, TPMI_YES_NO written_set);
+        ESYS_TR shandle3, TPMI_YES_NO written_set, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm);
 
 TSS2_RC fix_esys_hierarchy(uint32_t in, uint32_t *out);
 
@@ -416,27 +485,28 @@
     TPM2B_DIGEST *creation_hash, TPMT_SIG_SCHEME *in_scheme,
     TPMT_TK_CREATION *creation_ticket, TPM2B_ATTEST **certify_info,
     TPMT_SIGNATURE **signature, TPM2B_DATA *policy_qualifier,
-    TPM2B_DIGEST *cp_hash);
+    TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle2, ESYS_TR shandle3);
 
 tool_rc tpm2_nvcertify(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *signingkey_obj, tpm2_loaded_object *nvindex_authobj,
-    TPM2_HANDLE nv_index, UINT16 offset, UINT16 size,
+    TPM2_HANDLE nv_index, TPM2B_NAME *precalc_nvname,
+    TPM2B_NAME *precalc_signername, UINT16 offset, UINT16 size,
     TPMT_SIG_SCHEME *in_scheme, TPM2B_ATTEST **certify_info,
     TPMT_SIGNATURE **signature, TPM2B_DATA *policy_qualifier,
-    TPM2B_DIGEST *cp_hash);
+    TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle3);
 
-tool_rc tpm2_setprimarypolicy(ESYS_CONTEXT *esys_context,
+tool_rc tpm2_setprimarypolicy(ESYS_CONTEXT *ectx,
     tpm2_loaded_object *hierarchy_object, TPM2B_DIGEST *auth_policy,
-    TPMI_ALG_HASH hash_algorithm, TPM2B_DIGEST *cp_hash);
+    TPMI_ALG_HASH hash_algorithm, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
-tool_rc tpm2_gettime(ESYS_CONTEXT *ectx,
-        tpm2_loaded_object *privacy_admin,
-        tpm2_loaded_object *signing_object,
-        const TPM2B_DATA *qualifying_data,
-        const TPMT_SIG_SCHEME *scheme,
-        TPM2B_ATTEST **time_info,
-        TPMT_SIGNATURE **signature,
-        TPM2B_DIGEST *cp_hash);
+tool_rc tpm2_gettime(ESYS_CONTEXT *ectx, tpm2_loaded_object *privacy_admin,
+    tpm2_loaded_object *signing_object, const TPM2B_DATA *qualifying_data,
+    const TPMT_SIG_SCHEME *scheme, TPM2B_ATTEST **time_info,
+    TPMT_SIGNATURE **signature, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_setcommandcodeaudit(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *auth_entity_obj, TPMI_ALG_HASH hash_algorithm,
@@ -454,23 +524,28 @@
         ESYS_TR audit_session_handle);
 
 tool_rc tpm2_geteccparameters(ESYS_CONTEXT *esys_context,
-    TPMI_ECC_CURVE curve_id, TPMS_ALGORITHM_DETAIL_ECC **parameters);
+    TPMI_ECC_CURVE curve_id, TPMS_ALGORITHM_DETAIL_ECC **parameters,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_ecephemeral(ESYS_CONTEXT *esys_context, TPMI_ECC_CURVE curve_id,
-    TPM2B_ECC_POINT **Q, uint16_t *counter);
+    TPM2B_ECC_POINT **Q, uint16_t *counter, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_commit(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *signing_key_object, TPM2B_ECC_POINT *P1,
     TPM2B_SENSITIVE_DATA *s2, TPM2B_ECC_PARAMETER *y2, TPM2B_ECC_POINT **K,
-    TPM2B_ECC_POINT **L, TPM2B_ECC_POINT **E, uint16_t *counter);
+    TPM2B_ECC_POINT **L, TPM2B_ECC_POINT **E, uint16_t *counter,
+    TPM2B_DIGEST *cp_hash);
 
 tool_rc tpm2_ecdhkeygen(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *ecc_public_key, TPM2B_ECC_POINT **Z,
-    TPM2B_ECC_POINT **Q);
+    TPM2B_ECC_POINT **Q, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_ecdhzgen(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *ecc_key_object, TPM2B_ECC_POINT **Z,
-    TPM2B_ECC_POINT *Q);
+    TPM2B_ECC_POINT *Q, TPM2B_DIGEST *cp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 tool_rc tpm2_zgen2phase(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *ecc_key_object, TPM2B_ECC_POINT *Q1,

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_alg_util.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_alg_util.c Changed

@@ -12,6 +12,8 @@
 #include "tpm2_alg_util.h"
 #include "tpm2_attr_util.h"
 #include "tpm2_errata.h"
+#include "tpm2_hash.h"
+#include "tpm2_policy.h"
 
 typedef struct alg_pair alg_pair;
 struct alg_pair {
@@ -42,13 +44,15 @@
 
     static const alg_pair algs = {
 
-        // Assymetric
+        // Asymmetric
         { .name = "rsa", .id = TPM2_ALG_RSA, .flags = tpm2_alg_util_flags_asymmetric|tpm2_alg_util_flags_base },
         { .name = "ecc", .id = TPM2_ALG_ECC, .flags = tpm2_alg_util_flags_asymmetric|tpm2_alg_util_flags_base },
 
         // Symmetric
+        { .name = "tdes", .id = TPM2_ALG_TDES, .flags = tpm2_alg_util_flags_symmetric },
         { .name = "aes", .id = TPM2_ALG_AES, .flags = tpm2_alg_util_flags_symmetric },
         { .name = "camellia", .id = TPM2_ALG_CAMELLIA, .flags = tpm2_alg_util_flags_symmetric },
+        { .name = "sm4", .id = TPM2_ALG_SM4, .flags = tpm2_alg_util_flags_symmetric },
 
         // Hash
         { .name = "sha1", .id = TPM2_ALG_SHA1, .flags = tpm2_alg_util_flags_hash },
@@ -74,17 +78,13 @@
         { .name = "ecdsa", .id = TPM2_ALG_ECDSA, .flags = tpm2_alg_util_flags_sig },
         { .name = "ecdaa", .id = TPM2_ALG_ECDAA, .flags = tpm2_alg_util_flags_sig },
         { .name = "ecschnorr", .id = TPM2_ALG_ECSCHNORR, .flags = tpm2_alg_util_flags_sig },
+        { .name = "sm2", .id = TPM2_ALG_SM2, .flags = tpm2_alg_util_flags_sig },
 
-        // Assyemtric Encryption Scheme
+        // Asymmetric Encryption Scheme
         { .name = "oaep", .id = TPM2_ALG_OAEP, .flags = tpm2_alg_util_flags_enc_scheme | tpm2_alg_util_flags_rsa_scheme },
         { .name = "rsaes", .id = TPM2_ALG_RSAES, .flags = tpm2_alg_util_flags_enc_scheme | tpm2_alg_util_flags_rsa_scheme },
         { .name = "ecdh", .id = TPM2_ALG_ECDH, .flags = tpm2_alg_util_flags_enc_scheme },
 
-
-        // XXX are these sigs?
-        { .name = "sm2", .id = TPM2_ALG_SM2, .flags = tpm2_alg_util_flags_sig },
-        { .name = "sm4", .id = TPM2_ALG_SM4, .flags = tpm2_alg_util_flags_sig },
-
         // Key derivation functions
         { .name = "kdf1_sp800_56a", .id = TPM2_ALG_KDF1_SP800_56A, .flags = tpm2_alg_util_flags_kdf },
         { .name = "kdf2", .id = TPM2_ALG_KDF2, .flags = tpm2_alg_util_flags_kdf },
@@ -116,7 +116,7 @@
     }
 }
 
-static alg_parser_rc handle_sym_common(const char *ext, TPMT_SYM_DEF_OBJECT *s) {
+static alg_parser_rc handle_sym_common(const char *ext, TPMT_SYM_DEF_OBJECT *s, bool is_parent) {
 
     if (ext == NULL || ext0 == '\0') {
         ext = "128";
@@ -135,7 +135,7 @@
     ext += 3;
 
     if (*ext == '\0') {
-        ext = "null";
+        ext = is_parent ? "cfb" : "null";
     }
 
     s->mode.sym = tpm2_alg_util_strtoalg(ext,
@@ -193,14 +193,14 @@
     bool do_scheme_hash_alg = false;
 
     if (public->publicArea.type == TPM2_ALG_ECC) {
-        if (!strncmp(scheme, "oaep", 4)) {
-            do_scheme_halg(scheme, 4, TPM2_ALG_OAEP);
-        } else if (!strncmp(scheme, "ecdsa", 5)) {
+        if (!strncmp(scheme, "ecdsa", 5)) {
             do_scheme_halg(scheme, 5, TPM2_ALG_ECDSA);
         } else if (!strncmp(scheme, "ecdh", 4)) {
             do_scheme_halg(scheme, 4, TPM2_ALG_ECDH);
         } else if (!strncmp(scheme, "ecschnorr", 9)) {
             do_scheme_halg(scheme, 9, TPM2_ALG_ECSCHNORR);
+        } else if (!strncmp(scheme, "sm2", 3)) {
+            do_scheme_halg(scheme, 3, TPM2_ALG_SM2);
         } else if (!strncmp(scheme, "ecdaa", 5)) {
             do_scheme_halg(scheme, 5, TPM2_ALG_ECDAA);
             /*
@@ -236,6 +236,8 @@
             do_scheme_halg(scheme, 6, TPM2_ALG_RSAPSS);
         } else if (!strncmp("rsassa", scheme, 6)) {
             do_scheme_halg(scheme, 6, TPM2_ALG_RSASSA);
+        } else if (!strncmp(scheme, "oaep", 4)) {
+            do_scheme_halg(scheme, 4, TPM2_ALG_OAEP);
         }
     }
 
@@ -316,14 +318,33 @@
 
     public->publicArea.type = TPM2_ALG_ECC;
 
-    size_t len = ext ? strlen(ext) : 0;
-    if (len == 0 || ext0 == '\0') {
-        ext = "256";
-    }
-
     TPMS_ECC_PARMS *e = &public->publicArea.parameters.eccDetail;
     e->kdf.scheme = TPM2_ALG_NULL;
+    e->curveID = TPM2_ECC_NONE;
 
+    /* handle default ecc curve (NIST_P256) */
+    if (ext == NULL || ext0 == '\0') {
+        e->curveID = TPM2_ECC_NIST_P256;
+        return alg_parser_rc_continue;
+    }
+
+    if (ext0 == '_') {
+        /* skip separator */
+        ext++;
+        if (!strcmp(ext, "sm2_p256") || !strcmp(ext, "sm2")) {
+            e->curveID = TPM2_ECC_SM2_P256;
+            return alg_parser_rc_continue;
+        } else if (strncmp(ext, "nist_p", 6)) {
+            return alg_parser_rc_error;
+        }
+        ext += 6;
+        if (ext0 == '\0') {
+            return alg_parser_rc_error;
+        }
+        /* fall through to NIST curves */
+    }
+
+    /* parse NIST curves */
     if (!strncmp(ext, "192", 3)) {
         e->curveID = TPM2_ECC_NIST_P192;
         ext += 3;
@@ -339,8 +360,6 @@
     } else if (!strncmp(ext, "521", 3)) {
         e->curveID = TPM2_ECC_NIST_P521;
         ext += 3;
-    } else {
-        e->curveID = TPM2_ECC_NIST_P256;
     }
 
     /* ecc extension should be consumed at this point */
@@ -357,7 +376,7 @@
     TPMT_SYM_DEF_OBJECT *s = &public->publicArea.parameters.symDetail.sym;
     s->algorithm = TPM2_ALG_AES;
 
-    return handle_sym_common(ext, s);
+    return handle_sym_common(ext, s, false);
 }
 
 static alg_parser_rc handle_camellia(const char *ext, TPM2B_PUBLIC *public) {
@@ -367,7 +386,17 @@
     TPMT_SYM_DEF_OBJECT *s = &public->publicArea.parameters.symDetail.sym;
     s->algorithm = TPM2_ALG_CAMELLIA;
 
-    return handle_sym_common(ext, s);
+    return handle_sym_common(ext, s, false);
+}
+
+static alg_parser_rc handle_sm4(const char *ext, TPM2B_PUBLIC *public) {
+
+    public->publicArea.type = TPM2_ALG_SYMCIPHER;
+
+    TPMT_SYM_DEF_OBJECT *s = &public->publicArea.parameters.symDetail.sym;
+    s->algorithm = TPM2_ALG_SM4;
+
+    return handle_sym_common(ext, s, false);
 }
 
 static alg_parser_rc handle_xor(TPM2B_PUBLIC *public) {
@@ -407,6 +436,9 @@
     } else if (!strncmp(object, "camellia", 8)) {
         object += 8;
         return handle_camellia(object, public);
+    } else if (!strncmp(object, "sm4", 3)) {
+        object += (object3 == '_') ? 4 : 3;
+        return handle_sm4(object, public);
     } else if (!strcmp(object, "hmac")) {
         return handle_hmac(public);
     } else if (!strcmp(object, "xor")) {
@@ -483,10 +515,14 @@
 
         if (!strncmp(detail, "aes", 3)) {
             s->algorithm = TPM2_ALG_AES;
-            return handle_sym_common(detail + 3, s);
+            return handle_sym_common(detail + 3, s, is_restricted);
         } else if (!strncmp(detail, "camellia", 8)) {
             s->algorithm = TPM2_ALG_CAMELLIA;
-            return handle_sym_common(detail + 8, s);
+            return handle_sym_common(detail + 8, s, is_restricted);
+        } else if (!strncmp(detail, "sm4", 3)) {
+            s->algorithm = TPM2_ALG_SM4;
+            detail += (detail3 == '_') ? 4 : 3;
+            return handle_sym_common(detail, s, is_restricted);
         } else if (!strcmp(detail, "null")) {
             s->algorithm = TPM2_ALG_NULL;
             return alg_parser_rc_done;
@@ -594,6 +630,36 @@
     return false;
 }
 
+tool_rc tpm2_alg_util_handle_rsa_ext_alg(const char *alg_spec,
+    TPM2B_PUBLIC *public) {
+
+    #define RSA_KEYBITS_STRLEN 6
+    char *ext_alg_str = calloc(1, strlen(alg_spec) + strlen("rsa") +
+        RSA_KEYBITS_STRLEN);
+    if (ext_alg_str == NULL) {
+        LOG_ERR("oom");
+        return tool_rc_general_error;
+    }
+
+    strcat(ext_alg_str, "rsa");
+    switch(public->publicArea.parameters.rsaDetail.keyBits) {
+        case 1024: strcat(ext_alg_str, "1024:");
+                   break;
+        case 2048: strcat(ext_alg_str, "2048:");
+                   break;
+        case 3072: strcat(ext_alg_str, "3072:");
+                   break;
+        case 4096: strcat(ext_alg_str, "4096:");
+                   break;
+    };
+    strcat(ext_alg_str, alg_spec);
+
+    bool result = tpm2_alg_util_handle_ext_alg(ext_alg_str, public);
+    free(ext_alg_str);
+
+    return result ? tool_rc_success : tool_rc_general_error;
+}
+
 static alg_iter_res find_match(TPM2_ALG_ID id, const char *name,
         tpm2_alg_util_flags flags, void *userdata) {
 
@@ -642,6 +708,16 @@
     return userdata.name;
 }
 
+const char *tpm2_alg_util_numtoalgstr(const char *str, tpm2_alg_util_flags flags) {
+    TPM2_ALG_ID alg_id;
+
+    if (tpm2_util_string_to_uint16(str, &alg_id)) {
+        return tpm2_alg_util_algtostr(alg_id, flags);
+    } else {
+        return str;
+    }
+}
+
 tpm2_alg_util_flags tpm2_alg_util_algtoflags(TPM2_ALG_ID id) {
 
     alg_pair userdata = { .name = NULL, .id = id, .flags =
@@ -935,20 +1011,18 @@
     return tool_rc_success;
 }
 
-tool_rc tpm2_alg_util_public_init(char *alg_details, char *name_halg, char *attrs,
-        char *auth_policy,  TPMA_OBJECT def_attrs, TPM2B_PUBLIC *public) {
+tool_rc tpm2_alg_util_public_init(const char *alg_details, const char *name_halg,
+        char *attrs, char *auth_policy,  TPMA_OBJECT def_attrs,
+        TPM2B_PUBLIC *public) {
 
     memset(public, 0, sizeof(*public));
 
     /* load a policy from a path if present */
     if (auth_policy) {
-    public->publicArea.authPolicy.size =
-                sizeof(public->publicArea.authPolicy.buffer);
-        bool res = files_load_bytes_from_path(auth_policy,
-            public->publicArea.authPolicy.buffer,
-                &public->publicArea.authPolicy.size);
-        if (!res) {
-            return tool_rc_general_error;
+        tool_rc rc = tpm2_policy_set_digest(auth_policy,
+                &public->publicArea.authPolicy);
+        if (rc != tool_rc_success) {
+            return rc;
         }
     }
 
@@ -981,6 +1055,7 @@
     TPM2B_PUBLIC tmp = *public;
     bool res = tpm2_alg_util_handle_ext_alg(alg_details, &tmp);
     if (!res) {
+        LOG_ERR("Could not handle algorithm: \"%s\"", alg_details);
         return tool_rc_unsupported;
     }
 
@@ -1038,3 +1113,128 @@
         return false;
     }
 }
+
+bool tpm2_alg_util_is_sm4_size_valid(UINT16 size_in_bytes) {
+
+    switch (size_in_bytes) {
+    case 16:
+        return true;
+    default:
+        LOG_ERR("Invalid SM4 key size, got %u bytes, expected 16",
+                size_in_bytes);
+        return false;
+    }
+}
+
+TPM2_ALG_ID tpm2_alg_util_get_name_alg(ESYS_CONTEXT *ectx, ESYS_TR handle) {
+
+    TPM2B_NAME *name = NULL;
+    TSS2_RC rc = Esys_TR_GetName(ectx, handle, &name);
+    if (rc != TSS2_RC_SUCCESS) {
+        return TPM2_ALG_ERROR;
+    }
+
+    if (name->size < 2) {
+        Esys_Free(name);
+        return TPM2_ALG_ERROR;
+    }
+
+    UINT16 *big_endian_alg = (UINT16 *)name->name;
+
+    TPM2_ALG_ID name_alg = tpm2_util_ntoh_16(*big_endian_alg);
+    Esys_Free(name);
+    return name_alg;
+}
+
+tool_rc tpm2_alg_util_sm2_compute_id_digest(ESYS_CONTEXT *ectx, ESYS_TR handle, const char *id, size_t idlen, TPM2B_DIGEST *result) {
+
+    TPMS_ALGORITHM_DETAIL_ECC *parameters = NULL;
+    TPM2B_PUBLIC *public = NULL;
+    TPM2B *id_input = NULL;
+    TPM2B_DIGEST *tmp_digest = NULL;
+
+    if (!id || !result) {
+        return tool_rc_general_error;
+    }
+
+    /* 2-byte id length in bits */
+    if (strlen(id) != idlen) {
+        LOG_ERR("invalid sm2 id!");
+        return tool_rc_general_error;
+    }
+
+    if (idlen > SM2_MAX_ID_LENGTH || idlen <= 0) {
+        LOG_ERR("invalid id length!");
+        return tool_rc_general_error;
+    }
+
+    tool_rc rc = tpm2_geteccparameters(ectx, TPM2_ECC_SM2_P256, &parameters,
+        NULL, TPM2_ALG_NULL);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Could not get ecc parameters!");
+        goto out;
+    }
+
+    rc = tpm2_readpublic(ectx, handle, &public, NULL, NULL);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Could not read public!");
+        goto out;
+    }
+
+    UINT16 key_nbytes = parameters->keySize/8;
+    if (public->publicArea.type != TPM2_ALG_ECC ||
+            public->publicArea.parameters.eccDetail.curveID != TPM2_ECC_SM2_P256 ||
+            public->publicArea.unique.ecc.x.size != key_nbytes ||
+            public->publicArea.unique.ecc.y.size != key_nbytes) {
+        LOG_ERR("invalid sm2 public key!");
+        rc = tool_rc_general_error;
+        goto out;
+    }
+
+    BYTE idbits2;
+    idbits0 = ((idlen * 8) >> 8) % 256;
+    idbits1 = (idlen * 8) % 256;
+
+    UINT16 total_size = sizeof(idbits) + idlen + 6 * key_nbytes;
+
+    id_input = (TPM2B *) calloc(1, sizeof(TPM2B) + total_size);
+    if (id_input == NULL) {
+        LOG_ERR("Could not calloc memory!");
+        rc = tool_rc_general_error;
+        goto out;
+    }
+
+    id_input->size = total_size;
+
+    UINT16 pos = 0;
+    memcpy(id_input->buffer + pos, idbits, sizeof(idbits));
+    pos += sizeof(idbits);
+    memcpy(id_input->buffer + pos, id, idlen);
+    pos += idlen;
+    memcpy(id_input->buffer + pos, parameters->a.buffer, key_nbytes);
+    pos += key_nbytes;
+    memcpy(id_input->buffer + pos, parameters->b.buffer, key_nbytes);
+    pos += key_nbytes;
+    memcpy(id_input->buffer + pos, parameters->gX.buffer, key_nbytes);
+    pos += key_nbytes;
+    memcpy(id_input->buffer + pos, parameters->gY.buffer, key_nbytes);
+    pos += key_nbytes;
+    memcpy(id_input->buffer + pos, public->publicArea.unique.ecc.x.buffer, key_nbytes);
+    pos += key_nbytes;
+    memcpy(id_input->buffer + pos, public->publicArea.unique.ecc.y.buffer, key_nbytes);
+
+    rc = tpm2_hash_compute_data(ectx, TPM2_ALG_SM3_256, TPM2_RH_OWNER,
+                        id_input->buffer, id_input->size, &tmp_digest, NULL);
+    if (rc != tool_rc_success) {
+        goto out;
+    }
+
+    *result = *tmp_digest;
+
+out:
+    free(id_input);
+    Esys_Free(public);
+    Esys_Free(tmp_digest);
+    Esys_Free(parameters);
+    return rc;
+}

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_alg_util.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_alg_util.h Changed

@@ -13,7 +13,7 @@
 enum tpm2_alg_util_flags {
     tpm2_alg_util_flags_none       = 0,
     tpm2_alg_util_flags_hash       = 1 << 0,
-    tpm2_alg_util_flags_keyedhash  = 1 << 0,
+    tpm2_alg_util_flags_keyedhash  = 1 << 1,
     tpm2_alg_util_flags_symmetric  = 1 << 2,
     tpm2_alg_util_flags_asymmetric = 1 << 3,
     tpm2_alg_util_flags_kdf        = 1 << 4,
@@ -46,6 +46,16 @@
 const char *tpm2_alg_util_algtostr(TPM2_ALG_ID id, tpm2_alg_util_flags flags);
 
 /**
+ * If the input is a numerical string then convert it to a nice-name.
+ * Otherwise return the unmodified nice-name.
+ * @param str
+ *  The numerical string to convert.
+ * @return
+ *  The nice-name.
+ */
+const char *tpm2_alg_util_numtoalgstr(const char* str, tpm2_alg_util_flags flags);
+
+/**
  * XXX DOC AND TESTME
  * @param id
  * @return
@@ -163,6 +173,18 @@
 bool tpm2_alg_util_handle_ext_alg(const char *alg_spec, TPM2B_PUBLIC *public);
 
 /**
+ * Retrieves the scheme information for an RSA key to be used in
+ * TPM2_CC_RSA_Encrypt or TPM2_CC_RSA_Decrypt
+ * @param alg_spec
+ *  Friendly specification of the RSA scheme (oaep-sha1)
+ * @param public
+ *  Public structure which will contain relevant information about
+ *  specified algorithm
+ */
+tool_rc tpm2_alg_util_handle_rsa_ext_alg(const char *alg_spec,
+    TPM2B_PUBLIC *public);
+
+/**
  *
  * @param alg_details
  * @param name_halg
@@ -173,8 +195,9 @@
  * @param public
  * @return
  */
-tool_rc tpm2_alg_util_public_init(char *alg_details, char *name_halg, char *attrs,
-        char *auth_policy,  TPMA_OBJECT def_attrs, TPM2B_PUBLIC *public);
+tool_rc tpm2_alg_util_public_init(const char *alg_details, const char *name_halg,
+        char *attrs, char *auth_policy,  TPMA_OBJECT def_attrs,
+        TPM2B_PUBLIC *public);
 
 /**
  * Returns an ECC curve as a friendly name.
@@ -194,4 +217,53 @@
  */
 bool tpm2_alg_util_is_aes_size_valid(UINT16 size_in_bytes);
 
+/**
+ * Determines if a size is a valid SM4 key size.
+ * @param size_in_bytes
+ *  The size of a potential SM4 key in bytes.
+ * @return
+ *  true if valid, false otherwise.
+ */
+bool tpm2_alg_util_is_sm4_size_valid(UINT16 size_in_bytes);
+
+/**
+ * Given an ESYS_TR handle to an object, retrieves the name algorithm
+ * without making a readpublic call.
+ *
+ * @param ectx
+ *  The ESAPI context.
+ * @param handle
+ *  The handle of the object to query.
+ * @return
+ *  The TPM2_ALG_ID name algorithm identifier or TPM2_ALG_ERROR for an error.
+ */
+TPM2_ALG_ID tpm2_alg_util_get_name_alg(ESYS_CONTEXT *ectx, ESYS_TR handle);
+
+#define SM2_MAX_ID_BITS             65535
+#define SM2_MAX_ID_LENGTH           (SM2_MAX_ID_BITS/8)
+#define SM2_DEFAULT_ID_GMT09            "1234567812345678"
+#define SM2_DEFAULT_ID              SM2_DEFAULT_ID_GMT09
+#define SM2_DEFAULT_ID_LENGTH           (sizeof(SM2_DEFAULT_ID) - 1)
+
+/**
+ * Given an ESYS_TR handle to an object, retrieves ecc sm2 parameters
+ * with making a geteccparameters call, retrieves the public key with
+ * making a readpublic call, and compute id digest.
+ *
+ * @param ectx
+ *  The ESAPI context.
+ * @param handle
+ *  The handle of the object to query.
+ * @param id
+ *  sm2 id.
+ * @param idlen
+ *  sm2 id length.
+ * @param result
+ *  sm2 id digest output.
+ * @return
+ *  tool_rc indicating status.
+ */
+tool_rc tpm2_alg_util_sm2_compute_id_digest(ESYS_CONTEXT *ectx, ESYS_TR handle,
+        const char *id, size_t idlen, TPM2B_DIGEST *result);
+
 #endif /* LIB_TPM2_ALG_UTIL_H_ */

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_auth_util.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_auth_util.c Changed

@@ -14,6 +14,8 @@
 #include "tpm2.h"
 #include "tpm2_auth_util.h"
 #include "tpm2_policy.h"
+#include "tpm2_alg_util.h"
+#include "tpm2_capability.h"
 
 #define HEX_PREFIX "hex:"
 #define HEX_PREFIX_LEN sizeof(HEX_PREFIX) - 1
@@ -46,7 +48,7 @@
     return true;
 }
 
-static bool handle_str_password(const char *password, TPM2B_AUTH *auth) {
+bool handle_str_password(const char *password, TPM2B_AUTH *auth) {
 
     /* str may or may not have the str: prefix */
     bool is_str_prefix = !strncmp(password, STR_PREFIX, STR_PREFIX_LEN);
@@ -90,6 +92,40 @@
         return tool_rc_general_error;
     }
 
+    if (ectx) {
+        uint32_t i;
+        tool_rc tmp_rc;
+        TPM2_CAP capability = TPM2_CAP_ALGS;
+        UINT32 property = 0;
+        UINT32 count = TPM2_MAX_CAP_ALGS;
+        TPMS_CAPABILITY_DATA *capability_data = NULL;
+        TPMS_ALG_PROPERTY alg_property;
+        TPMI_ALG_HASH def_hash = tpm2_session_data_get_authhash(d);
+        TPMI_ALG_HASH hash = 0;
+        UINT16 hash_size = 0;
+
+        tmp_rc = tpm2_capability_get(ectx, capability, property, count, &capability_data);
+        if (tmp_rc == tool_rc_success) {
+            for (i = 0; i < capability_data->data.algorithms.count; i++) {
+                alg_property = capability_data->data.algorithms.algPropertiesi;
+                if ((alg_property.algProperties & TPMA_ALGORITHM_HASH) &&
+                        !(alg_property.algProperties & ~(TPMA_ALGORITHM_HASH))) {
+                    if (alg_property.alg == def_hash) {
+                        break;
+                    }
+                    if (tpm2_alg_util_get_hash_size(alg_property.alg) > hash_size) {
+                        hash = alg_property.alg;
+                        hash_size = tpm2_alg_util_get_hash_size(alg_property.alg);
+                    }
+                }
+            }
+            if (hash_size > 0 && i == capability_data->data.algorithms.count) {
+                tpm2_session_set_authhash(d, hash);
+            }
+            free(capability_data);
+        }
+    }
+
     tool_rc rc = tpm2_session_open(ectx, d, session);
     if (rc != tool_rc_success) {
         return rc;
@@ -221,6 +257,40 @@
         goto out;
     }
 
+    if (ectx) {
+        uint32_t i;
+        tool_rc tmp_rc;
+        TPM2_CAP capability = TPM2_CAP_ALGS;
+        UINT32 property = 0;
+        UINT32 count = TPM2_MAX_CAP_ALGS;
+        TPMS_CAPABILITY_DATA *capability_data = NULL;
+        TPMS_ALG_PROPERTY alg_property;
+        TPMI_ALG_HASH def_hash = tpm2_session_data_get_authhash(d);
+        TPMI_ALG_HASH hash = 0;
+        UINT16 hash_size = 0;
+
+        tmp_rc = tpm2_capability_get(ectx, capability, property, count, &capability_data);
+        if (tmp_rc == tool_rc_success) {
+            for (i = 0; i < capability_data->data.algorithms.count; i++) {
+                alg_property = capability_data->data.algorithms.algPropertiesi;
+                if ((alg_property.algProperties & TPMA_ALGORITHM_HASH) &&
+                        !(alg_property.algProperties & ~(TPMA_ALGORITHM_HASH))) {
+                    if (alg_property.alg == def_hash) {
+                        break;
+                    }
+                    if (tpm2_alg_util_get_hash_size(alg_property.alg) > hash_size) {
+                        hash = alg_property.alg;
+                        hash_size = tpm2_alg_util_get_hash_size(alg_property.alg);
+                    }
+                }
+            }
+            if (hash_size > 0 && i == capability_data->data.algorithms.count) {
+                tpm2_session_set_authhash(d, hash);
+            }
+            free(capability_data);
+        }
+    }
+
     tpm2_session *s = NULL;
     tool_rc tmp_rc = tpm2_session_open(ectx, d, &s);
     if (tmp_rc != tool_rc_success) {
@@ -348,7 +418,7 @@
     if (is_session) {
 
         if (is_restricted) {
-            LOG_ERR("cannot specify password");
+            LOG_ERR("Cannot specify password type \"session:\"");
             return tool_rc_general_error;
         }
 
@@ -364,6 +434,10 @@
     /* starts with pcr: */
     bool is_pcr = !strncmp(password, PCR_PREFIX, PCR_PREFIX_LEN);
     if (is_pcr) {
+        if (is_restricted) {
+            LOG_ERR("Cannot specify password type \"pcr:\"");
+            return tool_rc_general_error;
+        }
         return handle_pcr(ectx, password, session);
     }

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_auth_util.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_auth_util.h Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_capability.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_capability.c Changed

@@ -26,10 +26,11 @@
         more_data = false; \
     }
 
-tool_rc tpm2_capability_get(ESYS_CONTEXT *ectx, TPM2_CAP capability,
-        UINT32 property, UINT32 count, TPMS_CAPABILITY_DATA **capability_data) {
+tool_rc tpm2_capability_get_ex(ESYS_CONTEXT *ectx, TPM2_CAP capability,
+        UINT32 property, UINT32 count, bool ignore_more_data,
+        TPMS_CAPABILITY_DATA **capability_data) {
 
-    TPMI_YES_NO more_data;
+    TPMI_YES_NO more_data = 0;
     UINT32 property_count = 0;
     *capability_data = NULL;
 
@@ -66,7 +67,7 @@
             /* reuse the TPM's result structure */
             *capability_data = fetched_data;
 
-            if (!more_data) {
+            if (!more_data || ignore_more_data) {
                 /* there won't be another iteration of the loop, just return the result unmodified */
                 return tool_rc_success;
             }
@@ -112,12 +113,9 @@
             APPEND_CAPABILITY_INFORMATION(eccCurves, eccCurves,,
                     TPM2_MAX_ECC_CURVES);
             break;
-        case TPM2_CAP_VENDOR_PROPERTY:
-            APPEND_CAPABILITY_INFORMATION(intelPttProperty, property,,
-                    TPM2_MAX_PTT_PROPERTIES);
-            break;
         default:
-            LOG_ERR("Unsupported capability: 0x%x\n", capability);
+            LOG_ERR("Unsupported capability with moreData True,"
+                    "try with option -i, got: 0x%x\n", capability);
             if (fetched_data != *capability_data) {
                 free(fetched_data);
             }
@@ -134,6 +132,14 @@
     return tool_rc_success;
 }
 
+tool_rc tpm2_capability_get(ESYS_CONTEXT *ectx, TPM2_CAP capability,
+        UINT32 property, UINT32 count,
+        TPMS_CAPABILITY_DATA **capability_data) {
+
+    return tpm2_capability_get_ex(ectx, capability,
+            property, count, false, capability_data);
+}
+
 tool_rc tpm2_capability_find_vacant_persistent_handle(ESYS_CONTEXT *ctx,
         bool is_platform, TPMI_DH_PERSISTENT *vacant) {

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_capability.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_capability.h Changed

@@ -2,6 +2,7 @@
 
 #ifndef LIB_TPM2_CAPABILITY_H_
 #define LIB_TPM2_CAPABILITY_H_
+#include "config.h"
 
 #include <tss2/tss2_esys.h>
 
@@ -24,6 +25,28 @@
 tool_rc tpm2_capability_get(ESYS_CONTEXT *context, TPM2_CAP capability,
         UINT32 property, UINT32 count, TPMS_CAPABILITY_DATA **capability_data);
 
+/** Same as tpm2_capability_get with some extra options
+ * Invokes GetCapability to retrieve the current value of a capability from the
+ * TPM.
+ * @param context
+ *  Enhanced system api (ESAPI) context
+ * @param capability
+ *  the capability being requested from the TPM
+ * @param property
+ *  property
+ * @param count
+ *  maximum number of values to return
+ * @param ignore_more_data
+ *  Ignore the moreData value and just do one read.
+ * @param capability_data
+ *  capability data structure to populate
+ * @return
+ *  tool_rc indicating status.
+ */
+tool_rc tpm2_capability_get_ex(ESYS_CONTEXT *ectx, TPM2_CAP capability,
+        UINT32 property, UINT32 count, bool ignore_more_data,
+        TPMS_CAPABILITY_DATA **capability_data);
+
 /**
  * Attempts to find a vacant handle in the persistent handle namespace.
  * @param ctx

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_convert.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_convert.c Changed

@@ -8,7 +8,15 @@
 
 #include <openssl/bio.h>
 #include <openssl/err.h>
+#include <openssl/evp.h>
 #include <openssl/pem.h>
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+#include <openssl/rsa.h>
+#else
+#include <openssl/core_names.h>
+#include <openssl/params.h>
+#include <openssl/param_build.h>
+#endif
 
 #include "files.h"
 #include "log.h"
@@ -19,6 +27,20 @@
 static bool tpm2_convert_pubkey_ssl(TPMT_PUBLIC *public,
         tpm2_convert_pubkey_fmt format, const char *path);
 
+tpm2_convert_pcrs_output_fmt tpm2_convert_pcrs_output_fmt_from_optarg(
+    const char *label) {
+
+    if (strcasecmp(label, "values") == 0) {
+        return pcrs_output_format_values;
+    } else if (strcasecmp(label, "serialized") == 0) {
+        return pcrs_output_format_serialized;
+    }
+
+    LOG_ERR("Invalid pcrs output format '%s' specified", label);
+
+    return pcrs_output_format_err;
+}
+
 tpm2_convert_pubkey_fmt tpm2_convert_pubkey_fmt_from_optarg(const char *label) {
     if (strcasecmp(label, "der") == 0) {
         return pubkey_format_der;
@@ -70,36 +92,49 @@
     return false;
 }
 
-static bool convert_pubkey_RSA(TPMT_PUBLIC *public,
-        tpm2_convert_pubkey_fmt format, BIO *bio) {
+EVP_PKEY *convert_pubkey_RSA(TPMT_PUBLIC *public) {
 
-    bool ret = false;
-    RSA *ssl_rsa_key = NULL;
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    RSA *rsa_key = NULL;
+#else
+    OSSL_PARAM_BLD *build = NULL;
+    OSSL_PARAM *params = NULL;
+    EVP_PKEY_CTX *ctx = NULL;
+#endif
     BIGNUM *e = NULL, *n = NULL;
+    EVP_PKEY *pkey = NULL;
 
     UINT32 exponent = (public->parameters).rsaDetail.exponent;
     if (exponent == 0) {
         exponent = 0x10001;
     }
 
-    // OpenSSL expects this in network byte order
-    exponent = tpm2_util_hton_32(exponent);
-    ssl_rsa_key = RSA_new();
-    if (!ssl_rsa_key) {
-        print_ssl_error("Failed to allocate OpenSSL RSA structure");
+    n = BN_bin2bn(public->unique.rsa.buffer, public->unique.rsa.size, NULL);
+    if (!n) {
+        print_ssl_error("Failed to convert data to SSL internal format");
         goto error;
     }
 
-    e = BN_bin2bn((void*) &exponent, sizeof(exponent), NULL);
-    n = BN_bin2bn(public->unique.rsa.buffer, public->unique.rsa.size,
-    NULL);
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    rsa_key = RSA_new();
+    if (!rsa_key) {
+        print_ssl_error("Failed to allocate OpenSSL RSA structure");
+        goto error;
+    }
 
-    if (!n || !e) {
+    e = BN_new();
+    if (!e) {
+        print_ssl_error("Failed to convert data to SSL internal format");
+        goto error;
+    }
+    int rc = BN_set_word(e, exponent);
+    if (!rc) {
         print_ssl_error("Failed to convert data to SSL internal format");
         goto error;
     }
 
-    if (!RSA_set0_key(ssl_rsa_key, n, e, NULL)) {
+    rc = RSA_set0_key(rsa_key, n, e, NULL);
+    if (!rc) {
         print_ssl_error("Failed to set RSA modulus and exponent components");
         goto error;
     }
@@ -107,171 +142,281 @@
     /* modulus and exponent components are now owned by the RSA struct */
     n = e = NULL;
 
-    int ssl_res = 0;
+    pkey = EVP_PKEY_new();
+    if (!pkey) {
+        print_ssl_error("Failed to allocate OpenSSL EVP structure");
+        goto error;
+    }
 
-    switch (format) {
-    case pubkey_format_pem:
-        ssl_res = PEM_write_bio_RSA_PUBKEY(bio, ssl_rsa_key);
-        break;
-    case pubkey_format_der:
-        ssl_res = i2d_RSA_PUBKEY_bio(bio, ssl_rsa_key);
-        break;
-    default:
-        LOG_ERR("Invalid OpenSSL target format %d encountered", format);
+    rc = EVP_PKEY_assign_RSA(pkey, rsa_key);
+    if (!rc) {
+        print_ssl_error("Failed to set OpenSSL EVP structure");
+        EVP_PKEY_free(pkey);
+        pkey = NULL;
+        goto error;
+    }
+    /* rsa key is now owner by the EVP_PKEY struct */
+    rsa_key = NULL;
+#else
+    build = OSSL_PARAM_BLD_new();
+    if (!build) {
+        print_ssl_error("Failed to allocate OpenSSL parameters");
         goto error;
     }
 
-    if (ssl_res <= 0) {
-        print_ssl_error("OpenSSL public key conversion failed");
+    int rc = OSSL_PARAM_BLD_push_BN(build, OSSL_PKEY_PARAM_RSA_N, n);
+    if (!rc) {
+        print_ssl_error("Failed to set RSA modulus");
         goto error;
     }
 
-    ret = true;
+    rc = OSSL_PARAM_BLD_push_uint32(build, OSSL_PKEY_PARAM_RSA_E, exponent);
+    if (!rc) {
+        print_ssl_error("Failed to set RSA exponent");
+        goto error;
+    }
 
-    error: if (n) {
-        BN_free(n);
+    params = OSSL_PARAM_BLD_to_param(build);
+    if (!params) {
+        print_ssl_error("Failed to build OpenSSL parameters");
+        goto error;
     }
-    if (e) {
-        BN_free(e);
+
+    ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);
+    if (!ctx) {
+        print_ssl_error("Failed to allocate RSA key context");
+        goto error;
     }
-    if (ssl_rsa_key) {
-        RSA_free(ssl_rsa_key);
+
+    rc = EVP_PKEY_fromdata_init(ctx);
+    if (rc <= 0) {
+        print_ssl_error("Failed to initialize RSA key creation");
+        goto error;
     }
 
-    return ret;
+    rc = EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_PUBLIC_KEY, params);
+    if (rc <= 0) {
+        print_ssl_error("Failed to create a RSA public key");
+        goto error;
+    }
+#endif
+error:
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    RSA_free(rsa_key);
+#else
+    EVP_PKEY_CTX_free(ctx);
+    OSSL_PARAM_free(params);
+    OSSL_PARAM_BLD_free(build);
+#endif
+    BN_free(n);
+    BN_free(e);
+    return pkey;
 }
 
-static bool convert_pubkey_ECC(TPMT_PUBLIC *public,
-        tpm2_convert_pubkey_fmt format, BIO *bio) {
+EVP_PKEY *convert_pubkey_ECC(TPMT_PUBLIC *public) {
 
     BIGNUM *x = NULL;
     BIGNUM *y = NULL;
-    EC_KEY *key = NULL;
     EC_POINT *point = NULL;
-    const EC_GROUP *group = NULL;
-
-    bool result = false;
+    EC_GROUP *group = NULL;
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    EC_KEY *ec_key = NULL;
+#else
+    OSSL_PARAM_BLD *build = NULL;
+    OSSL_PARAM *params = NULL;
+    EVP_PKEY_CTX *ctx = NULL;
+    unsigned char *puboct = NULL;
+    size_t bsize;
+#endif
+    EVP_PKEY *pkey = NULL;
 
     TPMS_ECC_PARMS *tpm_ecc = &public->parameters.eccDetail;
     TPMS_ECC_POINT *tpm_point = &public->unique.ecc;
 
+    /*
+     * Set the affine coordinates for the point
+     */
+    x = BN_bin2bn(tpm_point->x.buffer, tpm_point->x.size, NULL);
+    if (!x) {
+        print_ssl_error("Could not convert x coordinate to BN");
+        goto out;
+    }
+
+    y = BN_bin2bn(tpm_point->y.buffer, tpm_point->y.size, NULL);
+    if (!y) {
+        print_ssl_error("Could not convert y coordinate to BN");
+        goto out;
+    }
+
     int nid = tpm2_ossl_curve_to_nid(tpm_ecc->curveID);
     if (nid < 0) {
-        return false;
+        goto out;
     }
 
     /*
-     * Create an empty EC key by the NID
+     * Create a new point in the group, which is the public key.
      */
-    key = EC_KEY_new_by_curve_name(nid);
-    if (!key) {
-        print_ssl_error("Failed to create EC key from nid");
-        return false;
-    }
-
-    group = EC_KEY_get0_group(key);
+    group = EC_GROUP_new_by_curve_name(nid);
     if (!group) {
         print_ssl_error("EC key missing group");
         goto out;
     }
 
-    /*
-     * Create a new point in the group, which is the public key.
-     */
     point = EC_POINT_new(group);
 
+    int rc = EC_POINT_set_affine_coordinates_tss(group, point, x, y, NULL);
+    if (!rc) {
+        print_ssl_error("Could not set affine coordinates");
+        goto out;
+    }
+
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
     /*
-     * Set the affine coordinates for the point
+     * Create an empty EC key by the NID
      */
-    x = BN_bin2bn(tpm_point->x.buffer, tpm_point->x.size, NULL);
-    if (!x) {
-        print_ssl_error("Could not convert x coordinate to BN");
+    ec_key = EC_KEY_new_by_curve_name(nid);
+    if (!ec_key) {
+        print_ssl_error("Failed to create EC key from nid");
+        return false;
+    }
+
+    rc = EC_KEY_set_public_key(ec_key, point);
+    if (!rc) {
+        print_ssl_error("Could not set point as public key portion");
         goto out;
     }
 
-    y = BN_bin2bn(tpm_point->y.buffer, tpm_point->y.size, NULL);
-    if (!y) {
-        print_ssl_error("Could not convert y coordinate to BN");
+    if ((pkey = EVP_PKEY_new()) == NULL) {
+        print_ssl_error("Failed to allocate OpenSSL EVP structure");
         goto out;
     }
 
-    int rc = EC_POINT_set_affine_coordinates_tss(group, point, x, y, NULL);
+    rc = EVP_PKEY_assign_EC_KEY(pkey, ec_key);
     if (!rc) {
-        print_ssl_error("Could not set affine coordinates");
+        print_ssl_error("Failed to set OpenSSL EVP structure");
+        EVP_PKEY_free(pkey);
+        pkey = NULL;
+        goto out;
+    }
+    /* rsa key is now owner by the EVP_PKEY struct */
+    ec_key = NULL;
+#else
+    build = OSSL_PARAM_BLD_new();
+    if (!build) {
+        print_ssl_error("Failed to allocate OpenSSL parameters");
         goto out;
     }
 
-    rc = EC_KEY_set_public_key(key, point);
+    rc = OSSL_PARAM_BLD_push_utf8_string(build, OSSL_PKEY_PARAM_GROUP_NAME,
+                                         (char *)OBJ_nid2sn(nid), 0);
     if (!rc) {
-        print_ssl_error("Could not set point as public key portion");
+        print_ssl_error("Failed to set the EC group name");
         goto out;
     }
 
-    int ssl_res = 0;
-
-    switch (format) {
-    case pubkey_format_pem:
-        ssl_res = PEM_write_bio_EC_PUBKEY(bio, key);
-        break;
-    case pubkey_format_der:
-        ssl_res = i2d_EC_PUBKEY_bio(bio, key);
-        break;
-    default:
-        LOG_ERR("Invalid OpenSSL target format %d encountered", format);
+    bsize = EC_POINT_point2buf(group, point,
+                               POINT_CONVERSION_COMPRESSED,
+                               &puboct, NULL);
+    if (bsize == 0) {
+        print_ssl_error("Failed compress the EC public key");
         goto out;
     }
 
-    if (ssl_res <= 0) {
-        print_ssl_error("OpenSSL public key conversion failed");
+    rc = OSSL_PARAM_BLD_push_octet_string(build, OSSL_PKEY_PARAM_PUB_KEY,
+                                          puboct, bsize);
+    if (!rc) {
+        print_ssl_error("Failed set the EC public key");
         goto out;
     }
 
-    result = true;
-
-out:
-    if (x) {
-        BN_free(x);
+    params = OSSL_PARAM_BLD_to_param(build);
+    if (!params) {
+        print_ssl_error("Failed to build OpenSSL parameters");
+        goto out;
     }
-    if (y) {
-        BN_free(y);
+
+    ctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL);
+    if (!ctx) {
+        print_ssl_error("Failed to allocate EC key context");
+        goto out;
     }
-    if (point) {
-        EC_POINT_free(point);
+
+    rc = EVP_PKEY_fromdata_init(ctx);
+    if (rc <= 0) {
+        print_ssl_error("Failed to initialize EC key creation");
+        goto out;
     }
-    if (key) {
-        EC_KEY_free(key);
+
+    rc = EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_PUBLIC_KEY, params);
+    if (rc <= 0) {
+        print_ssl_error("Failed to create a EC public key");
+        goto out;
     }
+#endif
 
-    return result;
+out:
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    EC_KEY_free(ec_key);
+#else
+    EVP_PKEY_CTX_free(ctx);
+    OSSL_PARAM_free(params);
+    OSSL_PARAM_BLD_free(build);
+    OPENSSL_free(puboct);
+#endif
+    EC_POINT_free(point);
+    EC_GROUP_free(group);
+    BN_free(x);
+    BN_free(y);
+    return pkey;
 }
 
 static bool tpm2_convert_pubkey_bio(TPMT_PUBLIC *public,
         tpm2_convert_pubkey_fmt format, BIO *bio) {
 
-    bool result = false;
+    EVP_PKEY *pubkey = NULL;
+    int ssl_res = 0;
 
     switch (public->type) {
     case TPM2_ALG_RSA:
-        result = convert_pubkey_RSA(public, format, bio);
+        pubkey = convert_pubkey_RSA(public);
         break;
     case TPM2_ALG_ECC:
-        result = convert_pubkey_ECC(public, format, bio);
+        pubkey = convert_pubkey_ECC(public);
         break;
     default:
-        LOG_ERR(
-                "Unsupported key type for requested output format. Only RSA is supported.");
+        LOG_ERR("Unsupported key type for requested output format.");
     }
 
-    ERR_free_strings();
-    return result;
+    if (pubkey == NULL)
+        return false;
+
+    switch (format) {
+    case pubkey_format_pem:
+        ssl_res = PEM_write_bio_PUBKEY(bio, pubkey);
+        break;
+    case pubkey_format_der:
+        ssl_res = i2d_PUBKEY_bio(bio, pubkey);
+        break;
+    default:
+        LOG_ERR("Invalid OpenSSL target format %d encountered", format);
+    }
+
+    EVP_PKEY_free(pubkey);
+
+    if (ssl_res <= 0) {
+        print_ssl_error("OpenSSL public key conversion failed");
+        return false;
+    }
+
+    return true;
 }
 
 static bool tpm2_convert_pubkey_ssl(TPMT_PUBLIC *public,
         tpm2_convert_pubkey_fmt format, const char *path) {
 
-    BIO *bio = BIO_new_file(path, "wb");
+    BIO *bio = path ? BIO_new_file(path, "wb") : BIO_new_fp(stdout, BIO_NOCLOSE);
     if (!bio) {
-        LOG_ERR("Failed to open public key output file '%s': %s", path,
+        LOG_ERR("Failed to open public key output file '%s': %s", path ? path : "<stdin>",
                 ERR_error_string(ERR_get_error(), NULL));
         return false;
     }
@@ -393,6 +538,7 @@
                 &signature->signature.rsapss.sig.size);
         return res;
     case TPM2_ALG_ECDSA:
+    case TPM2_ALG_SM2:
         signature->signature.ecdsa.hash = halg;
         return pop_ecdsa(path, &signature->signature.ecdsa);
     default:
@@ -561,7 +707,8 @@
         memcpy(buffer, hmac_sig, *size);
         break;
     }
-    case TPM2_ALG_ECDSA: {
+    case TPM2_ALG_ECDSA:
+    case TPM2_ALG_SM2: {
         return extract_ecdsa(&signature->signature.ecdsa, size);
     }
     default:
@@ -644,3 +791,65 @@
 
     return result;
 }
+
+bool tpm2_base64_encode(BYTE *buffer, size_t buffer_length, char *base64) {
+
+    unsigned char out1024;
+    int outl;
+
+    EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new();
+    EVP_EncodeInit(ctx);
+
+    int rc = EVP_EncodeUpdate(ctx, out, &outl, buffer, buffer_length);
+    if(rc < 0) {
+        LOG_ERR("EVP_DecodeUpdate failed with %d\n", rc);
+        EVP_ENCODE_CTX_free(ctx);
+        return false;
+    }
+
+    EVP_EncodeFinal(ctx, out, &outl); // no return value
+
+    EVP_ENCODE_CTX_free(ctx);
+
+    strcpy(base64, (char*) out);
+
+    return true;
+}
+
+bool tpm2_base64_decode(char *base64, BYTE *buffer, size_t *buffer_length) {
+
+    bool is_base64_bufferlen_valid = strlen(base64) > 1024 ? false : true;
+    if (!is_base64_bufferlen_valid) {
+        return false;
+    }
+
+    unsigned char base64u1024;
+    memcpy(base64u, base64, strlen(base64));
+
+    EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new();
+    EVP_DecodeInit(ctx);
+    unsigned char out1024;
+    int outl;
+    int rc = EVP_DecodeUpdate(ctx, out, &outl, base64u, strlen(base64));
+    if(rc < 0) {
+        LOG_ERR("EVP_DecodeUpdate failed with %d\n", rc);
+        EVP_ENCODE_CTX_free(ctx);
+        return false;
+    }
+
+    *buffer_length = outl;
+
+    rc = EVP_DecodeFinal(ctx, out, &outl);
+    if(rc < 0) {
+        LOG_ERR("EVP_DecodeFinal failed with %d\n", rc);
+        EVP_ENCODE_CTX_free(ctx);
+        return false;
+    }
+
+    EVP_ENCODE_CTX_free(ctx);
+
+    *buffer_length += outl;
+    memcpy(buffer, out, *buffer_length);
+
+    return true;
+}

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_convert.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_convert.h Changed

@@ -25,6 +25,25 @@
     signature_format_err
 };
 
+typedef enum tpm2_convert_pcrs_output_fmt tpm2_convert_pcrs_output_fmt;
+enum tpm2_convert_pcrs_output_fmt {
+    pcrs_output_format_values,
+    pcrs_output_format_serialized,
+    pcrs_output_format_err
+};
+
+/**
+ * Parses the given command line PCRS file output format option string and
+ * returns the corresponding pcrs_output_fmt enum value.
+ *
+ * LOG_ERR is used to communicate errors.
+ *
+ * @return
+ *   On error pcrs_output_format_err is returned.
+ */
+tpm2_convert_pcrs_output_fmt tpm2_convert_pcrs_output_fmt_from_optarg(
+    const char *label);
+
 /**
  * Parses the given command line public key format option string and returns
  * the corresponding pubkey_format enum value.
@@ -46,6 +65,26 @@
         tpm2_convert_pubkey_fmt format, const char *path);
 
 /**
+ * Converts the given RSA public key structure into the EVP_PKEY.
+ *
+ * @param public
+ *  TPM2 public key structure structure.
+ * @return
+ *   OpenSSL key structure, or NULL on error.
+ */
+EVP_PKEY *convert_pubkey_RSA(TPMT_PUBLIC *public);
+
+/**
+ * Converts the given ECC public key structure into the EVP_PKEY.
+ *
+ * @param public
+ *  TPM2 public key structure structure.
+ * @return
+ *   OpenSSL key structure, or NULL on error.
+ */
+EVP_PKEY *convert_pubkey_ECC(TPMT_PUBLIC *public);
+
+/**
  * Parses the given command line signature format option string and returns
  * the corresponding signature_format enum value.
  *
@@ -117,4 +156,30 @@
 
 bool tpm2_public_load_pkey(const char *path, EVP_PKEY **pkey);
 
+/**
+ * Encode a binary buffer to a Base64-encoded String.
+ * @param buffer
+ *  The binary buffer.
+ * @param buffer_length:
+ *  The length of the binary buffer.
+ * @param base64
+ *  The resulting Base64-encoded String.
+ * @return
+ *  true on success, false on error.
+ */
+bool tpm2_base64_encode(BYTE *buffer, size_t buffer_length, char *base64);
+
+/**
+ * Decode a Base64-encoded String to a binary buffer.
+ * @param base64
+ *  The Base64-encoded String.
+ * @param buffer
+ *  The resulting binary buffer, valid on success.
+ * @param buffer_length:
+ *  The length of the resulting binary buffer, valid on success.
+ * @return
+ *  true on success, false on error.
+ */
+bool tpm2_base64_decode(char *base64, BYTE *buffer, size_t *buffer_length);
+
 #endif /* CONVERSION_H */

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_eventlog.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_eventlog.c Changed

@@ -1,5 +1,7 @@
 #include <inttypes.h>
 #include <stdlib.h>
+#include <string.h>
+
 #include <tss2/tss2_tpm2_types.h>
 
 #include "log.h"
@@ -117,7 +119,7 @@
             }
 
             if (event->EventSize < sizeof(*data) + data->UnicodeNameLength *
-                sizeof(char16_t) + data->VariableDataLength)
+                sizeof(UTF16_CHAR) + data->VariableDataLength)
             {
                 LOG_ERR("size is insufficient for UEFI variable data");
                 return false;
@@ -271,7 +273,8 @@
 
         /* event data callback */
         if (ctx->event2_cb != NULL) {
-            ret = ctx->event2_cb(event, eventhdr->eventType, ctx->data);
+            ret = ctx->event2_cb(event, eventhdr->eventType, ctx->data,
+                                 ctx->eventlog_version);
             if (ret != true) {
                 return false;
             }
@@ -281,6 +284,136 @@
     return true;
 }
 
+/*
+ * For event types where digest can be verified from their event payload,
+ * perform verification to ensure event payload was not tempered
+ */
+bool verify_digests(size_t eventnum, TCG_EVENT_HEADER2 const *eventhdr, TCG_EVENT2 *event) {
+
+size_t i;
+
+    TCG_DIGEST2 const *digest = eventhdr->Digests;
+    UINT32 digest_count = eventhdr->DigestCount;
+    UINT32 event_type = eventhdr->EventType;
+    switch (event_type) {
+    /* Digests of these event types are calculated directly from event->Event, thus can be verified  */
+    case EV_S_CRTM_VERSION:
+    case EV_SEPARATOR:
+    case EV_EFI_VARIABLE_DRIVER_CONFIG:
+    case EV_EFI_GPT_EVENT:
+        for (i = 0; i < digest_count; i++) {
+            TPMI_ALG_HASH alg = digest->AlgorithmId;
+            TPM2B_DIGEST calc_digest;
+
+            bool result = tpm2_openssl_hash_compute_data(alg, event->Event,
+            event->EventSize, &calc_digest);
+            if (!result) {
+                LOG_WARN("Event %zu: Cannot calculate hash value from data", eventnum - 1);
+                return false;
+            }
+
+            size_t alg_size = tpm2_alg_util_get_hash_size(alg);
+            if (memcmp(calc_digest.buffer, digest->Digest, alg_size) != 0) {
+                LOG_WARN("Event %zu's digest does not match its payload", eventnum - 1);
+                return false;
+            }
+
+            digest = (TCG_DIGEST2*)((uintptr_t)digest->Digest + alg_size);
+        }
+        break;
+
+    /* Shim, grub & sd-boot use this event type for various tasks */
+    case EV_IPL:
+        switch (eventhdr->PCRIndex) {
+        /* PCR9: used to measure loaded kernel and initramfs images which cannot
+           be verified from eventlog alone */
+        case 9:
+            return true;
+
+        /* PCR14: used to measure MokList, MokListX, and MokSBState which cannot
+           be verified from eventlog alone */
+        case 14:
+            return true;
+
+        /* PCR8: used to measure grub and kernel command line */
+	case 8:
+            /* Digest is applied on the string between "^a-zA-Z_+:? " and EOL,
+             * including or excluding the trailing NULL character */
+            for (i = 0; i < digest_count; i++) {
+                size_t j;
+
+                for (j = 0; j < event->EventSize; j++) {
+                    if (event->Eventj == ' ')
+                        break;
+                }
+
+                if (j + 1 >= event->EventSize || event->Eventevent->EventSize - 1 != '\0') {
+                    LOG_WARN("Event %zu's event data is in unexpected format", eventnum - 1);
+                    return false;
+                }
+
+                TPM2B_DIGEST calc_digest;
+                TPMI_ALG_HASH alg = digest->AlgorithmId;
+                /* First try to calculate the hash excluding the trailing \0 */
+                bool result = tpm2_openssl_hash_compute_data(alg,
+                event->Event + (j + 1), event->EventSize - (j + 2), &calc_digest);
+                if (!result) {
+                    LOG_WARN("Event %zu: Cannot calculate hash value from data", eventnum - 1);
+                    return false;
+                }
+
+                size_t alg_size = tpm2_alg_util_get_hash_size(alg);
+                if (memcmp(calc_digest.buffer, digest->Digest, alg_size) != 0) {
+                    /* Next try to calculate the hash including the trailing \0 */
+                    bool result = tpm2_openssl_hash_compute_data(alg,
+                    event->Event + (j + 1), event->EventSize - (j + 1), &calc_digest);
+                    if (!result) {
+                        LOG_WARN("Event %zu: Cannot calculate hash value from data", eventnum - 1);
+                        return false;
+                    }
+
+                    if (memcmp(calc_digest.buffer, digest->Digest, alg_size) != 0) {
+                        LOG_WARN("Event %zu's digest does not match its payload", eventnum - 1);
+                        return false;
+                    }
+                }
+                digest = (TCG_DIGEST2*)((uintptr_t)digest->Digest + alg_size);
+            }
+            break;
+
+        /* PCR12: used by measure kernel command line (sd-boot >= 251) */
+        case 12:
+            for (i = 0; i < digest_count; i++) {
+                TPM2B_DIGEST calc_digest;
+                TPMI_ALG_HASH alg = digest->AlgorithmId;
+                bool result = tpm2_openssl_hash_compute_data(alg,
+                event->Event, event->EventSize, &calc_digest);
+
+                if (!result) {
+                    LOG_WARN("Event %zu: Cannot calculate hash value from data", eventnum - 1);
+                    return false;
+                }
+
+                size_t alg_size = tpm2_alg_util_get_hash_size(alg);
+                if (memcmp(calc_digest.buffer, digest->Digest, alg_size) != 0) {
+                    LOG_WARN("Event %zu's digest does not match its payload", eventnum - 1);
+                    return false;
+                }
+                digest = (TCG_DIGEST2*)((uintptr_t)digest->Digest + alg_size);
+            }
+            break;
+
+        default:
+            LOG_WARN("Event %zu is unexectedly not extending either PCR 8, 9, 12 or 14", eventnum - 1);
+            return false;
+        }
+
+        break;
+    }
+
+    return true;
+}
+
 bool foreach_event2(tpm2_eventlog_context *ctx, TCG_EVENT_HEADER2 const *eventhdr_start, size_t size) {
 
     if (eventhdr_start == NULL) {
@@ -328,9 +461,14 @@
             return ret;
         }
 
+        /* digest verification */
+        if (ctx->data != 0) {
+            verify_digests(*(size_t*)ctx->data, eventhdr, event);
+        }
+
         /* event data callback */
         if (ctx->event2_cb != NULL) {
-            ret = ctx->event2_cb(event, eventhdr->EventType, ctx->data);
+            ret = ctx->event2_cb(event, eventhdr->EventType, ctx->data, ctx->eventlog_version);
             if (ret != true) {
                 return false;
             }
@@ -421,7 +559,11 @@
 
 bool parse_eventlog(tpm2_eventlog_context *ctx, BYTE const *eventlog, size_t size) {
 
-    if(!eventlog || (size < sizeof(TCG_EVENT))) {
+    if(!eventlog) {
+        return false;
+    }
+
+    if(size < sizeof(TCG_EVENT)) {
         return false;
     }

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_eventlog.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_eventlog.h Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_eventlog_yaml.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_eventlog_yaml.c Changed

@@ -1,3 +1,4 @@
+#include <ctype.h>
 #include <errno.h>
 #include <inttypes.h>
 #include <stdio.h>
@@ -15,6 +16,41 @@
 #include "tpm2_tool.h"
 #include "tpm2_tool_output.h"
 
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+#ifdef HAVE_EFIVAR_EFIVAR_H
+#include <efivar/efivar.h>
+#endif
+
+/* Valid variable unicode names and their length */
+#define NAME_DB "db"
+#define NAME_DB_LEN 2
+#define NAME_DBX "dbx"
+#define NAME_DBX_LEN 3
+#define NAME_BOOTORDER "BootOrder"
+#define NAME_BOOTORDER_LEN 9
+#define NAME_KEK "KEK"
+#define NAME_KEK_LEN 3
+#define NAME_MOKLISTTRUSTED "MokListTrusted"
+#define NAME_MOKLISTTRUSTED_LEN 14
+#define NAME_PK "PK"
+#define NAME_PK_LEN 2
+#define NAME_SBATLEVEL "SbatLevel"
+#define NAME_SBATLEVEL_LEN 9
+#define NAME_SECUREBOOT "SecureBoot"
+#define NAME_SHIM "Shim"
+#define NAME_SHIM_LEN 4
+#define NAME_SECUREBOOT_LEN 10
+
+static void guid_unparse_lower(EFI_GUID guid, char guid_buf37) {
+
+    snprintf(guid_buf, 37, "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
+            guid.Data1, guid.Data2, guid.Data3, guid.Data40, guid.Data41,
+            guid.Data42, guid.Data43, guid.Data44,
+            guid.Data45, guid.Data46, guid.Data47);
+}
+
 char const *eventtype_to_string (UINT32 event_type) {
 
     switch (event_type) {
@@ -74,6 +110,12 @@
         return "EV_EFI_PLATFORM_FIRMWARE_BLOB";
     case EV_EFI_HANDOFF_TABLES:
         return "EV_EFI_HANDOFF_TABLES";
+    case EV_EFI_PLATFORM_FIRMWARE_BLOB2:
+        return "EV_EFI_PLATFORM_FIRMWARE_BLOB2";
+    case EV_EFI_HANDOFF_TABLES2:
+        return "EV_EFI_HANDOFF_TABLES2";
+    case EV_EFI_VARIABLE_BOOT2:
+        return "EV_EFI_VARIABLE_BOOT2";
     case EV_EFI_VARIABLE_AUTHORITY:
         return "EV_EFI_VARIABLE_AUTHORITY";
     default:
@@ -93,9 +135,9 @@
 
     (void)size;
 
-    tpm2_tool_output("    PCRIndex: %d\n"
-                     "    EventType: %s\n"
-                     "    DigestCount: %d\n",
+    tpm2_tool_output("  PCRIndex: %d\n"
+                     "  EventType: %s\n"
+                     "  DigestCount: %d\n",
                      eventhdr->PCRIndex,
                      eventtype_to_string(eventhdr->EventType),
                      eventhdr->DigestCount);
@@ -106,54 +148,51 @@
 
     (void)size;
 
-    tpm2_tool_output("    PCRIndex: %d\n"
-                     "    EventType: %s\n",
+    tpm2_tool_output("  PCRIndex: %d\n"
+                     "  EventType: %s\n",
                      eventhdr->pcrIndex,
                      eventtype_to_string(eventhdr->eventType));
 
     return;
 }
 /* converting byte buffer to hex string requires 2x, plus 1 for '\0' */
-#define BYTES_TO_HEX_STRING_SIZE(byte_count) (byte_count * 2 + 1)
+#define BYTES_TO_HEX_STRING_SIZE(byte_count) ((byte_count) * 2 + 1)
 #define DIGEST_HEX_STRING_MAX BYTES_TO_HEX_STRING_SIZE(TPM2_MAX_DIGEST_BUFFER)
 bool yaml_digest2(TCG_DIGEST2 const *digest, size_t size) {
 
     char hexstrDIGEST_HEX_STRING_MAX = { 0, };
     bytes_to_str(digest->Digest, size, hexstr, sizeof(hexstr));
 
-    tpm2_tool_output("      - AlgorithmId: %s\n"
-                     "        Digest: \"%s\"\n",
+    tpm2_tool_output("  - AlgorithmId: %s\n"
+                     "    Digest: \"%s\"\n",
                      tpm2_alg_util_algtostr(digest->AlgorithmId, tpm2_alg_util_flags_hash),
                      hexstr);
 
     return true;
 }
-bool yaml_uefi_var_unicodename(UEFI_VARIABLE_DATA *data) {
+static char *yaml_utf16_to_str(UTF16_CHAR *data, size_t len) {
 
     int ret = 0;
-    char *mbstr = NULL, *tmp = NULL;
     mbstate_t st;
 
     memset(&st, '\0', sizeof(st));
 
-    mbstr = tmp = calloc(data->UnicodeNameLength + 1, MB_CUR_MAX);
+    char *mbstr = calloc(len + 1, MB_CUR_MAX);
+    char *tmp = mbstr;
     if (mbstr == NULL) {
         LOG_ERR("failed to allocate data: %s\n", strerror(errno));
-        return false;
+        return NULL;
     }
 
-    for(size_t i = 0; i < data->UnicodeNameLength; ++i, tmp += ret) {
-        ret = c16rtomb(tmp, data->UnicodeNamei, &st);
+    for(size_t i = 0; i < len; ++i, tmp += ret) {
+        ret = c16rtomb(tmp, datai.c, &st);
         if (ret < 0) {
             LOG_ERR("c16rtomb failed: %s", strerror(errno));
             free(mbstr);
-            return false;
+            return NULL;
         }
     }
-    tpm2_tool_output("      UnicodeName: %s\n", mbstr);
-    free(mbstr);
-
-    return true;
+    return mbstr;
 }
 #define VAR_DATA_HEX_SIZE(data) BYTES_TO_HEX_STRING_SIZE(data->VariableDataLength)
 static bool yaml_uefi_var_data(UEFI_VARIABLE_DATA *data) {
@@ -172,7 +211,7 @@
     bytes_to_str(variable_data, data->VariableDataLength, var_data,
                  VAR_DATA_HEX_SIZE(data));
 
-    tpm2_tool_output("      VariableData: \"%s\"\n", var_data);
+    tpm2_tool_output("    VariableData: \"%s\"\n", var_data);
     free(var_data);
 
     return true;
@@ -188,58 +227,557 @@
  * field string of "BIS CODE" in all caps. ...
  * - ACPI flash data prior to any modifications ... should use
  * event field string of "ACPI DATA" in all caps.
+ *
+ * Section 9.2.5 also says "...Below is the definition of the
+ * UEFI_PLATFORM_FIRMWARE_BLOB structure that the CRTM MUST put
+ * into the Event Log entry TCG_PCR_EVENT2.event1 field for
+ * event types EV_POST_CODE, EV_S_CRTM_CONTENTS, and
+ * EV_EFI_PLATFORM_FIRMWARE_BLOB."
  */
-static bool yaml_uefi_post_code(const TCG_EVENT2 * const event)
-{
-    const char * const data = (const char *) event->Event;
+
+static bool yaml_uefi_post_code(const TCG_EVENT2* const event) {
     const size_t len = event->EventSize;
 
-    tpm2_tool_output(
-        "    Event: '%.*s'\n",
-        (int) len,
-        data);
+    /* if length is 16, we treat it as EV_EFI_PLATFORM_FIRMWARE_BLOB */
+    if (len == 16) {
+        const UEFI_PLATFORM_FIRMWARE_BLOB * const blob = \
+            (const UEFI_PLATFORM_FIRMWARE_BLOB*) event->Event;
+        tpm2_tool_output("  Event:\n"
+                         "    BlobBase: 0x%" PRIx64 "\n"
+                         "    BlobLength: 0x%" PRIx64 "\n",
+                         blob->BlobBase,
+                         blob->BlobLength);
+    } else { // otherwise, we treat it as an ASCII string
+        const char* const data = (const char *) event->Event;
+        tpm2_tool_output("  Event: |-\n"
+                         "    %.*s\n", (int) len, data);
+
+    }
     return true;
 }
 /*
+ * Parses Device Path field using the efivar library if present, otherwise,
+ * print the field in raw byte format
+ */
+#ifdef HAVE_EFIVAR_EFIVAR_H
+char *yaml_devicepath(BYTE* dp, UINT64 dp_len) {
+    int ret;
+    ret = efidp_format_device_path(NULL, 0, (const_efidp)dp, dp_len);
+    if (ret < 0) {
+        LOG_ERR("failed to allocate memory: %s\n", strerror(errno));
+        return NULL;
+    }
+
+    int text_path_len;
+    char *text_path;
+    text_path_len = ret + 1;
+    text_path = (char*)malloc(text_path_len);
+    if (!text_path) {
+        LOG_ERR("failed to allocate memory: %s\n", strerror(errno));
+        return NULL;
+    }
+  
+    ret = efidp_format_device_path((unsigned char *)text_path,
+            text_path_len, (const_efidp)dp, dp_len);
+    if (ret < 0) {
+        free(text_path);
+        LOG_ERR("cannot parse device path\n");
+        return NULL;
+    }
+
+    return text_path; 
+}
+#endif
+/*
+ * The yaml_ipl description is received as raw bytes, but the
+ * data will represent a printable string. Unfortunately we
+ * are not told its encoding, and this can vary. For example,
+ * grub will use UTF8, while sd-boot will UTF16LE.
+ *
+ * We need to emit YAML with some rules:
+ *
+ *  - No leading ' ' without quoting it
+ *  - Escape non-printable ascii chars
+ *  - Double quotes if using escape sequences
+ *  - Valid UTF8 string
+ *
+ * This method will ignore the question of original data
+ * encoding and apply a few simple rules to make the data
+ * mostly YAML compliant. Where it falls down is not
+ * guaranteeing valid UTF8, if the input was not already
+ * valid UTF8. In practice this limitation shouldn't be
+ * a problem given expected measured data.
+ *
+ * Note: one consequence of this approach is that most
+ * UTF16LE data will be rendered with lots of \0 bytes
+ * escaped.
+ *
+ * For ease of output reading, the data is also split on newlines
+ */
+char **yaml_split_escape_string(UINT8 const *description, size_t size)
+{
+    char **lines = NULL, **tmp;
+    size_t nlines = 0;
+    size_t i, j, k;
+    size_t len;
+    UINT8 *nl;
+
+    i = 0;
+    do {
+        nl = memchr(description + i, '\n', size - i);
+        len = nl ? (size_t)(nl - (description + i)) : size - i;
+
+        tmp = realloc(lines, sizeof(char *) * (nlines + 2));
+        if (!tmp) {
+            LOG_ERR("failed to allocate memory for description lines: %s\n",
+                    strerror(errno));
+            goto error;
+        }
+        lines = tmp;
+        linesnlines + 1 = NULL;
+        k = 0;
+
+        /* Worst case: every byte needs escaping, plus start/end quotes, plus nul */
+        linesnlines = calloc(1, (len * 2) + 2 + 1);
+        if (!linesnlines) {
+            LOG_ERR("failed to allocate memory for escaped string: %s\n",
+                    strerror(errno));
+            goto error;
+        }
+
+        linesnlinesk++ = '"';
+        for (j = i; j < (i + len); j++) {
+            char escape = '\0';
+
+            switch (descriptionj) {
+            case '\0':
+              escape = '0';
+              break;
+            case '\a':
+              escape = 'a';
+              break;
+            case '\b':
+              escape = 'b';
+              break;
+            case '\t':
+              escape = 't';
+              break;
+            case '\v':
+              escape = 'v';
+              break;
+            case '\f':
+              escape = 'f';
+              break;
+            case '\r':
+              escape = 'r';
+              break;
+            case '\e':
+              escape = 'e';
+              break;
+            case '\'':
+              escape = '\'';
+              break;
+            case '\\':
+              escape = '\\';
+              break;
+            }
+
+            if (escape == '\0') {
+                linesnlinesk++ = descriptionj;
+            } else {
+                linesnlinesk++ = '\\';
+                linesnlinesk++ = escape;
+            }
+        }
+        linesnlinesk++ = '"';
+
+        nlines++;
+        i += len + 1;
+    } while (i < size);
+
+    return lines;
+
+ error:
+    for (i = 0; lines != NULL && linesi != NULL; i++) {
+      free(linesi);
+    }
+    free(lines);
+    return NULL;
+}
+
+/*
  * TCG PC Client FPF section 9.2.6
  * The tpm2_eventlog module validates the event structure but nothing within
  * the event data buffer so we must do that here.
  */
-static bool yaml_uefi_var(UEFI_VARIABLE_DATA *data) {
+static bool yaml_uefi_var(UEFI_VARIABLE_DATA *data, size_t size, UINT32 type,
+                          uint32_t eventlog_version) {
 
-    bool ret;
     char uuidstr37 = { 0 };
+    size_t start = 0;
 
-    uuid_unparse_lower(data->VariableName, uuidstr);
+    if (size < sizeof(*data)) {
+        LOG_ERR("EventSize is too small\n");
+        return false;
+    }
 
-    tpm2_tool_output("    Event:\n"
-                     "      VariableName: %s\n"
-                     "      UnicodeNameLength: %"PRIu64"\n"
-                     "      VariableDataLength: %" PRIu64 "\n",
+    guid_unparse_lower(data->VariableName, uuidstr);
+
+    tpm2_tool_output("  Event:\n"
+                     "    VariableName: %s\n"
+                     "    UnicodeNameLength: %"PRIu64"\n"
+                     "    VariableDataLength: %" PRIu64 "\n",
                      uuidstr, data->UnicodeNameLength,
                      data->VariableDataLength);
 
-    ret = yaml_uefi_var_unicodename(data);
+    start += sizeof(*data);
+    if (start + data->UnicodeNameLength*2 > size) {
+        LOG_ERR("EventSize is too small\n");
+        return false;
+    }
+
+    char *ret = yaml_utf16_to_str(data->UnicodeName, data->UnicodeNameLength);
     if (!ret) {
         return false;
     }
+    tpm2_tool_output("    UnicodeName: %s\n", ret);
+
+    start += data->UnicodeNameLength*2;
+    /* Try to parse as much as we can without fail-stop. Bugs in firmware, shim,
+     * grub could produce inconsistent metadata. As long as it is not preventing
+     * us from parsing the data, we try to continue while giving a warning
+     * message.
+     */
+    if (start + data->VariableDataLength > size) {
+        LOG_ERR("EventSize is inconsistent with actual data\n");
+    }
 
+    if (eventlog_version == 2) {
+        /* PK, KEK, db, and dbx are reserved variables names used to store platform
+         * keys, key exchange keys, database keys, and blacklisted database keys,
+         * respectively.
+         */
+        if (type == EV_EFI_VARIABLE_DRIVER_CONFIG) {
+            if ((strlen(ret) == NAME_PK_LEN && strncmp(ret, NAME_PK, NAME_PK_LEN) == 0) ||
+                (strlen(ret) == NAME_KEK_LEN && strncmp(ret, NAME_KEK, NAME_KEK_LEN) == 0) ||
+                (strlen(ret) == NAME_DB_LEN && strncmp(ret, NAME_DB, NAME_DB_LEN) == 0) ||
+                (strlen(ret) == NAME_DBX_LEN && strncmp(ret, NAME_DBX, NAME_DBX_LEN) == 0)) {
+
+                free(ret);
+                tpm2_tool_output("    VariableData:\n");
+                uint8_t *variable_data = (uint8_t *)&data->UnicodeName
+                    data->UnicodeNameLength;
+                /* iterate through each EFI_SIGNATURE_LIST */
+                while (start < size) {
+                    EFI_SIGNATURE_LIST *slist = (EFI_SIGNATURE_LIST *)variable_data;
+                    if (start + sizeof(*slist) > size) {
+                        LOG_ERR("EventSize is inconsistent with actual data\n");
+                        break;
+                    }
+
+                    if (slist->SignatureSize < 16) {
+                        LOG_ERR("SignatureSize is too small\n");
+                        break;
+                    }
+
+                    guid_unparse_lower(slist->SignatureType, uuidstr);
+                    tpm2_tool_output("    - SignatureType: %s\n"
+                                     "      SignatureListSize: %" PRIu32 "\n"
+                                     "      SignatureHeaderSize: %" PRIu32 "\n"
+                                     "      SignatureSize: %" PRIu32 "\n"
+                                     "      Keys:\n",
+                                     uuidstr, slist->SignatureListSize,
+                                     slist->SignatureHeaderSize,
+                                     slist->SignatureSize);
+
+                    start += (sizeof(*slist) + slist->SignatureHeaderSize);
+                    if (start + slist->SignatureSize > size) {
+                        LOG_ERR("EventSize is inconsistent with actual data\n");
+                        break;
+                    }
+
+                    int signature_size = slist->SignatureListSize -
+                        sizeof(*slist) - slist->SignatureHeaderSize;
+                    if (signature_size < 0 || signature_size % slist->SignatureSize != 0) {
+                        LOG_ERR("Malformed EFI_SIGNATURE_LIST\n");
+                        break;
+                    }
+
+                    uint8_t *signature = (uint8_t *)slist +
+                        sizeof(*slist) + slist->SignatureHeaderSize;
+                    int signatures = signature_size / slist->SignatureSize;
+                    /* iterate through each EFI_SIGNATURE on the list */
+                    int i;
+                    for (i = 0; i < signatures; i++) {
+                        EFI_SIGNATURE_DATA *s = (EFI_SIGNATURE_DATA *)signature;
+                        char *sdata = calloc (1,
+                            BYTES_TO_HEX_STRING_SIZE(slist->SignatureSize - sizeof(EFI_GUID)));
+                        if (sdata == NULL) {
+                            LOG_ERR("Failled to allocate data: %s\n", strerror(errno));
+                            return false;
+                        }
+                        bytes_to_str(s->SignatureData, slist->SignatureSize - sizeof(EFI_GUID),
+                            sdata, BYTES_TO_HEX_STRING_SIZE(slist->SignatureSize - sizeof(EFI_GUID)));
+                        guid_unparse_lower(s->SignatureOwner, uuidstr);
+                        tpm2_tool_output("      - SignatureOwner: %s\n"
+                                         "        SignatureData: %s\n",
+                                         uuidstr, sdata);
+                        free(sdata);
+
+                        signature += slist->SignatureSize;
+                        start += slist->SignatureSize;
+                        if (start > size) {
+                            LOG_ERR("Malformed EFI_SIGNATURE_DATA\n");
+                            break;
+                        }
+                    }
+                    variable_data += slist->SignatureListSize;
+                }
+                return true;
+            } else if ((strlen(ret) == NAME_SECUREBOOT_LEN && strncmp(ret, NAME_SECUREBOOT, NAME_SECUREBOOT_LEN) == 0)) {
+                free(ret);
+                tpm2_tool_output("    VariableData:\n"
+                                 "      Enabled: ");
+                if (data->VariableDataLength == 0) {
+                    tpm2_tool_output("'No'\n");
+                } else if (data->VariableDataLength > 1) {
+                    LOG_ERR("SecureBoot value length %" PRIu64 " is unexpectedly > 1\n",
+                            data->VariableDataLength);
+                    return false;
+                } else {
+                    uint8_t *variable_data = (uint8_t *)&data->UnicodeName
+                        data->UnicodeNameLength;
+                    if (*variable_data == 0) {
+                        tpm2_tool_output("'No'\n");
+                    } else {
+                        tpm2_tool_output("'Yes'\n");
+                    }
+                }
+                return true;
+            }
+        } else if (type == EV_EFI_VARIABLE_AUTHORITY) {
+            /* The MokListTrusted is boolean option, not a EFI_SIGNATURE_DATA*/
+            if ((strlen(ret) == NAME_MOKLISTTRUSTED_LEN && strncmp(ret, NAME_MOKLISTTRUSTED, NAME_MOKLISTTRUSTED_LEN) == 0)) {
+                free(ret);
+                tpm2_tool_output("    VariableData:\n"
+                                 "      Enabled: ");
+                if (data->VariableDataLength == 0) {
+                    tpm2_tool_output("'No'\n");
+                } else if (data->VariableDataLength > 1) {
+                    LOG_ERR("MokListTrusted value length %" PRIu64 " is unexpectedly > 1\n",
+                            data->VariableDataLength);
+                    return false;
+                } else {
+                    uint8_t *variable_data = (uint8_t *)&data->UnicodeName
+                        data->UnicodeNameLength;
+                    if (*variable_data == 0) {
+                        tpm2_tool_output("'No'\n");
+                    } else {
+                        tpm2_tool_output("'Yes'\n");
+                    }
+                }
+                return true;
+            } else if ((strlen(ret) == NAME_DB_LEN && strncmp(ret, NAME_DB, NAME_DB_LEN) == 0) ||
+                       (strlen(ret) == NAME_SHIM_LEN && strncmp(ret, NAME_SHIM, NAME_SHIM_LEN) == 0)) {
+                /* db and Shim will be parsed as EFI_SIGNATURE_DATA */
+                free(ret);
+                tpm2_tool_output("    VariableData:\n");
+                EFI_SIGNATURE_DATA *s= (EFI_SIGNATURE_DATA *)&data->UnicodeName
+                    data->UnicodeNameLength;
+                if (data->VariableDataLength < sizeof(EFI_SIGNATURE_DATA)) {
+                    LOG_ERR("VariableDataLength is too short for EFI_SIGNATURE_DATA");
+                    return false;
+                }
+                char *sdata = calloc (1,
+                    BYTES_TO_HEX_STRING_SIZE(data->VariableDataLength - sizeof(EFI_GUID)));
+                if (sdata == NULL) {
+                    LOG_ERR("Failled to allocate data: %s\n", strerror(errno));
+                    return false;
+                }
+                bytes_to_str(s->SignatureData, data->VariableDataLength - sizeof(EFI_GUID),
+                    sdata, BYTES_TO_HEX_STRING_SIZE(data->VariableDataLength - sizeof(EFI_GUID)));
+                guid_unparse_lower(s->SignatureOwner, uuidstr);
+                tpm2_tool_output("    - SignatureOwner: %s\n"
+                                 "      SignatureData: %s\n",
+                                uuidstr, sdata);
+                free(sdata);
+                return true;
+            } else if (strlen(ret) == NAME_SBATLEVEL_LEN && strncmp(ret, NAME_SBATLEVEL, NAME_SBATLEVEL_LEN) == 0)  {
+                free(ret);
+                tpm2_tool_output("    VariableData:\n"
+                                 "      String: |-\n");
+
+                UINT8 *description = (UINT8 *)&data->UnicodeName
+                    data->UnicodeNameLength;
+                char **lines = NULL;
+                lines = yaml_split_escape_string(description, data->VariableDataLength);
+                if (!lines) {
+                    return false;
+                }
+
+                size_t i;
+                for (i = 0; linesi != NULL; i++) {
+                    tpm2_tool_output("        %s\n", linesi);
+                    free(linesi);
+                }
+                free(lines);
+                return true;
+            }
+        } else if (type == EV_EFI_VARIABLE_BOOT || type == EV_EFI_VARIABLE_BOOT2) {
+            if ((strlen(ret) == NAME_BOOTORDER_LEN && strncmp(ret, NAME_BOOTORDER, NAME_BOOTORDER_LEN) == 0)) {
+                free(ret);
+                tpm2_tool_output("    VariableData:\n");
+                
+                if (data->VariableDataLength % 2 != 0) {
+                    LOG_ERR("BootOrder value length %" PRIu64 " is not divisible by 2\n",
+                            data->VariableDataLength);
+                    return false;
+                }
+
+                uint8_t *variable_data = (uint8_t *)&data->UnicodeName
+                    data->UnicodeNameLength;
+                for (uint64_t i = 0; i < data->VariableDataLength / 2; i++) {
+                    tpm2_tool_output("    - Boot%04x\n", *((uint16_t*)variable_data + i));
+                }
+                return true;
+            }
+
+            /* Test for regex "^Boot0-9a-fA-F\\{4\\}$" */
+            if (strlen(ret) == 8 && strncmp(ret, "Boot", 4) == 0 &&
+                isxdigit((int)ret4) && isxdigit((int)ret5) &&
+                isxdigit((int)ret6) && isxdigit((int)ret7)) {
+
+                free(ret);
+                tpm2_tool_output("    VariableData:\n"
+                                 "      Enabled: ");
+                EFI_LOAD_OPTION *loadopt = (EFI_LOAD_OPTION*)&data->UnicodeName
+                    data->UnicodeNameLength;
+
+                if (loadopt->Attributes & 1) {
+                    tpm2_tool_output("'Yes'\n");
+                } else {
+                    tpm2_tool_output("'No'\n");
+                }
+
+                tpm2_tool_output("      FilePathListLength: %" PRIu16 "\n",
+                    loadopt->FilePathListLength);
+
+                tpm2_tool_output("      Description: \"");
+                int i;
+                for (i = 0; (wchar_t)loadopt->Descriptioni != 0; i++) {
+                    char16_t c = (char16_t)loadopt->Descriptioni;
+                    tpm2_tool_output("%lc", c);
+                }
+                tpm2_tool_output("\"\n");
+
+                uint8_t *devpath = (uint8_t*)&loadopt->Description++i;
+                size_t devpath_len =  (data->VariableDataLength -
+                    sizeof(EFI_LOAD_OPTION) - sizeof(UINT16) * i) * 2 + 1;
+
+                char *buf = calloc(1, devpath_len);
+                if (!buf) {
+                    LOG_ERR("failed to allocate memory: %s\n", strerror(errno));
+                    return false;
+                }
+
+#ifdef HAVE_EFIVAR_EFIVAR_H
+                char *dp = yaml_devicepath(devpath, devpath_len);
+                if (dp) {
+                    tpm2_tool_output("      DevicePath: '%s'\n", dp);
+                    free(dp);
+                } else {
+                    /* fallback to printing the raw bytes if devicepath cannot be parsed */
+                    bytes_to_str(devpath, data->VariableDataLength -
+                        sizeof(EFI_LOAD_OPTION) - sizeof(UINT16) * i, buf, devpath_len);
+                    tpm2_tool_output("      DevicePath: '%s'\n", buf);
+                }
+#else
+                bytes_to_str(devpath, data->VariableDataLength -
+                    sizeof(EFI_LOAD_OPTION) - sizeof(UINT16) * i, buf, devpath_len);
+                tpm2_tool_output("      DevicePath: '%s'\n", buf);
+#endif
+                free(buf);
+                return true;
+            }
+        }
+        /* Other event types will be printed as a hex string */
+    }
+
+    free(ret);
     return yaml_uefi_var_data(data);
 }
 /* TCG PC Client FPF section 9.2.5 */
 bool yaml_uefi_platfwblob(UEFI_PLATFORM_FIRMWARE_BLOB *data) {
 
-    tpm2_tool_output("    Event:\n"
-                     "      BlobBase: 0x%" PRIx64 "\n"
-                     "      BlobLength: 0x%" PRIx64 "\n",
+    tpm2_tool_output("  Event:\n"
+                     "    BlobBase: 0x%" PRIx64 "\n"
+                     "    BlobLength: 0x%" PRIx64 "\n",
                      data->BlobBase,
                      data->BlobLength);
     return true;
 }
+
+/* TCG PC Client PFP (02 dec 2020) section 10.2.5 */
+bool yaml_uefi_platfwblob2(UEFI_PLATFORM_FIRMWARE_BLOB2 *data) {
+  UINT8 blobdescsize = data->BlobDescriptionSize;
+  UEFI_PLATFORM_FIRMWARE_BLOB * data2 = (UEFI_PLATFORM_FIRMWARE_BLOB *)((UINT8 *)data + sizeof(data->BlobDescriptionSize) + blobdescsize);
+
+  char * eventdesc = (char *)calloc (1, 2*blobdescsize+1);
+  if (!eventdesc) {
+    LOG_ERR("failed to allocate memory: %s\n", strerror(errno));
+    return false;
+  }
+
+  bytes_to_str (data->BlobDescription, blobdescsize, eventdesc, 2*blobdescsize);
+
+  tpm2_tool_output("  Event:\n"
+                   "    BlobDescriptionSize: %d\n"
+                   "    BlobDescription: \"%.*s\"\n"
+                   "    BlobBase: 0x%" PRIx64 "\n"
+                   "    BlobLength: 0x%" PRIx64 "\n",
+                   blobdescsize,
+                   2*blobdescsize,
+                   eventdesc,
+                   data2->BlobBase,
+                   data2->BlobLength);
+
+  free(eventdesc);
+  return true;
+}
+
+
+
 /* TCG PC Client PFP section 9.4.4 */
 bool yaml_uefi_action(UINT8 const *action, size_t size) {
 
-    tpm2_tool_output("    Event: '%.*s'\n", (int) size, action);
+    tpm2_tool_output("  Event: |-\n"
+                     "    %.*s\n", (int) size, action);
+
+    return true;
+}
+
+/*
+ * TCG PC Client PFP section 9.4.1
+ * This event type is extensively used by the Shim and Grub on a wide varities
+ * of Linux distributions to measure grub and kernel command line parameters and
+ * the loading of grub, kernel, and initrd images.
+ */
+bool yaml_ipl(UINT8 const *description, size_t size) {
+    char **lines = NULL;
+    size_t i;
+    tpm2_tool_output("  Event:\n"
+                     "    String: |-\n");
+
+    lines = yaml_split_escape_string(description, size);
+    if (!lines) {
+        return false;
+    }
+
+    for (i = 0; linesi != NULL; i++) {
+        tpm2_tool_output("      %s\n", linesi);
+        free(linesi);
+    }
+    free(lines);
 
     return true;
 }
@@ -247,32 +785,148 @@
 bool yaml_uefi_image_load(UEFI_IMAGE_LOAD_EVENT *data, size_t size) {
 
     size_t devpath_len = (size - sizeof(*data)) * 2 + 1;
-    char *buf = calloc (1, devpath_len);
+    char *buf = calloc(1, devpath_len);
     if (!buf) {
         LOG_ERR("failed to allocate memory: %s\n", strerror(errno));
         return false;
     }
 
-    tpm2_tool_output("    Event:\n"
-                     "      ImageLocationInMemory: 0x%" PRIx64 "\n"
-                     "      ImageLengthInMemory: %" PRIu64 "\n"
-                     "      ImageLinkTimeAddress: 0x%" PRIx64 "\n"
-                     "      LengthOfDevicePath: %" PRIu64 "\n",
+    tpm2_tool_output("  Event:\n"
+                     "    ImageLocationInMemory: 0x%" PRIx64 "\n"
+                     "    ImageLengthInMemory: %" PRIu64 "\n"
+                     "    ImageLinkTimeAddress: 0x%" PRIx64 "\n"
+                     "    LengthOfDevicePath: %" PRIu64 "\n",
                      data->ImageLocationInMemory, data->ImageLengthInMemory,
                      data->ImageLinkTimeAddress, data->LengthOfDevicePath);
 
+#ifdef HAVE_EFIVAR_EFIVAR_H
+    char *dp = yaml_devicepath(data->DevicePath, data->LengthOfDevicePath); 
+    if (dp) {
+        tpm2_tool_output("    DevicePath: '%s'\n", dp);
+        free(dp);
+    } else {
+        /* fallback to printing the raw bytes if devicepath cannot be parsed */
+        bytes_to_str(data->DevicePath, size - sizeof(*data), buf, devpath_len);
+        tpm2_tool_output("    DevicePath: '%s'\n", buf);
+    }
+#else
     bytes_to_str(data->DevicePath, size - sizeof(*data), buf, devpath_len);
-    tpm2_tool_output("      DevicePath: \"%s\"\n", buf);
+    tpm2_tool_output("    DevicePath: '%s'\n", buf);
+#endif
 
     free(buf);
     return true;
 }
 #define EVENT_BUF_MAX BYTES_TO_HEX_STRING_SIZE(1024)
-bool yaml_event2data(TCG_EVENT2 const *event, UINT32 type) {
+/* TCG PC Client PFP section 9.2.6 */
+bool yaml_gpt(UEFI_GPT_DATA *data, size_t size, uint32_t eventlog_version) {
+
+    if (size < sizeof(*data)) {
+        LOG_ERR("EventSize(%zu) is too small\n", size);
+        return false;
+    }
+
+    if (eventlog_version == 2) {
+        UEFI_PARTITION_TABLE_HEADER *header = &data->UEFIPartitionHeader;
+        char guid37 = { 0 };
+
+        guid_unparse_lower(header->DiskGUID, guid);
+
+        tpm2_tool_output("  Event:\n"
+                         "    Header:\n"
+                         "      Signature: \"%.*s\"\n"
+                         "      Revision: 0x%" PRIx32 "\n"
+                         "      HeaderSize: %" PRIu32 "\n"
+                         "      HeaderCRC32: 0x%" PRIx32 "\n"
+                         "      MyLBA: 0x%" PRIx64 "\n"
+                         "      AlternateLBA: 0x%" PRIx64 "\n"
+                         "      FirstUsableLBA: 0x%" PRIx64 "\n"
+                         "      LastUsableLBA: 0x%" PRIx64 "\n"
+                         "      DiskGUID: %s\n"
+                         "      PartitionEntryLBA: 0x%" PRIx64 "\n"
+                         "      NumberOfPartitionEntry: %" PRIu32 "\n"
+                         "      SizeOfPartitionEntry: %" PRIu32 "\n"
+                         "      PartitionEntryArrayCRC32: 0x%" PRIx32 "\n"
+                         "    NumberOfPartitions: %" PRIu64 "\n"
+                         "    Partitions:\n",
+                         8, (char*)&header->Signature, /* 8-char ASCII string */
+                         header->Revision,
+                         header->HeaderSize,
+                         header->HeaderCRC32,
+                         header->MyLBA,
+                         header->AlternateLBA,
+                         header->FirstUsableLBA,
+                         header->LastUsableLBA,
+                         guid,
+                         header->PartitionEntryLBA,
+                         header->NumberOfPartitionEntries,
+                         header->SizeOfPartitionEntry,
+                         header->PartitionEntryArrayCRC32,
+                         data->NumberOfPartitions);
+
+        size -= (sizeof(data->UEFIPartitionHeader) + sizeof(data->NumberOfPartitions));
+
+        UINT64 i;
+        for (i = 0; i < data->NumberOfPartitions; i++) {
+            UEFI_PARTITION_ENTRY *partition = &data->Partitionsi;
+            if (size < sizeof(*partition)) {
+                LOG_ERR("Cannot parse GPT partition entry: insufficient data (%zu)\n", size);
+                return false;
+            }
+
+            guid_unparse_lower(partition->PartitionTypeGUID, guid);
+            tpm2_tool_output("    - PartitionTypeGUID: %s\n", guid);
+            guid_unparse_lower(partition->UniquePartitionGUID, guid);
+            size_t len = sizeof(partition->PartitionName) / sizeof(UTF16_CHAR);
+            char *part_name = yaml_utf16_to_str(partition->PartitionName, len);
+            tpm2_tool_output("      UniquePartitionGUID: %s\n"
+                             "      StartingLBA: 0x%" PRIx64 "\n"
+                             "      EndingLBA: 0x%" PRIx64 "\n"
+                             "      Attributes: 0x%" PRIx64 "\n"
+                             "      PartitionName: \"%s\"\n",
+                             guid,
+                             partition->StartingLBA,
+                             partition->EndingLBA,
+                             partition->Attributes,
+                             part_name);
+            free(part_name);
+            size -= sizeof(*partition);
+        }
+
+        if (size != 0) {
+            LOG_ERR("EventSize is inconsistent with actual data\n");
+            return false;
+        }
+    } else {
+        char hexstrEVENT_BUF_MAX = { 0, };
+        bytes_to_str((UINT8*)data, size, hexstr, sizeof(hexstr));
+        tpm2_tool_output("  Event: \"%s\"\n", hexstr);
+    }
+    return true;
+}
+
+/* TCG PC Client PFP section 9.2.6 */
+bool yaml_no_action(EV_NO_ACTION_STRUCT *data, size_t size, uint32_t eventlog_version) {
+    if (eventlog_version == 2) {
+        if (size > sizeof(STARTUP_LOCALITY_SIGNATURE) &&
+            memcmp(data->Signature, STARTUP_LOCALITY_SIGNATURE, sizeof(STARTUP_LOCALITY_SIGNATURE)) == 0) {
+            tpm2_tool_output("  Event:\n"
+                             "    StartupLocality: %u\n",
+                             data->Cases.StartupLocality);
+            return true;
+        }
+    }
+    char hexstrEVENT_BUF_MAX = { 0, };
+    bytes_to_str((UINT8*)data, size, hexstr, sizeof(hexstr));
+    tpm2_tool_output("  Event: \"%s\"\n", hexstr);
+    return true;
+}
+
+bool yaml_event2data(TCG_EVENT2 const *event, UINT32 type, uint32_t eventlog_version) {
 
     char hexstrEVENT_BUF_MAX = { 0, };
 
-    tpm2_tool_output("    EventSize: %" PRIu32 "\n", event->EventSize);
+    tpm2_tool_output("  EventSize: %" PRIu32 "\n", event->EventSize);
 
     if (event->EventSize == 0) {
         return true;
@@ -281,32 +935,43 @@
     switch (type) {
     case EV_EFI_VARIABLE_DRIVER_CONFIG:
     case EV_EFI_VARIABLE_BOOT:
+    case EV_EFI_VARIABLE_BOOT2:
     case EV_EFI_VARIABLE_AUTHORITY:
-        return yaml_uefi_var((UEFI_VARIABLE_DATA*)event->Event);
+        return yaml_uefi_var((UEFI_VARIABLE_DATA*)event->Event,
+                                event->EventSize, type, eventlog_version);
     case EV_POST_CODE:
         return yaml_uefi_post_code(event);
     case EV_S_CRTM_CONTENTS:
     case EV_EFI_PLATFORM_FIRMWARE_BLOB:
         return yaml_uefi_platfwblob((UEFI_PLATFORM_FIRMWARE_BLOB*)event->Event);
+    case EV_EFI_PLATFORM_FIRMWARE_BLOB2:
+        return yaml_uefi_platfwblob2((UEFI_PLATFORM_FIRMWARE_BLOB2*)event->Event);
     case EV_EFI_ACTION:
         return yaml_uefi_action(event->Event, event->EventSize);
+    case EV_IPL:
+        return yaml_ipl(event->Event, event->EventSize);
     case EV_EFI_BOOT_SERVICES_APPLICATION:
     case EV_EFI_BOOT_SERVICES_DRIVER:
     case EV_EFI_RUNTIME_SERVICES_DRIVER:
         return yaml_uefi_image_load((UEFI_IMAGE_LOAD_EVENT*)event->Event,
                                     event->EventSize);
+    case EV_EFI_GPT_EVENT:
+        return yaml_gpt((UEFI_GPT_DATA*)event->Event,
+                        event->EventSize, eventlog_version);
+    case EV_NO_ACTION:
+        return yaml_no_action((EV_NO_ACTION_STRUCT*)event->Event, event->EventSize, eventlog_version);
     default:
         bytes_to_str(event->Event, event->EventSize, hexstr, sizeof(hexstr));
-        tpm2_tool_output("    Event: \"%s\"\n", hexstr);
+        tpm2_tool_output("  Event: \"%s\"\n", hexstr);
         return true;
     }
 }
 bool yaml_event2data_callback(TCG_EVENT2 const *event, UINT32 type,
-                              void *data) {
+                              void *data, uint32_t eventlog_version) {
 
     (void)data;
 
-    return yaml_event2data(event, type);
+    return yaml_event2data(event, type, eventlog_version);
 }
 bool yaml_digest2_callback(TCG_DIGEST2 const *digest, size_t size,
                             void *data_in) {
@@ -325,11 +990,11 @@
         return false;
     }
 
-    tpm2_tool_output("  - EventNum: %zu\n", (*count)++);
+    tpm2_tool_output("- EventNum: %zu\n", (*count)++);
 
     yaml_event2hdr(eventhdr, size);
 
-    tpm2_tool_output("    Digests:\n");
+    tpm2_tool_output("  Digests:\n");
 
     return true;
 }
@@ -343,10 +1008,10 @@
     char hexstrBYTES_TO_HEX_STRING_SIZE(sizeof(eventhdr->digest)) = { 0, };
     bytes_to_str(eventhdr->digest, sizeof(eventhdr->digest), hexstr, sizeof(hexstr));
 
-    tpm2_tool_output("    DigestCount: 1\n"
-                     "    Digests:\n"
-                     "      - AlgorithmId: %s\n"
-                     "        Digest: \"%s\"\n",
+    tpm2_tool_output("  DigestCount: 1\n"
+                     "  Digests:\n"
+                     "  - AlgorithmId: %s\n"
+                     "    Digest: \"%s\"\n",
                      tpm2_alg_util_algtostr(TPM2_ALG_SHA1, tpm2_alg_util_flags_hash),
                      hexstr);
     return true;
@@ -357,11 +1022,11 @@
     char digest_hex2*sizeof(event->digest) + 1 = {};
     bytes_to_str(event->digest, sizeof(event->digest), digest_hex, sizeof(digest_hex));
 
-    tpm2_tool_output("  - EventNum: %zu\n"
-                     "    PCRIndex: %" PRIu32 "\n"
-                     "    EventType: %s\n"
-                     "    Digest: \"%s\"\n"
-                     "    EventSize: %" PRIu32 "\n",
+    tpm2_tool_output("- EventNum: %zu\n"
+                     "  PCRIndex: %" PRIu32 "\n"
+                     "  EventType: %s\n"
+                     "  Digest: \"%s\"\n"
+                     "  EventSize: %" PRIu32 "\n",
                      (*count)++, event->pcrIndex,
                      eventtype_to_string(event->eventType), digest_hex,
                      event->eventDataSize);
@@ -373,15 +1038,15 @@
     char sig_strsizeof(specid->Signature) + 1 = { '\0', };
     memcpy(sig_str, specid->Signature, sizeof(specid->Signature));
 
-    tpm2_tool_output("    SpecID:\n"
-                     "      - Signature: %s\n"
-                     "        platformClass: %" PRIu32 "\n"
-                     "        specVersionMinor: %" PRIu8 "\n"
-                     "        specVersionMajor: %" PRIu8 "\n"
-                     "        specErrata: %" PRIu8 "\n"
-                     "        uintnSize: %" PRIu8 "\n"
-                     "        numberOfAlgorithms: %" PRIu32 "\n"
-                     "        Algorithms:\n",
+    tpm2_tool_output("  SpecID:\n"
+                     "  - Signature: %s\n"
+                     "    platformClass: %" PRIu32 "\n"
+                     "    specVersionMinor: %" PRIu8 "\n"
+                     "    specVersionMajor: %" PRIu8 "\n"
+                     "    specErrata: %" PRIu8 "\n"
+                     "    uintnSize: %" PRIu8 "\n"
+                     "    numberOfAlgorithms: %" PRIu32 "\n"
+                     "    Algorithms:\n",
                      sig_str,
                      specid->platformClass, specid->specVersionMinor,
                      specid->specVersionMajor, specid->specErrata,
@@ -392,9 +1057,9 @@
 void yaml_specid_algs(TCG_SPECID_ALG const *alg, size_t count) {
 
     for (size_t i = 0; i < count; ++i, ++alg) {
-        tpm2_tool_output("          - Algorithm%zu:\n"
-                         "            algorithmId: %s\n"
-                         "            digestSize: %" PRIu16 "\n",
+        tpm2_tool_output("    - Algorithm%zu:\n"
+                         "      algorithmId: %s\n"
+                         "      digestSize: %" PRIu16 "\n",
                          i,
                          tpm2_alg_util_algtostr(alg->algorithmId,
                                                 tpm2_alg_util_flags_hash),
@@ -405,7 +1070,7 @@
 
     char *vendinfo_str;
 
-    tpm2_tool_output("        vendorInfoSize: %" PRIu8 "\n", vendor->vendorInfoSize);
+    tpm2_tool_output("    vendorInfoSize: %" PRIu8 "\n", vendor->vendorInfoSize);
     if (vendor->vendorInfoSize == 0) {
         return true;
     }
@@ -417,7 +1082,7 @@
     }
     bytes_to_str(vendor->vendorInfo, vendor->vendorInfoSize, vendinfo_str,
                  vendor->vendorInfoSize * 2 + 1);
-    tpm2_tool_output("        vendorInfo: \"%s\"\n", vendinfo_str);
+    tpm2_tool_output("    vendorInfo: \"%s\"\n", vendinfo_str);
     free(vendinfo_str);
     return true;
 }
@@ -500,7 +1165,13 @@
     }
 }
 
-bool yaml_eventlog(UINT8 const *eventlog, size_t size) {
+bool yaml_eventlog(UINT8 const *eventlog, size_t size, uint32_t eventlog_version) {
+
+    if (eventlog_version < MIN_EVLOG_YAML_VERSION || 
+        eventlog_version > MAX_EVLOG_YAML_VERSION) {
+        LOG_ERR("Unexpected YAML version number: %u\n", eventlog_version);
+        return false;
+    }
 
     size_t count = 0;
     tpm2_eventlog_context ctx = {
@@ -510,9 +1181,11 @@
         .log_eventhdr_cb = yaml_sha1_log_eventhdr_callback,
         .digest2_cb = yaml_digest2_callback,
         .event2_cb = yaml_event2data_callback,
+        .eventlog_version = eventlog_version,
     };
 
     tpm2_tool_output("---\n");
+    tpm2_tool_output("version: %u\n", eventlog_version);
     tpm2_tool_output("events:\n");
     bool rc = parse_eventlog(&ctx, eventlog, size);
     if (!rc) {

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_eventlog_yaml.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_eventlog_yaml.h Changed

@@ -8,16 +8,19 @@
 #include "efi_event.h"
 #include "tpm2_eventlog.h"
 
+#define MIN_EVLOG_YAML_VERSION 1
+#define MAX_EVLOG_YAML_VERSION 2
+
 char const *eventtype_to_string (UINT32 event_type);
 void yaml_event2hdr(TCG_EVENT_HEADER2 const *event_hdr, size_t size);
 bool yaml_digest2(TCG_DIGEST2 const *digest, size_t size);
-bool yaml_uefi_var_unicodename(UEFI_VARIABLE_DATA *data);
-bool yaml_event2data(TCG_EVENT2 const *event, UINT32 type);
+bool yaml_event2data(TCG_EVENT2 const *event, UINT32 type, uint32_t eventlog_version);
 bool yaml_digest2_callback(TCG_DIGEST2 const *digest, size_t size, void *data);
 bool yaml_event2hdr_callback(TCG_EVENT_HEADER2 const *event_hdr, size_t size,
                              void *data);
-bool yaml_event2data_callback(TCG_EVENT2 const *event, UINT32 type, void *data);
+bool yaml_event2data_callback(TCG_EVENT2 const *event, UINT32 type, void *data,
+                              uint32_t eventlog_version);
 
-bool yaml_eventlog(UINT8 const *eventlog, size_t size);
+bool yaml_eventlog(UINT8 const *eventlog, size_t size, uint32_t eventlog_version);
 
 #endif

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_hash.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_hash.c Changed

@@ -134,3 +134,130 @@
     return tpm2_hash_common(ectx, halg, hierarchy, input, NULL, 0, result,
         validation);
 }
+
+static tool_rc tpm2_sm2_compute_msg_digest(ESYS_CONTEXT *ectx,
+    TPMI_ALG_HASH halg, TPMI_RH_HIERARCHY hierarchy, FILE *infilep,
+    BYTE *inbuffer, UINT16 inbuffer_len, TPM2B_DIGEST *z_digest,
+    TPM2B_DIGEST **result, TPMT_TK_HASHCHECK **validation) {
+
+    /*  if we're using infilep, get file size */
+    bool use_left = true;
+    unsigned long left = inbuffer_len;
+    if (!!infilep) {
+        /* Suppress error reporting with NULL path */
+        use_left = files_get_file_size(infilep, &left, NULL);
+    }
+
+    TPM2B_MAX_BUFFER buffer = {0};
+    if (z_digest->size <= BUFFER_SIZE(typeof(*z_digest), buffer)) {
+        buffer.size = z_digest->size;
+        memcpy(buffer.buffer, z_digest->buffer, z_digest->size);
+    } else {
+        return tool_rc_general_error;
+    }
+
+    /*
+     * length is either unknown because the FILE * is a fifo, or it's too
+     * big to do in a single hash call. Based on the size figure out the
+     * chunks to loop over, if possible. This way we can call Complete with
+     * data.
+     */
+    TPMI_DH_OBJECT sequence_handle;
+    TPM2B_AUTH null_auth = TPM2B_EMPTY_INIT;
+    tool_rc rc = tpm2_hash_sequence_start(ectx, &null_auth, halg, &sequence_handle);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    rc = tpm2_sequence_update(ectx, sequence_handle, &buffer);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+    /* If we know the file size, we decrement the amount read and terminate
+     * the loop when 1 block is left, else we go till feof.
+     */
+    bool done = false;
+    if (use_left && left <= TPM2_MAX_DIGEST_BUFFER) {
+        done = true;
+    } else {
+        done = false;
+    }
+
+    size_t bytes_read;
+    while (!done) {
+        /*  if we're using infilep, read the file. Otherwise, directly
+         copy into our local buffer. */
+        buffer.size = BUFFER_SIZE(typeof(buffer), buffer);
+        if (!!infilep) {
+            bytes_read = fread(buffer.buffer, 1, buffer.size, infilep);
+            if (ferror(infilep)) {
+                LOG_ERR("Error reading from input file");
+                return tool_rc_general_error;
+            } else {
+                buffer.size = bytes_read;
+            }
+        } else {
+            memcpy(buffer.buffer, inbuffer, buffer.size);
+            inbuffer = inbuffer + buffer.size;
+        }
+
+        rc = tpm2_sequence_update(ectx, sequence_handle, &buffer);
+        if (rc != tool_rc_success) {
+            return rc;
+        }
+
+        if (use_left) {
+            left -= buffer.size;
+            if (left <= TPM2_MAX_DIGEST_BUFFER) {
+                done = true;
+                continue;
+            }
+        } else if (!!infilep && feof(infilep)) {
+            done = true;
+        }
+    } /* end file read/hash update loop */
+
+    /*  if there is data left, get the last bit of data from the file or
+     buffer or set the size to zero */
+    if (use_left) {
+        buffer.size = left;
+        if (!!infilep) {
+            bool res = files_read_bytes(infilep, buffer.buffer, buffer.size);
+            if (!res) {
+                LOG_ERR("Error reading from input file.");
+                return tool_rc_general_error;
+            }
+        } else {
+            memcpy(buffer.buffer, inbuffer, buffer.size);
+        }
+    } else {
+        buffer.size = 0;
+    }
+
+    return tpm2_sequence_complete(ectx, sequence_handle,
+            &buffer, hierarchy, result, validation);
+}
+
+tool_rc tpm2_sm2_compute_msg_digest_data(ESYS_CONTEXT *ectx, TPMI_ALG_HASH halg,
+        TPMI_RH_HIERARCHY hierarchy, BYTE *buffer, UINT16 length,
+        TPM2B_DIGEST *z, TPM2B_DIGEST **result, TPMT_TK_HASHCHECK **validation) {
+
+    if (!buffer || !z) {
+        return tool_rc_general_error;
+    }
+
+    return tpm2_sm2_compute_msg_digest(ectx, halg, hierarchy, NULL, buffer, length,
+            z, result, validation);
+}
+
+tool_rc tpm2_sm2_compute_msg_digest_file(ESYS_CONTEXT *ectx, TPMI_ALG_HASH halg,
+        TPMI_RH_HIERARCHY hierarchy, FILE *input, TPM2B_DIGEST *z,
+        TPM2B_DIGEST **result, TPMT_TK_HASHCHECK **validation) {
+
+    if (!input || !z) {
+        return tool_rc_general_error;
+    }
+
+    return tpm2_sm2_compute_msg_digest(ectx, halg, hierarchy, input, NULL, 0, z,
+            result, validation);
+}

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_hash.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_hash.h Changed

@@ -53,4 +53,53 @@
         TPMI_RH_HIERARCHY hierarchy, FILE *input, TPM2B_DIGEST **result,
         TPMT_TK_HASHCHECK **validation);
 
+/**
+ * Hashes a BYTE array via the tpm.
+ * @param context
+ *  The esapi context.
+ * @param hash_alg
+ *  The hashing algorithm to use.
+ * @param hierarchy
+ *  The hierarchy.
+ * @param buffer
+ *  The data to hash.
+ * @param length
+ *  The length of the data.
+ * @param input
+ *  The sm2 id digest.
+ * @param result
+ *  The digest result.
+ * @param validation
+ *  The validation ticket. Note that some hierarchies don't produce a
+ *  validation ticket and thus size will be 0.
+ * @return
+ *  A tool_rc indicating status.
+ */
+tool_rc tpm2_sm2_compute_msg_digest_data(ESYS_CONTEXT *ectx, TPMI_ALG_HASH halg,
+        TPMI_RH_HIERARCHY hierarchy, BYTE *buffer, UINT16 length,
+        TPM2B_DIGEST *z, TPM2B_DIGEST **result, TPMT_TK_HASHCHECK **validation);
+
+/**
+ * Hashes a FILE * object via the tpm.
+ * @param context
+ *  The esapi context.
+ * @param hash_alg
+ *  The hashing algorithm to use.
+ * @param hierarchy
+ *  The hierarchy.
+ * @param input
+ *  The FILE object to hash.
+ * @param input
+ *  The sm2 id digest.
+ * @param result
+ *  The digest result.
+ * @param validation
+ *  The validation ticket. Note that some hierarchies don't produce a
+ *  validation ticket and thus size will be 0.
+ * @return
+ *  A tool_rc indicating status.
+ */
+tool_rc tpm2_sm2_compute_msg_digest_file(ESYS_CONTEXT *ectx, TPMI_ALG_HASH halg,
+        TPMI_RH_HIERARCHY hierarchy, FILE *input, TPM2B_DIGEST *z,
+        TPM2B_DIGEST **result, TPMT_TK_HASHCHECK **validation);
 #endif /* SRC_TPM_HASH_H_ */

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_hierarchy.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_hierarchy.c Changed

@@ -11,66 +11,6 @@
 #include "tpm2_alg_util.h"
 #include "tpm2_hierarchy.h"
 
-tool_rc tpm2_hierarchy_create_primary(ESYS_CONTEXT *ectx, tpm2_session *sess,
-        tpm2_hierarchy_pdata *objdata, TPM2B_DIGEST *cp_hash) {
-
-    ESYS_TR hierarchy;
-
-    hierarchy = tpm2_tpmi_hierarchy_to_esys_tr(objdata->in.hierarchy);
-
-    ESYS_TR shandle1 = ESYS_TR_NONE;
-    tool_rc rc = tpm2_auth_util_get_shandle(ectx, hierarchy, sess, &shandle1);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Couldn't get shandle for hierarchy");
-        return rc;
-    }
-
-    if (cp_hash) {
-        /*
-         * Need sys_context to be able to calculate CpHash
-         */
-        TSS2_SYS_CONTEXT *sys_context = NULL;
-        rc = tpm2_getsapicontext(ectx, &sys_context);
-        if(rc != tool_rc_success) {
-            LOG_ERR("Failed to acquire SAPI context.");
-            return rc;
-        }
-
-        TSS2_RC rval = Tss2_Sys_CreatePrimary_Prepare(sys_context,
-        objdata->in.hierarchy, &objdata->in.sensitive, &objdata->in.public,
-        &objdata->in.outside_info, &objdata->in.creation_pcr);
-        if (rval != TPM2_RC_SUCCESS) {
-            LOG_PERR(Tss2_Sys_CreatePrimary_Prepare, rval);
-            return tool_rc_general_error;
-        }
-
-        TPM2B_NAME *name1 = NULL;
-        rc = tpm2_tr_get_name(ectx, hierarchy, &name1);
-        if (rc != tool_rc_success) {
-            goto tpm2_create_free_name1;
-        }
-
-        cp_hash->size = tpm2_alg_util_get_hash_size(
-            tpm2_session_get_authhash(sess));
-        rc = tpm2_sapi_getcphash(sys_context, name1, NULL, NULL,
-            tpm2_session_get_authhash(sess), cp_hash);
-
-        /*
-         * Exit here without making the ESYS call since we just need the cpHash
-         */
-tpm2_create_free_name1:
-        Esys_Free(name1);
-        return rc;
-    }
-
-    return tpm2_create_primary(ectx, hierarchy, shandle1, ESYS_TR_NONE,
-            ESYS_TR_NONE, &objdata->in.sensitive, &objdata->in.public,
-            &objdata->in.outside_info, &objdata->in.creation_pcr,
-            &objdata->out.handle, &objdata->out.public,
-            &objdata->out.creation.data, &objdata->out.hash,
-            &objdata->out.creation.ticket);
-}
-
 void tpm2_hierarchy_pdata_free(tpm2_hierarchy_pdata *objdata) {
 
     free(objdata->out.creation.data);

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_hierarchy.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_hierarchy.h Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_identity_util.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_identity_util.c Changed

@@ -10,6 +10,7 @@
 
 #include "log.h"
 #include "tpm2_alg_util.h"
+#include "tpm2_convert.h"
 #include "tpm2_identity_util.h"
 #include "tpm2_kdfa.h"
 #include "tpm2_kdfe.h"
@@ -17,73 +18,6 @@
 
 // Identity-related functionality that the TPM normally does, but using OpenSSL
 
-#if defined(LIBRESSL_VERSION_NUMBER)
-static int RSA_padding_add_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,
-        const unsigned char *from, int flen, const unsigned char *param, int plen,
-        const EVP_MD *md, const EVP_MD *mgf1md) {
-
-    int ret = 0;
-    int i, emlen = tlen - 1;
-    unsigned char *db, *seed;
-    unsigned char *dbmask, seedmaskEVP_MAX_MD_SIZE;
-    int mdlen;
-
-    if (md == NULL)
-    md = EVP_sha1();
-    if (mgf1md == NULL)
-    mgf1md = md;
-
-    mdlen = EVP_MD_size(md);
-
-    if (flen > emlen - 2 * mdlen - 1) {
-        RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP,
-                RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
-        return 0;
-    }
-
-    if (emlen < 2 * mdlen + 1) {
-        RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP,
-                RSA_R_KEY_SIZE_TOO_SMALL);
-        return 0;
-    }
-
-    to0 = 0;
-    seed = to + 1;
-    db = to + mdlen + 1;
-
-    if (!EVP_Digest((void *)param, plen, db, NULL, md, NULL))
-    return 0;
-    memset(db + mdlen, 0, emlen - flen - 2 * mdlen - 1);
-    dbemlen - flen - mdlen - 1 = 0x01;
-    memcpy(db + emlen - flen - mdlen, from, (unsigned int)flen);
-    if (RAND_bytes(seed, mdlen) <= 0)
-    return 0;
-
-    dbmask = OPENSSL_malloc(emlen - mdlen);
-    if (dbmask == NULL) {
-        RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);
-        return 0;
-    }
-
-    if (PKCS1_MGF1(dbmask, emlen - mdlen, seed, mdlen, mgf1md) < 0)
-    goto err;
-    for (i = 0; i < emlen - mdlen; i++)
-    dbi ^= dbmaski;
-
-    if (PKCS1_MGF1(seedmask, mdlen, db, emlen - mdlen, mgf1md) < 0)
-    goto err;
-    for (i = 0; i < mdlen; i++)
-    seedi ^= seedmaski;
-
-    ret = 1;
-
-err:
-    OPENSSL_free(dbmask);
-
-    return ret;
-}
-#endif
-
 static TPM2_KEY_BITS get_pub_asym_key_bits(TPM2B_PUBLIC *public) {
 
     TPMU_PUBLIC_PARMS *p = &public->publicArea.parameters;
@@ -99,22 +33,16 @@
 }
 
 static bool share_secret_with_tpm2_rsa_public_key(TPM2B_DIGEST *protection_seed,
-        TPM2B_PUBLIC *parent_pub, unsigned char *label, int label_len,
+        TPM2B_PUBLIC *parent_pub, const unsigned char *label, int label_len,
         TPM2B_ENCRYPTED_SECRET *encrypted_protection_seed) {
     bool rval = false;
-    RSA *rsa = NULL;
-
-    // Public modulus (RSA-only!)
-    TPMI_RSA_KEY_BITS mod_size_bits =
-            parent_pub->publicArea.parameters.rsaDetail.keyBits;
-    UINT16 mod_size = mod_size_bits / 8;
-    TPM2B *pub_key_val = (TPM2B *) &parent_pub->publicArea.unique.rsa;
-    unsigned char *pub_modulus = malloc(mod_size);
-    if (pub_modulus == NULL) {
-        LOG_ERR("Failed to allocate memory to store public key's modulus.");
+    EVP_PKEY_CTX *ctx = NULL;
+
+    EVP_PKEY *pkey = convert_pubkey_RSA(&parent_pub->publicArea);
+    if (pkey == NULL) {
+        LOG_ERR("Failed to retrieve public key");
         return false;
     }
-    memcpy(pub_modulus, pub_key_val->buffer, mod_size);
 
     TPMI_ALG_HASH parent_name_alg = parent_pub->publicArea.nameAlg;
 
@@ -122,70 +50,66 @@
      * RSA Secret Sharing uses a randomly generated seed (Part 1, B.10.3).
      */
     protection_seed->size = tpm2_alg_util_get_hash_size(parent_name_alg);
-    int return_code = RAND_bytes(protection_seed->buffer, protection_seed->size);
-    if (return_code != 1) {
+    int rc = RAND_bytes(protection_seed->buffer, protection_seed->size);
+    if (rc != 1) {
         LOG_ERR("Failed to get random bytes");
         goto error;
     }
 
     /*
-     * This is the biggest buffer value, so it should always be sufficient.
+     * The seed value will be OAEP encrypted with a given L parameter.
      */
-    unsigned char encodedTPM2_MAX_DIGEST_BUFFER;
-    return_code = RSA_padding_add_PKCS1_OAEP_mgf1(encoded, mod_size,
-            protection_seed->buffer, protection_seed->size, label, label_len,
-            tpm2_openssl_halg_from_tpmhalg(parent_name_alg), NULL);
-    if (return_code != 1) {
-        LOG_ERR("Failed RSA_padding_add_PKCS1_OAEP_mgf1\n");
-        goto error;
-    }
-    BIGNUM* bne = BN_new();
-    if (!bne) {
-        LOG_ERR("BN_new for bne failed\n");
+    ctx = EVP_PKEY_CTX_new(pkey, NULL);
+    if (!ctx) {
+        LOG_ERR("Failed EVP_PKEY_CTX_new");
         goto error;
     }
-    return_code = BN_set_word(bne, RSA_F4);
-    if (return_code != 1) {
-        LOG_ERR("BN_set_word failed\n");
-        BN_free(bne);
+
+    rc = EVP_PKEY_encrypt_init(ctx);
+    if (rc <= 0) {
+        LOG_ERR("Failed EVP_PKEY_encrypt_init");
         goto error;
     }
-    rsa = RSA_new();
-    if (!rsa) {
-        LOG_ERR("RSA_new failed\n");
-        BN_free(bne);
+
+    rc = EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_OAEP_PADDING);
+    if (rc <= 0) {
+        LOG_ERR("Failed EVP_PKEY_CTX_set_rsa_padding");
         goto error;
     }
-    return_code = RSA_generate_key_ex(rsa, mod_size_bits, bne, NULL);
-    BN_free(bne);
-    if (return_code != 1) {
-        LOG_ERR("RSA_generate_key_ex failed\n");
+
+    rc = EVP_PKEY_CTX_set_rsa_oaep_md(ctx,
+            tpm2_openssl_md_from_tpmhalg(parent_name_alg));
+    if (rc <= 0) {
+        LOG_ERR("Failed EVP_PKEY_CTX_set_rsa_oaep_md");
         goto error;
     }
-    BIGNUM *n = BN_bin2bn(pub_modulus, mod_size, NULL);
-    if (n == NULL) {
-        LOG_ERR("BN_bin2bn failed\n");
+
+    // the library will take ownership of the label
+    char *newlabel = strdup((const char *)label);
+    if (newlabel == NULL) {
+        LOG_ERR("Failed to allocate label");
         goto error;
     }
-    if (!RSA_set0_key(rsa, n, NULL, NULL)) {
-        LOG_ERR("RSA_set0_key failed\n");
-        BN_free(n);
+
+    rc = EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, newlabel, label_len);
+    if (rc <= 0) {
+        LOG_ERR("Failed EVP_PKEY_CTX_set0_rsa_oaep_label");
+        free(newlabel);
         goto error;
     }
-    // Encrypting
-    encrypted_protection_seed->size = mod_size;
-    return_code = RSA_public_encrypt(mod_size, encoded,
-            encrypted_protection_seed->secret, rsa, RSA_NO_PADDING);
-    if (return_code < 0) {
-        LOG_ERR("Failed RSA_public_encrypt\n");
+
+    size_t outlen = sizeof(TPMU_ENCRYPTED_SECRET);
+    if (EVP_PKEY_encrypt(ctx, encrypted_protection_seed->secret, &outlen,
+            protection_seed->buffer, protection_seed->size) <= 0) {
+        LOG_ERR("Failed EVP_PKEY_encrypt\n");
         goto error;
     }
-
+    encrypted_protection_seed->size = outlen;
     rval = true;
 
 error:
-    free(pub_modulus);
-    RSA_free(rsa);
+    EVP_PKEY_CTX_free(ctx);
+    EVP_PKEY_free(pkey);
     return rval;
 }
 
@@ -218,7 +142,7 @@
 
 bool tpm2_identity_util_share_secret_with_public_key(
         TPM2B_DIGEST *protection_seed, TPM2B_PUBLIC *parent_pub,
-        unsigned char *label, int label_len,
+        const unsigned char *label, int label_len,
         TPM2B_ENCRYPTED_SECRET *encrypted_protection_seed) {
     bool result = false;
     TPMI_ALG_PUBLIC alg = parent_pub->publicArea.type;
@@ -253,7 +177,18 @@
             return EVP_aes_256_cfb();
             /* no default */
         }
+        break;
     }
+#if HAVE_EVP_SM4_CFB
+    case TPM2_ALG_SM4: {
+        switch (sym->keyBits.sm4) {
+        case 128:
+            return EVP_sm4_cfb();
+            /* no default */
+        }
+        break;
+    }
+#endif
         /* no default */
     }
 
@@ -289,7 +224,10 @@
         return false;
     }
 
-    EVP_CIPHER_CTX *ctx = tpm2_openssl_cipher_new();
+    EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
+    if (!ctx) {
+        return false;
+    }
 
     int rc = EVP_EncryptInit_ex(ctx, cipher, NULL, encryption_key, iv);
     if (!rc) {
@@ -336,7 +274,7 @@
     result = true;
 
 out:
-    tpm2_openssl_cipher_free(ctx);
+    EVP_CIPHER_CTX_free(ctx);
 
     return result;
 }
@@ -353,7 +291,7 @@
 
     UINT16 hash_size = tpm2_alg_util_get_hash_size(parent_name_alg);
 
-    HMAC(tpm2_openssl_halg_from_tpmhalg(parent_name_alg), hmac_key, hash_size,
+    HMAC(tpm2_openssl_md_from_tpmhalg(parent_name_alg), hmac_key, hash_size,
             to_hmac_buffer, buffer1_size + buffer2_size,
             outer_integrity_hmac->buffer, &size);
     outer_integrity_hmac->size = size;
@@ -364,16 +302,29 @@
         TPM2B_DATA *enc_sensitive_key, TPMT_SYM_DEF_OBJECT *sym_alg,
         TPM2B_MAX_BUFFER *encrypted_inner_integrity) {
 
+    TSS2_RC rval;
+
     //Marshal sensitive area
     uint8_t buffer_marshalled_sensitiveAreaTPM2_MAX_DIGEST_BUFFER = { 0 };
     size_t marshalled_sensitive_size = 0;
-    Tss2_MU_TPMT_SENSITIVE_Marshal(&sensitive->sensitiveArea,
+    rval = Tss2_MU_TPMT_SENSITIVE_Marshal(&sensitive->sensitiveArea,
             buffer_marshalled_sensitiveArea + sizeof(uint16_t),
             TPM2_MAX_DIGEST_BUFFER, &marshalled_sensitive_size);
+    if (rval != TPM2_RC_SUCCESS)
+    {
+        LOG_ERR("Error serializing the sensitive data");
+        return false;
+    }
+
     size_t marshalled_sensitive_size_info = 0;
-    Tss2_MU_UINT16_Marshal(marshalled_sensitive_size,
+    rval = Tss2_MU_UINT16_Marshal(marshalled_sensitive_size,
             buffer_marshalled_sensitiveArea, sizeof(uint16_t),
             &marshalled_sensitive_size_info);
+    if (rval != TPM2_RC_SUCCESS)
+    {
+        LOG_ERR("Error serializing the sensitive size");
+        return false;
+    }
 
     //concatenate NAME
     memcpy(buffer_marshalled_sensitiveArea + marshalled_sensitive_size +
@@ -385,14 +336,28 @@
                     + marshalled_sensitive_size_info + pubname->size;
     size_t digest_size_info = 0;
     UINT16 hash_size = tpm2_alg_util_get_hash_size(name_alg);
-    Tss2_MU_UINT16_Marshal(hash_size, marshalled_sensitive_and_name_digest,
+    rval = Tss2_MU_UINT16_Marshal(hash_size, marshalled_sensitive_and_name_digest,
             sizeof(uint16_t), &digest_size_info);
+    if (rval != TPM2_RC_SUCCESS)
+    {
+        LOG_ERR("Error serializing the name size");
+        return false;
+    }
 
-    digester d = tpm2_openssl_halg_to_digester(name_alg);
-    d(buffer_marshalled_sensitiveArea,
-            marshalled_sensitive_size_info + marshalled_sensitive_size
-                    + pubname->size,
-            marshalled_sensitive_and_name_digest + digest_size_info);
+    const EVP_MD *md = tpm2_openssl_md_from_tpmhalg(name_alg);
+    if (!md) {
+        LOG_ERR("Algorithm not supported: %x", name_alg);
+        return false;
+    }
+    int rc = EVP_Digest(buffer_marshalled_sensitiveArea,
+                        marshalled_sensitive_size_info + marshalled_sensitive_size
+                            + pubname->size,
+                        marshalled_sensitive_and_name_digest + digest_size_info,
+                        NULL, md, NULL);
+    if (!rc) {
+        LOG_ERR("Hash calculation failed");
+        return false;
+    }
 
     //Inner integrity
     encrypted_inner_integrity->size = marshalled_sensitive_size_info
@@ -423,3 +388,59 @@
             encrypted_duplicate_sensitive->size, pubname->name, pubname->size,
             protection_hmac_key->buffer, outer_hmac);
 }
+
+bool tpm2_identity_create_name(TPM2B_PUBLIC *public, TPM2B_NAME *pubname) {
+
+    /*
+     * A TPM2B_NAME is the name of the algorithm, followed by the hash.
+     * Calculate the name by:
+     * 1. Marshaling the name algorithm
+     * 2. Marshaling the TPMT_PUBLIC past the name algorithm from step 1.
+     * 3. Hash the TPMT_PUBLIC portion in marshaled data.
+     */
+    TSS2_RC rval;
+
+    TPMI_ALG_HASH name_alg = public->publicArea.nameAlg;
+
+    // Step 1 - set beginning of name to hash alg
+    size_t hash_offset = 0;
+    rval = Tss2_MU_UINT16_Marshal(name_alg, pubname->name, pubname->size,
+            &hash_offset);
+    if (rval != TPM2_RC_SUCCESS)
+    {
+        LOG_ERR("Error serializing the name size");
+        return false;
+    }
+
+    // Step 2 - marshal TPMTP
+    TPMT_PUBLIC marshaled_tpmt;
+    size_t tpmt_marshalled_size = 0;
+    rval = Tss2_MU_TPMT_PUBLIC_Marshal(&public->publicArea,
+            (uint8_t *) &marshaled_tpmt, sizeof(public->publicArea),
+            &tpmt_marshalled_size);
+    if (rval != TPM2_RC_SUCCESS)
+    {
+        LOG_ERR("Error serializing the public area");
+        return false;
+    }
+
+    // Step 3 - Hash the data into name just past the alg type.
+    const EVP_MD *md = tpm2_openssl_md_from_tpmhalg(name_alg);
+    if (!md) {
+        LOG_ERR("Algorithm not supported: %x", name_alg);
+        return false;
+    }
+
+    unsigned int hash_size;
+    int rc = EVP_Digest(&marshaled_tpmt, tpmt_marshalled_size,
+                        pubname->name + hash_offset, &hash_size, md, NULL);
+    if (!rc) {
+        LOG_ERR("Hash calculation failed");
+        return false;
+    }
+
+    //Set the name size, UINT16 followed by HASH
+    pubname->size = hash_size + hash_offset;
+
+    return true;
+}

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_identity_util.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_identity_util.h Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_kdfa.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_kdfa.c Changed

@@ -2,6 +2,13 @@
 
 #include <string.h>
 
+#include <openssl/evp.h>
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+#include <openssl/hmac.h>
+#else
+#include <openssl/core_names.h>
+#endif
+
 #include "log.h"
 #include "tpm2_kdfa.h"
 #include "tpm2_openssl.h"
@@ -34,19 +41,33 @@
 
     i = 1;
 
-    const EVP_MD *md = tpm2_openssl_halg_from_tpmhalg(hash_alg);
+    const EVP_MD *md = tpm2_openssl_md_from_tpmhalg(hash_alg);
     if (!md) {
         LOG_ERR("Algorithm not supported for hmac: %x", hash_alg);
         return TPM2_RC_HASH;
     }
 
-    HMAC_CTX *ctx = tpm2_openssl_hmac_new();
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    HMAC_CTX *ctx = HMAC_CTX_new();
+#else
+    EVP_MAC *hmac = EVP_MAC_fetch(NULL, "HMAC", NULL);
+    EVP_MAC_CTX *ctx = EVP_MAC_CTX_new(hmac);
+#endif
     if (!ctx) {
         LOG_ERR("HMAC context allocation failed");
         return TPM2_RC_MEMORY;
     }
 
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
     int rc = HMAC_Init_ex(ctx, key->buffer, key->size, md, NULL);
+#else
+    OSSL_PARAM params2;
+
+    params0 = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST,
+                                                 (char *)EVP_MD_get0_name(md), 0);
+    params1 = OSSL_PARAM_construct_end();
+    int rc = EVP_MAC_init(ctx, key->buffer, key->size, params);
+#endif
     if (!rc) {
         LOG_ERR("HMAC Init failed: %s", ERR_error_string(rc, NULL));
         rval = TPM2_RC_MEMORY;
@@ -71,7 +92,11 @@
         int c;
         for (c = 0; c < j; c++) {
             TPM2B_DIGEST *digest = buffer_listc;
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
             int rc = HMAC_Update(ctx, digest->buffer, digest->size);
+#else
+            int rc = EVP_MAC_update(ctx, digest->buffer, digest->size);
+#endif
             if (!rc) {
                 LOG_ERR("HMAC Update failed: %s", ERR_error_string(rc, NULL));
                 rval = TPM2_RC_MEMORY;
@@ -79,8 +104,13 @@
             }
         }
 
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
         unsigned size = sizeof(tmpResult.buffer);
         int rc = HMAC_Final(ctx, tmpResult.buffer, &size);
+#else
+        size_t size;
+        int rc = EVP_MAC_final(ctx, tmpResult.buffer, &size, sizeof(tmpResult.buffer));
+#endif
         if (!rc) {
             LOG_ERR("HMAC Final failed: %s", ERR_error_string(rc, NULL));
             rval = TPM2_RC_MEMORY;
@@ -100,7 +130,12 @@
     result_key->size = bytes;
 
 err:
-    tpm2_openssl_hmac_free(ctx);
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    HMAC_CTX_free(ctx);
+#else
+    EVP_MAC_CTX_free(ctx);
+    EVP_MAC_free(hmac);
+#endif
 
     return rval;
 }

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_kdfe.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_kdfe.c Changed

@@ -5,19 +5,23 @@
 #include <string.h>
 
 #include <openssl/bn.h>
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
 #include <openssl/ecdh.h>
-
+#else
+#include <openssl/core_names.h>
+#endif
 #include <tss2/tss2_tpm2_types.h>
 #include <tss2/tss2_mu.h>
 
 #include "log.h"
+#include "tpm2_convert.h"
 #include "tpm2_openssl.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_util.h"
 
 TSS2_RC tpm2_kdfe(
         TPMI_ALG_HASH hash_alg, TPM2B_ECC_PARAMETER *Z,
-        unsigned char *label, int label_length,
+        const unsigned char *label, int label_length,
         TPM2B_ECC_PARAMETER *party_u, TPM2B_ECC_PARAMETER *party_v,
         UINT16 size_in_bits, TPM2B_MAX_BUFFER  *result_key ) {
 
@@ -42,13 +46,22 @@
     tpm2_util_concat_buffer(&hash_input, (TPM2B *) party_u);
     tpm2_util_concat_buffer(&hash_input, (TPM2B *) party_v);
 
-    digester d = tpm2_openssl_halg_to_digester(hash_alg);
+    const EVP_MD *md = tpm2_openssl_md_from_tpmhalg(hash_alg);
+    if (!md) {
+        LOG_ERR("Algorithm not supported: %x", hash_alg);
+        return TPM2_RC_HASH;
+    }
 
     for (done = 0, counter = 1; done < bytes; done += hash_size, counter++) {
         counter_be = tpm2_util_hton_32(counter);
         memcpy(hash_input.buffer, &counter_be, 4);
 
-        d(hash_input.buffer, hash_input.size, result_key->buffer + done);
+        int rc = EVP_Digest(hash_input.buffer, hash_input.size,
+                            result_key->buffer + done, NULL, md, NULL);
+        if (!rc) {
+            LOG_ERR("Hash calculation failed");
+            return TPM2_RC_MEMORY;
+        }
     }
     // truncate the result to the desired size
     result_key->size = bytes;
@@ -56,72 +69,18 @@
     return rval;
 }
 
-static EC_POINT * tpm2_get_EC_public_key(TPM2B_PUBLIC *public) {
-    EC_POINT *q = NULL;
-    BIGNUM *bn_qx, *bn_qy;
-    EC_KEY *key;
-    const EC_GROUP *group;
-    bool rval;
-    TPMS_ECC_PARMS *tpm_ecc   = &public->publicArea.parameters.eccDetail;
-    TPMS_ECC_POINT *tpm_point = &public->publicArea.unique.ecc;
-
-    int nid = tpm2_ossl_curve_to_nid(tpm_ecc->curveID);
-    if (nid < 0) {
-        return NULL;
-    }
-
-    key = EC_KEY_new_by_curve_name(nid);
-    if (!key) {
-        LOG_ERR("Failed to create EC key from nid");
-        return NULL;
-    }
-
-    bn_qx = BN_bin2bn(tpm_point->x.buffer, tpm_point->x.size, NULL);
-    bn_qy = BN_bin2bn(tpm_point->y.buffer, tpm_point->y.size, NULL);
-    if ((bn_qx == NULL) || (bn_qy == NULL)) {
-        LOG_ERR("Could not convert EC public key to BN");
-        goto out;
-    }
-    group = EC_KEY_get0_group(key);
-    if (!group) {
-        LOG_ERR("EC key missing group");
-        goto out;
-    }
-    q = EC_POINT_new(group);
-    if (q == NULL) {
-        LOG_ERR("Could not allocate EC_POINT");
-        goto out;
-    }
-
-    rval = EC_POINT_set_affine_coordinates_tss(group, q, bn_qx, bn_qy, NULL);
-    if (rval == false) {
-        LOG_ERR("Could not set affine_coordinates");
-        EC_POINT_free(q);
-        q = NULL;
-    }
-
-out:
-    if (bn_qx) {
-        BN_free(bn_qx);
-    }
-    if (bn_qy) {
-        BN_free(bn_qy);
-    }
-    if (key) {
-        EC_KEY_free(key);
-    }
-
-    return q;
-}
-
-
-static bool get_public_key_from_ec_key(EC_KEY *key, TPMS_ECC_POINT *point) {
-    BIGNUM *x = BN_new();
-    BIGNUM *y = BN_new();
-    const EC_POINT *pubkey = EC_KEY_get0_public_key(key);
+static bool get_public_key_from_ec_key(EVP_PKEY *pkey, TPMS_ECC_POINT *point) {
+    BIGNUM *x = NULL;
+    BIGNUM *y = NULL;
     unsigned int nbx, nby;
     bool result = false;
 
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    EC_KEY *key = EVP_PKEY_get0_EC_KEY(pkey);
+    const EC_POINT *pubkey = EC_KEY_get0_public_key(key);
+
+    x = BN_new();
+    y = BN_new();
     if ((x == NULL) || (y == NULL) || (pubkey == NULL)) {
         LOG_ERR("Failed to allocate memory to store EC public key.");
         goto out;
@@ -129,6 +88,18 @@
 
     EC_POINT_get_affine_coordinates_tss(EC_KEY_get0_group(key),
             pubkey, x, y, NULL);
+#else
+    int rc = EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_EC_PUB_X, &x);
+    if (!rc) {
+        LOG_ERR("Failed to get EC public key X.");
+        goto out;
+    }
+    rc = EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_EC_PUB_Y, &y);
+    if (!rc) {
+        LOG_ERR("Failed to get EC public key Y.");
+        goto out;
+    }
+#endif
     nbx = BN_num_bytes(x);
     nby = BN_num_bytes(y);
     if ((nbx > sizeof(point->x.buffer))||
@@ -144,36 +115,48 @@
     result = true;
 
 out:
-    if (x) {
-        BN_free(x);
-    }
-    if (y) {
-        BN_free(y);
-    }
+    BN_free(x);
+    BN_free(y);
     return result;
 }
 
 
-static int get_ECDH_shared_secret(EC_KEY *key,
-        const EC_POINT *p_pub, TPM2B_ECC_PARAMETER *secret) {
+static int get_ECDH_shared_secret(EVP_PKEY *pkey,
+        EVP_PKEY *p_pub, TPM2B_ECC_PARAMETER *secret) {
 
-    int shared_secret_length;
+    EVP_PKEY_CTX *ctx;
+    int result = -1;
 
-    shared_secret_length = EC_GROUP_get_degree(EC_KEY_get0_group(key));
-    shared_secret_length = (shared_secret_length + 7) / 8;
-    if ((size_t) shared_secret_length > sizeof(secret->buffer)) {
+    ctx = EVP_PKEY_CTX_new(pkey, NULL);
+    if (!ctx)
         return -1;
-    }
-    secret->size = ECDH_compute_key(secret->buffer,
-            shared_secret_length, p_pub, key, NULL);
-    return secret->size;
+
+    int rc = EVP_PKEY_derive_init(ctx);
+    if (rc <= 0)
+        goto out;
+
+    rc = EVP_PKEY_derive_set_peer(ctx, p_pub);
+    if (rc <= 0)
+        goto out;
+
+    size_t shared_secret_length = sizeof(secret->buffer);
+    rc = EVP_PKEY_derive(ctx, secret->buffer, &shared_secret_length);
+    if (rc <= 0)
+        goto out;
+
+    secret->size = shared_secret_length;
+    result = secret->size;
+
+out:
+    EVP_PKEY_CTX_free(ctx);
+    return result;
 }
 
 
 
 bool ecdh_derive_seed_and_encrypted_seed(
         TPM2B_PUBLIC *parent_pub,
-        unsigned char *label, int label_len,
+        const unsigned char *label, int label_len,
         TPM2B_DIGEST *seed,
         TPM2B_ENCRYPTED_SECRET *out_sym_seed) {
 
@@ -181,25 +164,42 @@
     TPMI_ALG_HASH parent_name_alg = parent_pub->publicArea.nameAlg;
     UINT16 parent_hash_size = tpm2_alg_util_get_hash_size(parent_name_alg);
     bool result = false;
-    EC_KEY *key = NULL;
-    EC_POINT *qsv = NULL;
+    EVP_PKEY_CTX *ctx;
+    EVP_PKEY *pkey = NULL;
+    EVP_PKEY *qsv = NULL;
     TPMS_ECC_POINT qeu;
     bool qeu_is_valid;
     TPM2B_ECC_PARAMETER ecc_secret;
 
     // generate an ephemeral key
     int nid = tpm2_ossl_curve_to_nid(tpm_ecc->curveID);
-    if (nid >= 0) {
-        key = EC_KEY_new_by_curve_name(nid);
-    }
-    if (key == NULL) {
-        LOG_ERR("Failed to create EC key from curveID");
+
+    ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
+    if (!ctx) {
+        LOG_ERR("Failed to create key creation context");
         return false;
     }
-    EC_KEY_generate_key(key);
+
+    int rc = EVP_PKEY_keygen_init(ctx);
+    if (rc <= 0) {
+        LOG_ERR("Failed to initialize key creation");
+        goto out;
+    }
+
+    rc = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, nid);
+    if (rc <= 0) {
+        LOG_ERR("Failed to set EC curve NID %i", nid);
+        goto out;
+    }
+
+    rc = EVP_PKEY_keygen(ctx, &pkey);
+    if (rc <= 0) {
+        LOG_ERR("Failed to generate the ephemeral EC key");
+        goto out;
+    }
 
     // get public key for the ephemeral key
-    qeu_is_valid = get_public_key_from_ec_key(key, &qeu);
+    qeu_is_valid = get_public_key_from_ec_key(pkey, &qeu);
     if (qeu_is_valid == false) {
         LOG_ERR("Could not get the ECC public key");
         goto out;
@@ -217,13 +217,17 @@
     out_sym_seed->size = offset;
 
     /* get parents public key */
-    qsv = tpm2_get_EC_public_key(parent_pub);
+    qsv = convert_pubkey_ECC(&parent_pub->publicArea);
     if (qsv == NULL) {
         LOG_ERR("Could not get parent's public key");
         goto out;
     }
 
-    get_ECDH_shared_secret(key, qsv, &ecc_secret);
+    rc = get_ECDH_shared_secret(pkey, qsv, &ecc_secret);
+    if (rc <= 0) {
+        LOG_ERR("Could not derive shared secret");
+        goto out;
+    }
 
     /* derive seed using KDFe */
     TPM2B_ECC_PARAMETER *party_u_info = &qeu.x;
@@ -235,11 +239,8 @@
     result = true;
 
 out:
-    if (qsv) {
-        EC_POINT_free(qsv);
-    }
-    if (key) {
-        EC_KEY_free(key);
-    }
+    EVP_PKEY_free(qsv);
+    EVP_PKEY_free(pkey);
+    EVP_PKEY_CTX_free(ctx);
     return result;
 }

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_kdfe.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_kdfe.h Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_nv_util.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_nv_util.h Changed

@@ -14,11 +14,6 @@
 #include "tpm2_hierarchy.h"
 #include "tpm2_util.h"
 
-/*
- * The default buffer size when one cannot be determined via get capability.
- */
-#define NV_DEFAULT_BUFFER_SIZE 512
-
 /**
  * Reads the public portion of a Non-Volatile (nv) index.
  * @param context
@@ -31,56 +26,97 @@
  *  tool_rc indicating status.
  */
 static inline tool_rc tpm2_util_nv_read_public(ESYS_CONTEXT *context,
-        TPMI_RH_NV_INDEX nv_index, TPM2B_NV_PUBLIC **nv_public) {
-
-    ESYS_TR tr_object;
-    tool_rc rc = tpm2_from_tpm_public(context, nv_index, ESYS_TR_NONE,
-            ESYS_TR_NONE, ESYS_TR_NONE, &tr_object);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
-
-    rc = tpm2_nv_readpublic(context, tr_object, nv_public, NULL);
-    tool_rc tmp_rc = tpm2_close(context, &tr_object);
-    if (tmp_rc != tool_rc_success) {
-        rc = tmp_rc;
-    }
-
-    return rc;
+    TPMI_RH_NV_INDEX nv_index, TPM2B_NAME *precalc_nvname,
+    TPM2B_NV_PUBLIC **nv_public, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, ESYS_TR shandle1, ESYS_TR shandle2,
+    ESYS_TR shandle3) {
+
+    return tpm2_nv_readpublic(context, nv_index, precalc_nvname, nv_public, 0,
+        cp_hash, rp_hash, parameter_hash_algorithm, shandle1, shandle2,
+        shandle3);
 }
 
 /**
- * Retrieves the maximum transmission size for an NV buffer by
- * querying the capabilities for TPM2_PT_NV_BUFFER_MAX.
- * @param context
+ * Retrieves max NV buffer size based on the NV operation and accounting for the
+ * buffers reported by the capability structures.
+ * 1. If getcap fails, return TPM2_MAX_NV_BUFFER_SIZE constant
+ * 2. If getcap passes AND op is NVDEFINE return TPM2_PT_NV_INDEX_MAX cap data
+ * 3. if getcap passes AND op is !NVDEFINE return TPM2_PT_NV_BUFFER cap data
+ *
+ * @param esys_context
  *  The Enhanced System API (ESAPI) context
- * @param size
- *  The size of the buffer.
+ * @param is_nvdefine_op
+ *  Truth value to check if the NV operation is for defining NV index.
  * @return
- *  tool_rc Indicating status.
+ *  The maximum allowed NV size based on the NV operation and capability info.
  */
-static inline tool_rc tpm2_util_nv_max_buffer_size(ESYS_CONTEXT *ectx,
-        UINT32 *size) {
-
-    /* Get the maximum read block size */
-    TPMS_CAPABILITY_DATA *cap_data;
-    TPMI_YES_NO more_data;
-    tool_rc rc = tpm2_getcap(ectx, TPM2_CAP_TPM_PROPERTIES,
-            TPM2_PT_NV_BUFFER_MAX, 1, &more_data, &cap_data);
+static inline uint16_t tpm2_nv_util_max_allowed_nv_size(
+    ESYS_CONTEXT *esys_context, bool is_nvdefine_op) {
+
+    /*
+     * 1. Default size if getcap fails to report
+     */
+    uint16_t max_nv_size = TPM2_MAX_NV_BUFFER_SIZE;
+
+    TPMS_CAPABILITY_DATA *cap_data = 0;
+    UINT32 property = is_nvdefine_op ? TPM2_PT_FIXED : TPM2_PT_NV_BUFFER_MAX;
+    UINT32 property_count = is_nvdefine_op ? TPM2_MAX_TPM_PROPERTIES : 1;
+    tool_rc rc = tpm2_getcap(esys_context, TPM2_CAP_TPM_PROPERTIES, property,
+        property_count, 0, &cap_data);
+    bool is_getcap_op_fail = false;
     if (rc != tool_rc_success) {
-        return rc;
+        is_getcap_op_fail = true;
+        goto out;
     }
 
-    if ( cap_data->data.tpmProperties.tpmProperty0.property == TPM2_PT_NV_BUFFER_MAX ) {
-        *size = cap_data->data.tpmProperties.tpmProperty0.value;
-    } else {
-        /* TPM2_PT_NV_BUFFER_MAX is not part of the module spec <= 0.98*/
-        *size = NV_DEFAULT_BUFFER_SIZE;
+    /*
+     * 2. Non-NVDEFINE ops
+     */
+    if (!is_nvdefine_op) {
+        if(cap_data->data.tpmProperties.tpmProperty0.property ==
+        TPM2_PT_NV_BUFFER_MAX ) {
+            max_nv_size = cap_data->data.tpmProperties.tpmProperty0.value;
+        } else {
+            /*
+             * If TPM doesn't report TPM2_PT_NV_BUFFER_MAX in getcap,
+             * set the default sz.
+             */
+            is_getcap_op_fail = true;
+        }
+        goto out;
     }
 
+    /*
+     * 3. NVDEFINE op
+     */
+    TPMS_TAGGED_PROPERTY *properties = cap_data->data.tpmProperties.tpmProperty;
+    UINT32 count = cap_data->data.tpmProperties.count;
+    if (!count) {
+        is_getcap_op_fail = true;
+        goto out;
+    }
+
+    /*
+     * If TPM doesn't report TPM2_PT_NV_INDEX_MAX in getcap, set the default sz.
+     */
+    is_getcap_op_fail = true;
+    UINT32 i;
+    for (i = 0; i < count; i++) {
+        if (propertiesi.property == TPM2_PT_NV_INDEX_MAX) {
+            max_nv_size = propertiesi.value;
+            is_getcap_op_fail = false;
+            break;
+        }
+    }
+
+out:
     free(cap_data);
 
-    return rc;
+    if (is_getcap_op_fail) {
+        LOG_WARN("Cannot determine size from TPM properties."
+                 "Setting max NV index size value to TPM2_MAX_NV_BUFFER_SIZE");
+    }
+    return max_nv_size;
 }
 
 /**
@@ -101,107 +137,140 @@
  *  tpm2 session.
  * @param data_buffer
  *  (callee-allocated) Buffer containing data at nv_index
- * @param bytes_written
+ * @param bytes_read
  *  The number of bytes written to data_buffer
  * @return
  *  tool_rc indicating status.
  */
 static inline tool_rc tpm2_util_nv_read(ESYS_CONTEXT *ectx,
-        TPMI_RH_NV_INDEX nv_index, UINT16 size, UINT16 offset,
-        tpm2_loaded_object * auth_hierarchy_obj, UINT8 **data_buffer,
-        UINT16 *bytes_written, TPM2B_DIGEST *cp_hash) {
-
-    *data_buffer = NULL;
-
-    TPM2B_NV_PUBLIC *nv_public = NULL;
-    tool_rc rc = tpm2_util_nv_read_public(ectx, nv_index, &nv_public);
-    if (rc != tool_rc_success) {
-        goto out;
+    TPMI_RH_NV_INDEX nv_index, UINT16 size, UINT16 offset,
+    tpm2_loaded_object * auth_hierarchy_obj, UINT8 **data_buffer,
+    UINT16 *bytes_read, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
+    TPMI_ALG_HASH parameter_hash_algorithm, TPM2B_NAME *precalc_nvname,
+    ESYS_TR shandle2, ESYS_TR shandle3, TPM2B_NV_PUBLIC **nv_pub_out) {
+
+    /*
+     * NVRead is not dispatched when:
+     * cpHash size is non-zero and rpHash size is zero.
+     */
+    bool is_nvread_dispatched = (cp_hash->size && !rp_hash->size)? false : true;
+    UINT16 max_data_size = 0;
+    if (!is_nvread_dispatched) {
+        *data_buffer = 0;
+        max_data_size = size;
     }
 
-    UINT16 data_size = nv_public->nvPublic.dataSize;
-    free(nv_public);
+    /*
+     * Perform additional checks on the NV index size when actually dispatching
+     * NVRead command.
+     */
+    tool_rc rc = tool_rc_success;
+    if (is_nvread_dispatched) {
 
-    /* if size is 0, assume the whole object */
-    if (size == 0) {
-        size = data_size;
-    }
+        max_data_size= tpm2_nv_util_max_allowed_nv_size(ectx, false);
 
-    if (offset > data_size) {
-        LOG_ERR("Requested offset to read from is greater than size. offset=%u"
-                ", size=%u", offset, data_size);
-        rc = tool_rc_general_error;
-        goto out;
-    }
+        TPM2B_NV_PUBLIC *nv_public = NULL;
+        rc = tpm2_util_nv_read_public(ectx, nv_index, 0, &nv_public, 0, 0, 0,
+            ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE);
+        if (rc != tool_rc_success) {
+            goto out;
+        }
 
-    if (offset + size > data_size) {
-        LOG_ERR("Requested to read more bytes than available from offset,"
-                " offset=%u, request-read-size=%u actual-data-size=%u", offset,
-                size, data_size);
-        rc = tool_rc_general_error;
-        goto out;
-    }
+        UINT16 data_size = nv_public->nvPublic.dataSize;
+        if (nv_pub_out) {
+            *nv_pub_out = nv_public;
+        } else {
+            free(nv_public);
+        }
+        /* if size is 0, assume the whole object */
+        if (size == 0) {
+            size = data_size;
+        }
 
-    if (cp_hash) {
-        goto tpm2_util_nv_read_collect_cp_hash;
-    }
+        if (offset > data_size) {
+            LOG_ERR("Requested offset to read from is greater than size. offset=%u"
+                    ", size=%u", offset, data_size);
+            rc = tool_rc_general_error;
+            goto out;
+        }
 
-    UINT32 max_data_size;
-    rc = tpm2_util_nv_max_buffer_size(ectx, &max_data_size);
-    if (rc != tool_rc_success) {
-        goto out;
-    }
+        if (offset + size > data_size) {
+            LOG_ERR("Requested to read more bytes than available from offset,"
+                    " offset=%u, request-read-size=%u actual-data-size=%u", offset,
+                    size, data_size);
+            rc = tool_rc_general_error;
+            goto out;
+        }
 
-    if (max_data_size > TPM2_MAX_NV_BUFFER_SIZE) {
-        max_data_size = TPM2_MAX_NV_BUFFER_SIZE;
-    } else if (max_data_size == 0) {
-        max_data_size = NV_DEFAULT_BUFFER_SIZE;
+        *data_buffer = malloc(data_size);
+        if (!*data_buffer) {
+            LOG_ERR("oom");
+            rc = tool_rc_general_error;
+            goto out;
+        }
     }
 
-tpm2_util_nv_read_collect_cp_hash:
-    if (cp_hash) {
-        TPM2B_MAX_NV_BUFFER *nv_data;
-        rc = tpm2_nv_read(ectx, auth_hierarchy_obj, nv_index, size, offset,
-            &nv_data, cp_hash);
-        if (rc != tool_rc_success) {
-            LOG_ERR("Failed cpHash for NVRAM read at index 0x%X", nv_index);
-        }
+    bool is_nv_index_data_larger_than_max_read = (size > max_data_size);
+    /*
+     * The cpHash will also be calculated when rpHash is not zero and command is
+     * actually dispatched. So we want to make sure that if size is not
+     * specified, the NV read operation defaulting to read the entire NV index,
+     * must not cause cpHash buffer to be overwritten. This is becuase in such a
+     * case the NV read is broken into two seperate calls due to the buffer size
+     * being larger than the maximum NV read access size.
+     */
+    if ((cp_hash->size || rp_hash->size) &&
+    is_nv_index_data_larger_than_max_read) {
+        LOG_ERR("Cannot continue to avoid overwriting cpHash/rphash data in file. "
+        "Make seperate tpm2_nvread calls with proper offsets specified to "
+        "specify all NV index data to be read");
+
+        rc = tool_rc_option_error;
         goto out;
     }
 
-    *data_buffer = malloc(data_size);
-    if (!*data_buffer) {
-        LOG_ERR("oom");
-        rc = tool_rc_general_error;
+    bool is_auth_a_policy_session = is_nvread_dispatched &&
+        tpm2_session_get_type(auth_hierarchy_obj->session) == TPM2_SE_POLICY;
+    if (is_auth_a_policy_session && is_nv_index_data_larger_than_max_read) {
+        LOG_ERR("Cannot continue as the policy auth session must be "
+                "reinstantiated for multiple iterations of NV read. "
+                "Specify a max read size of %u or specify an offset and max "
+                "read size of %u", max_data_size, max_data_size);
+        rc = tool_rc_option_error;
         goto out;
     }
 
-    UINT16 data_offset = 0;
-
+    UINT16 data_buffer_offset = 0;
     while (size > 0) {
-
         UINT16 bytes_to_read = size > max_data_size ? max_data_size : size;
-
         TPM2B_MAX_NV_BUFFER *nv_data;
-
-        rc = tpm2_nv_read(ectx, auth_hierarchy_obj, nv_index, bytes_to_read,
-            offset, &nv_data, cp_hash);
+        rc = tpm2_nv_read(ectx, auth_hierarchy_obj, nv_index, precalc_nvname,
+            bytes_to_read, offset, &nv_data, cp_hash, rp_hash,
+            parameter_hash_algorithm, shandle2, shandle3);
         if (rc != tool_rc_success) {
-            LOG_ERR("Failed to read NVRAM area at index 0x%X", nv_index);
+            if (rc != tool_rc_option_error) {
+                LOG_ERR("Failed to read NVRAM area at index 0x%X", nv_index);
+            }
             goto out;
         }
 
-        size -= nv_data->size;
-        offset += nv_data->size;
-
-        memcpy(*data_buffer + data_offset, nv_data->buffer, nv_data->size);
-        data_offset += nv_data->size;
-
-        free(nv_data);
+        if (is_nvread_dispatched) {
+            size -= nv_data->size;
+            offset += nv_data->size;
+            memcpy(*data_buffer + data_buffer_offset, nv_data->buffer, nv_data->size);
+            data_buffer_offset += nv_data->size;
+            free(nv_data);
+        } else {
+            /*
+             * When calculating cpHash the full size is already considered and
+             * so there is no need to adjust it.
+             */
+            size = 0;
+        }
     }
 
-    if (bytes_written) {
-        *bytes_written = data_offset;
+    if (is_nvread_dispatched && bytes_read) {
+        *bytes_read = data_buffer_offset;
     }
 
 out:

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_openssl.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_openssl.c Changed

@@ -6,37 +6,24 @@
 #include <string.h>
 
 #include <openssl/pem.h>
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
 #include <openssl/rand.h>
+#else
+#include <openssl/core_names.h>
+#endif
 
 #include "files.h"
 #include "log.h"
 #include "tpm2_alg_util.h"
+#include "tpm2_auth_util.h"
+#include "tpm2_attr_util.h"
+#include "tpm2_identity_util.h"
 #include "tpm2_openssl.h"
+#include "tpm2_errata.h"
 #include "tpm2_systemdeps.h"
 
-/* compatibility function for OpenSSL versions < 1.1.0 */
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-static int BN_bn2binpad(const BIGNUM *a, unsigned char *to, int tolen) {
-    int r;
-    int topad;
-    int islen;
-
-    islen = BN_num_bytes(a);
-
-    if (tolen < islen)
-        return -1;
-
-    topad = tolen - islen;
-
-    memset(to, 0x00, topad);
-    r = BN_bn2bin(a, to + topad);
-    if (r == 0) {
-        return -1;
-    }
-
-    return tolen;
-}
-#endif
+#define KEYEDHASH_MAX_SIZE 128
+#define HMAC_MAX_SIZE      64
 
 int tpm2_openssl_halgid_from_tpmhalg(TPMI_ALG_HASH algorithm) {
 
@@ -49,13 +36,17 @@
         return NID_sha384;
     case TPM2_ALG_SHA512:
         return NID_sha512;
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+	case TPM2_ALG_SM3_256:
+		return NID_sm3;
+#endif
     default:
         return NID_sha256;
     }
     /* no return, not possible */
 }
 
-const EVP_MD *tpm2_openssl_halg_from_tpmhalg(TPMI_ALG_HASH algorithm) {
+const EVP_MD *tpm2_openssl_md_from_tpmhalg(TPMI_ALG_HASH algorithm) {
 
     switch (algorithm) {
     case TPM2_ALG_SHA1:
@@ -66,70 +57,22 @@
         return EVP_sha384();
     case TPM2_ALG_SHA512:
         return EVP_sha512();
+#if HAVE_EVP_SM3
+	case TPM2_ALG_SM3_256:
+		return EVP_sm3();
+#endif
     default:
         return NULL;
     }
     /* no return, not possible */
 }
 
-#if defined(LIB_TPM2_OPENSSL_OPENSSL_PRE11)
-int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d) {
-
-    if ((r->n == NULL && n == NULL) || (r->e == NULL && e == NULL)) {
-        return 0;
-    }
-
-    if (n != NULL) {
-        BN_free(r->n);
-        r->n = n;
-    }
-
-    if (e != NULL) {
-        BN_free(r->e);
-        r->e = e;
-    }
-
-    if (d != NULL) {
-        BN_free(r->d);
-        r->d = d;
-    }
-
-    return 1;
-}
-
-void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q) {
-    if(p) {
-        *p = r->p;
-    }
-
-    if (q) {
-        *q = r->q;
-    }
-}
-
-int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s) {
-
-    if (!r || !s) {
-        return 0;
-    }
-
-    BN_clear_free(sig->r);
-    BN_clear_free(sig->s);
-
-    sig->r = r;
-    sig->s = s;
-
-    return 1;
-}
-
-#endif
-
 bool tpm2_openssl_hash_compute_data(TPMI_ALG_HASH halg, BYTE *buffer,
         UINT16 length, TPM2B_DIGEST *digest) {
 
     bool result = false;
 
-    const EVP_MD *md = tpm2_openssl_halg_from_tpmhalg(halg);
+    const EVP_MD *md = tpm2_openssl_md_from_tpmhalg(halg);
     if (!md) {
         return false;
     }
@@ -173,7 +116,7 @@
 
     bool result = false;
 
-    const EVP_MD *md = tpm2_openssl_halg_from_tpmhalg(halg);
+    const EVP_MD *md = tpm2_openssl_md_from_tpmhalg(halg);
     if (!md) {
         return false;
     }
@@ -222,7 +165,7 @@
 
     bool result = false;
 
-    const EVP_MD *md = tpm2_openssl_halg_from_tpmhalg(halg);
+    const EVP_MD *md = tpm2_openssl_md_from_tpmhalg(halg);
     if (!md) {
         return false;
     }
@@ -274,7 +217,7 @@
     UINT32 vi = 0, di = 0, i;
     bool result = false;
 
-    const EVP_MD *md = tpm2_openssl_halg_from_tpmhalg(hash_alg);
+    const EVP_MD *md = tpm2_openssl_md_from_tpmhalg(hash_alg);
     if (!md) {
         return false;
     }
@@ -351,7 +294,7 @@
     UINT32 vi = 0, di = 0, i;
     bool result = false;
 
-    const EVP_MD *md = tpm2_openssl_halg_from_tpmhalg(hash_alg);
+    const EVP_MD *md = tpm2_openssl_md_from_tpmhalg(hash_alg);
     if (!md) {
         return false;
     }
@@ -420,75 +363,6 @@
     return result;
 }
 
-HMAC_CTX *tpm2_openssl_hmac_new() {
-    HMAC_CTX *ctx;
-#if defined(LIB_TPM2_OPENSSL_OPENSSL_PRE11)
-    ctx = malloc(sizeof(*ctx));
-#else
-    ctx = HMAC_CTX_new();
-#endif
-    if (!ctx)
-        return NULL;
-
-#if defined(LIB_TPM2_OPENSSL_OPENSSL_PRE11)
-    HMAC_CTX_init(ctx);
-#endif
-
-    return ctx;
-}
-
-void tpm2_openssl_hmac_free(HMAC_CTX *ctx) {
-#if defined(LIB_TPM2_OPENSSL_OPENSSL_PRE11)
-    HMAC_CTX_cleanup(ctx);
-    free(ctx);
-#else
-    HMAC_CTX_free(ctx);
-#endif
-}
-
-EVP_CIPHER_CTX *tpm2_openssl_cipher_new(void) {
-    EVP_CIPHER_CTX *ctx;
-#if defined(LIB_TPM2_OPENSSL_OPENSSL_PRE11)
-    ctx = malloc(sizeof(*ctx));
-#else
-    ctx = EVP_CIPHER_CTX_new();
-#endif
-    if (!ctx)
-        return NULL;
-
-#if defined(LIB_TPM2_OPENSSL_OPENSSL_PRE11)
-    EVP_CIPHER_CTX_init(ctx);
-#endif
-
-    return ctx;
-}
-
-void tpm2_openssl_cipher_free(EVP_CIPHER_CTX *ctx) {
-#if defined(LIB_TPM2_OPENSSL_OPENSSL_PRE11)
-    EVP_CIPHER_CTX_cleanup(ctx);
-    free(ctx);
-#else
-    EVP_CIPHER_CTX_free(ctx);
-#endif
-}
-
-digester tpm2_openssl_halg_to_digester(TPMI_ALG_HASH halg) {
-
-    switch (halg) {
-    case TPM2_ALG_SHA1:
-        return SHA1;
-    case TPM2_ALG_SHA256:
-        return SHA256;
-    case TPM2_ALG_SHA384:
-        return SHA384;
-    case TPM2_ALG_SHA512:
-        return SHA512;
-        /* no default */
-    }
-
-    return NULL;
-}
-
 /*
  * Per man openssl(1), handle the following --passin formats:
  *     pass:password
@@ -661,32 +535,58 @@
     return pfn(passin, pass);
 }
 
-static bool load_public_RSA_from_key(RSA *k, TPM2B_PUBLIC *pub) {
+static bool load_public_RSA_from_key(EVP_PKEY *key, TPM2B_PUBLIC *pub) {
 
+    bool result = false;
     TPMT_PUBLIC *pt = &pub->publicArea;
     pt->type = TPM2_ALG_RSA;
 
     TPMS_RSA_PARMS *rdetail = &pub->publicArea.parameters.rsaDetail;
-    rdetail->scheme.scheme = TPM2_ALG_NULL;
-    rdetail->symmetric.algorithm = TPM2_ALG_NULL;
-    rdetail->scheme.details.anySig.hashAlg = TPM2_ALG_NULL;
+    /*
+     * If the scheme is not TPM2_ALG_ERROR (0),
+     * its a valid scheme so don't set it to NULL scheme
+     */
+    if (rdetail->scheme.scheme == TPM2_ALG_ERROR) {
+        rdetail->scheme.scheme = TPM2_ALG_NULL;
+        rdetail->symmetric.algorithm = TPM2_ALG_NULL;
+        rdetail->scheme.details.anySig.hashAlg = TPM2_ALG_NULL;
+    }
 
-    /* NULL out sym details */
+    /* NULL out sym details if not already set */
     TPMT_SYM_DEF_OBJECT *sym = &rdetail->symmetric;
-    sym->algorithm = TPM2_ALG_NULL;
-    sym->keyBits.sym = 0;
-    sym->mode.sym = TPM2_ALG_NULL;
+    if (sym->algorithm == TPM2_ALG_ERROR) {
+        sym->algorithm = TPM2_ALG_NULL;
+        sym->keyBits.sym = 0;
+        sym->mode.sym = TPM2_ALG_NULL;
+    }
 
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
     const BIGNUM *n; /* modulus */
     const BIGNUM *e; /* public key exponent */
 
-#if defined(LIB_TPM2_OPENSSL_OPENSSL_PRE11)
-    n = k->n;
-    e = k->e;
-#else
+    RSA *k = EVP_PKEY_get0_RSA(key);
+    if (!k) {
+        LOG_ERR("Could not retrieve RSA key");
+        goto out;
+    }
+
     RSA_get0_key(k, &n, &e, NULL);
-#endif
+#else
+    BIGNUM *n = NULL; /* modulus */
+    BIGNUM *e = NULL; /* public key exponent */
 
+    int rc = EVP_PKEY_get_bn_param(key, OSSL_PKEY_PARAM_RSA_N, &n);
+    if (!rc) {
+        LOG_ERR("Could not read public modulus N");
+        goto out;
+    }
+
+    rc = EVP_PKEY_get_bn_param(key, OSSL_PKEY_PARAM_RSA_E, &e);
+    if (!rc) {
+        LOG_ERR("Could not read public exponent E");
+        goto out;
+    }
+#endif
     /*
      * The size of the modulus is the key size in RSA, store this as the
      * keyBits in the RSA details.
@@ -699,7 +599,7 @@
         break;
     default:
         LOG_ERR("RSA key-size %u is not supported", rdetail->keyBits);
-        return false;
+        goto out;
     }
 
     /* copy the modulus to the unique RSA field */
@@ -707,47 +607,25 @@
     int success = BN_bn2bin(n, pt->unique.rsa.buffer);
     if (!success) {
         LOG_ERR("Could not copy public modulus N");
-        return false;
-    }
-
-    /*Make sure that we can fit the exponent into a UINT32 */
-    unsigned e_size = BN_num_bytes(e);
-    if (e_size > sizeof(rdetail->exponent)) {
-        LOG_ERR(
-                "Exponent is too big. Got %d expected less than or equal to %zu",
-                e_size, sizeof(rdetail->exponent));
-        return false;
-    }
-
-    /*
-     * Copy the exponent into the field.
-     * Returns 1 on success false on error.
-     */
-    return BN_bn2bin(e, (unsigned char *) &rdetail->exponent);
-}
-
-static RSA *tpm2_openssl_get_public_RSA_from_pem(FILE *f, const char *path) {
-
-    /*
-     * Public PEM files appear in two formats:
-     * 1. PEM format, read with PEM_read_RSA_PUBKEY
-     * 2. PKCS#1 format, read with PEM_read_RSAPublicKey
-     *
-     * See:
-     *  - https://stackoverflow.com/questions/7818117/why-i-cant-read-openssl-generated-rsa-pub-key-with-pem-read-rsapublickey
-     */
-    RSA *pub = PEM_read_RSA_PUBKEY(f, NULL, NULL, NULL);
-    if (!pub) {
-        pub = PEM_read_RSAPublicKey(f, NULL, NULL, NULL);
+        goto out;
     }
 
-    if (!pub) {
-        ERR_print_errors_fp(stderr);
-        LOG_ERR("Reading public PEM file \"%s\" failed", path);
-        return NULL;
+    unsigned long exp = BN_get_word(e);
+    if (exp == 0xffffffffL) {
+        LOG_ERR("Could not copy public exponent E");
+        goto out;
     }
+    rdetail->exponent = exp;
 
-    return pub;
+    result = true;
+out:
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    /* k,n,e point to internal structrues and must not be freed after use */
+#else
+    BN_free(n);
+    BN_free(e);
+#endif
+    return result;
 }
 
 static bool load_public_RSA_from_pem(FILE *f, const char *path,
@@ -761,15 +639,19 @@
      * See:
      *  - https://stackoverflow.com/questions/7818117/why-i-cant-read-openssl-generated-rsa-pub-key-with-pem-read-rsapublickey
      */
-    RSA *k = tpm2_openssl_get_public_RSA_from_pem(f, path);
+    EVP_PKEY *k = PEM_read_PUBKEY(f, NULL, NULL, NULL);
     if (!k) {
-        /* tpm2_openssl_get_public_RSA_from_pem() should already log errors */
+        ERR_print_errors_fp(stderr);
+        LOG_ERR("Reading public PEM file \"%s\" failed", path);
         return false;
     }
 
-    bool result = load_public_RSA_from_key(k, pub);
+    bool result = false;
+    if (EVP_PKEY_base_id(k) == EVP_PKEY_RSA) {
+        result = load_public_RSA_from_key(k, pub);
+    }
 
-    RSA_free(k);
+    EVP_PKEY_free(k);
 
     return result;
 }
@@ -782,7 +664,10 @@
     { TPM2_ECC_NIST_P224, NID_secp224r1        },
     { TPM2_ECC_NIST_P256, NID_X9_62_prime256v1 },
     { TPM2_ECC_NIST_P384, NID_secp384r1        },
-    { TPM2_ECC_NIST_P521, NID_secp521r1        }
+    { TPM2_ECC_NIST_P521, NID_secp521r1        },
+#if OPENSSL_VERSION_NUMBER >= 0x10101003L
+    { TPM2_ECC_SM2_P256,  NID_sm2              },
+#endif
     /*
      * XXX
      * See if it's possible to support the other curves, I didn't see the
@@ -832,39 +717,41 @@
     return -1;
 }
 
-static bool load_public_ECC_from_key(EC_KEY *k, TPM2B_PUBLIC *pub) {
+static bool load_public_ECC_from_key(EVP_PKEY *key, TPM2B_PUBLIC *pub) {
 
+    BIGNUM *y = NULL;
+    BIGNUM *x = NULL;
+    int nid;
+    unsigned keysize;
     bool result = false;
 
-    BIGNUM *y = BN_new();
-    BIGNUM *x = BN_new();
-    if (!x || !y) {
-        LOG_ERR("oom");
-        goto out;
-    }
-
     /*
      * Set the algorithm type
      */
     pub->publicArea.type = TPM2_ALG_ECC;
+    TPMS_ECC_PARMS *pp = &pub->publicArea.parameters.eccDetail;
 
     /*
-     * Get the curve type
+     * Get the curve type and the public key (X and Y)
      */
-    const EC_GROUP *group = EC_KEY_get0_group(k);
-    int nid = EC_GROUP_get_curve_name(group);
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    EC_KEY *k = EVP_PKEY_get0_EC_KEY(key);
+    if (!k) {
+        LOG_ERR("Could not retrieve ECC key");
+        goto out;
+    }
 
-    TPMS_ECC_PARMS *pp = &pub->publicArea.parameters.eccDetail;
-    TPM2_ECC_CURVE curve_id = ossl_nid_to_curve(nid); // Not sure what lines up with NIST 256...
-    if (curve_id == TPM2_ALG_ERROR) {
+    y = BN_new();
+    x = BN_new();
+    if (!x || !y) {
+        LOG_ERR("oom");
         goto out;
     }
 
-    pp->curveID = curve_id;
+    const EC_GROUP *group = EC_KEY_get0_group(k);
+    nid = EC_GROUP_get_curve_name(group);
+    keysize = (EC_GROUP_get_degree(group) + 7) / 8;
 
-    /*
-     * Set the unique data to the public key.
-     */
     const EC_POINT *point = EC_KEY_get0_public_key(k);
 
     int ret = EC_POINT_get_affine_coordinates_tss(group, point, x, y, NULL);
@@ -872,6 +759,39 @@
         LOG_ERR("Could not get X and Y affine coordinates");
         goto out;
     }
+#else
+    char curve_name80;
+
+    int rc = EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME,
+                                            curve_name, sizeof(curve_name), NULL);
+    if (!rc) {
+        LOG_ERR("Could not read ECC curve name");
+        goto out;
+    }
+    nid = OBJ_txt2nid(curve_name);
+    keysize = (EVP_PKEY_bits(key) + 7) / 8;
+
+    rc = EVP_PKEY_get_bn_param(key, OSSL_PKEY_PARAM_EC_PUB_X, &x);
+    if (!rc) {
+        LOG_ERR("Could not read public X coordinate");
+        goto out;
+    }
+
+    rc = EVP_PKEY_get_bn_param(key, OSSL_PKEY_PARAM_EC_PUB_Y, &y);
+    if (!rc) {
+        LOG_ERR("Could not read public Y coordinate");
+        goto out;
+    }
+#endif
+
+    /*
+     * Set the curve type
+     */
+    TPM2_ECC_CURVE curve_id = ossl_nid_to_curve(nid); // Not sure what lines up with NIST 256...
+    if (curve_id == TPM2_ALG_ERROR) {
+        goto out;
+    }
+    pp->curveID = curve_id;
 
     /*
      * Copy the X and Y coordinate data into the ECC unique field,
@@ -880,28 +800,26 @@
     TPM2B_ECC_PARAMETER *X = &pub->publicArea.unique.ecc.x;
     TPM2B_ECC_PARAMETER *Y = &pub->publicArea.unique.ecc.y;
 
-    unsigned x_size = (EC_GROUP_get_degree(group) + 7) / 8;
-    if (x_size > sizeof(X->buffer)) {
+    if (keysize > sizeof(X->buffer)) {
         LOG_ERR("X coordinate is too big. Got %u expected less than or equal to"
-                " %zu", x_size, sizeof(X->buffer));
+                " %zu", keysize, sizeof(X->buffer));
         goto out;
     }
 
-    unsigned y_size = (EC_GROUP_get_degree(group) + 7) / 8;
-    if (y_size > sizeof(Y->buffer)) {
+    if (keysize > sizeof(Y->buffer)) {
         LOG_ERR("X coordinate is too big. Got %u expected less than or equal to"
-                " %zu", y_size, sizeof(Y->buffer));
+                " %zu", keysize, sizeof(Y->buffer));
         goto out;
     }
 
-    X->size = BN_bn2binpad(x, X->buffer, x_size);
-    if (X->size != x_size) {
+    X->size = BN_bn2binpad(x, X->buffer, keysize);
+    if (X->size != keysize) {
         LOG_ERR("Error converting X point BN to binary");
         goto out;
     }
 
-    Y->size = BN_bn2binpad(y, Y->buffer, y_size);
-    if (Y->size != y_size) {
+    Y->size = BN_bn2binpad(y, Y->buffer, keysize);
+    if (Y->size != keysize) {
         LOG_ERR("Error converting Y point BN to binary");
         goto out;
     }
@@ -910,54 +828,47 @@
      * no kdf - not sure what this should be
      */
     pp->kdf.scheme = TPM2_ALG_NULL;
-    pp->scheme.scheme = TPM2_ALG_NULL;
-    pp->symmetric.algorithm = TPM2_ALG_NULL;
-    pp->scheme.details.anySig.hashAlg = TPM2_ALG_NULL;
 
-    /* NULL out sym details */
+    /*
+     * If the scheme is not TPM2_ALG_ERROR (0),
+     * its a valid scheme so don't set it to NULL scheme
+     */
+    if (pp->scheme.scheme == TPM2_ALG_ERROR) {
+        pp->scheme.scheme = TPM2_ALG_NULL;
+        pp->scheme.details.anySig.hashAlg = TPM2_ALG_NULL;
+    }
+
+    /* NULL out sym details if not already set */
     TPMT_SYM_DEF_OBJECT *sym = &pp->symmetric;
-    sym->algorithm = TPM2_ALG_NULL;
-    sym->keyBits.sym = 0;
-    sym->mode.sym = TPM2_ALG_NULL;
+    if (sym->algorithm == TPM2_ALG_ERROR) {
+        sym->algorithm = TPM2_ALG_NULL;
+        sym->keyBits.sym = 0;
+        sym->mode.sym = TPM2_ALG_NULL;
+    }
 
     result = true;
-
 out:
-    if (x) {
-        BN_free(x);
-    }
-    if (y) {
-        BN_free(y);
-    }
-
+    BN_free(x);
+    BN_free(y);
     return result;
 }
 
-EC_KEY *tpm2_openssl_get_public_ECC_from_pem(FILE *f, const char *path) {
-
-    EC_KEY *pub = PEM_read_EC_PUBKEY(f, NULL, NULL, NULL);
-    if (!pub) {
-        ERR_print_errors_fp(stderr);
-        LOG_ERR("Reading public PEM file \"%s\" failed", path);
-        return NULL;
-    }
-
-    return pub;
-}
-
 static bool load_public_ECC_from_pem(FILE *f, const char *path,
         TPM2B_PUBLIC *pub) {
 
-    EC_KEY *k = tpm2_openssl_get_public_ECC_from_pem(f, path);
+    EVP_PKEY *k = PEM_read_PUBKEY(f, NULL, NULL, NULL);
     if (!k) {
         ERR_print_errors_fp(stderr);
         LOG_ERR("Reading PEM file \"%s\" failed", path);
         return false;
     }
 
-    bool result = load_public_ECC_from_key(k, pub);
+    bool result = false;
+    if (EVP_PKEY_base_id(k) == EVP_PKEY_EC) {
+        result = load_public_ECC_from_key(k, pub);
+    }
 
-    EC_KEY_free(k);
+    EVP_PKEY_free(k);
 
     return result;
 }
@@ -1002,14 +913,67 @@
     return tpm2_util_calc_unique(name_alg, key, seed, unique);
 }
 
-static bool load_private_RSA_from_key(RSA *k, TPM2B_SENSITIVE *priv) {
+static bool load_public_SM4_from_file(FILE *f, const char *path,
+        TPM2B_PUBLIC *pub, TPM2B_SENSITIVE *priv) {
 
-    const BIGNUM *p; /* the private key exponent */
+    /*
+     * Get the file size and validate that it is the proper AES keysize.
+     */
+    unsigned long file_size = 0;
+    bool result = files_get_file_size(f, &file_size, path);
+    if (!result) {
+        return false;
+    }
 
-#if defined(LIB_TPM2_OPENSSL_OPENSSL_PRE11)
-    p = k->p;
-#else
+    result = tpm2_alg_util_is_sm4_size_valid(file_size);
+    if (!result) {
+        return false;
+    }
+
+    pub->publicArea.type = TPM2_ALG_SYMCIPHER;
+    TPMT_SYM_DEF_OBJECT *s = &pub->publicArea.parameters.symDetail.sym;
+    s->algorithm = TPM2_ALG_SM4;
+    s->keyBits.sm4 = file_size * 8;
+
+    /* allow any mode later on */
+    s->mode.sm4 = TPM2_ALG_NULL;
+
+    /*
+     * Calculate the unique field with is the
+     * is HMAC(sensitive->seedValue, sensitive->sensitive(key itself))
+     * Where:
+     *   - HMAC Key is the seed
+     *   - Hash algorithm is the name algorithm
+     */
+    TPM2B_DIGEST *unique = &pub->publicArea.unique.sym;
+    TPM2B_DIGEST *seed = &priv->sensitiveArea.seedValue;
+    TPM2B_PRIVATE_VENDOR_SPECIFIC *key = &priv->sensitiveArea.sensitive.any;
+    TPMI_ALG_HASH name_alg = pub->publicArea.nameAlg;
+
+    return tpm2_util_calc_unique(name_alg, key, seed, unique);
+}
+
+
+static bool load_private_RSA_from_key(EVP_PKEY *key, TPM2B_SENSITIVE *priv) {
+
+    bool result = false;
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    const BIGNUM *p = NULL; /* the private key exponent */
+
+    RSA *k = EVP_PKEY_get0_RSA(key);
+    if (!k) {
+        LOG_ERR("Could not retrieve RSA key");
+        goto out;
+    }
     RSA_get0_factors(k, &p, NULL);
+#else
+    BIGNUM *p = NULL; /* the private key exponent */
+
+    int rc = EVP_PKEY_get_bn_param(key, OSSL_PKEY_PARAM_RSA_FACTOR1, &p);
+    if (!rc) {
+        LOG_ERR("Could not read private key");
+        goto out;
+    }
 #endif
 
     TPMT_SENSITIVE *sa = &priv->sensitiveArea;
@@ -1022,7 +986,7 @@
     if (priv_bytes > sizeof(pkr->buffer)) {
         LOG_ERR("Expected prime \"d\" to be less than or equal to %zu,"
                 " got: %u", sizeof(pkr->buffer), priv_bytes);
-        return false;
+        goto out;
     }
 
     pkr->size = priv_bytes;
@@ -1031,10 +995,16 @@
     if (!success) {
         ERR_print_errors_fp(stderr);
         LOG_ERR("Could not copy private exponent \"d\"");
-        return false;
+        goto out;
     }
-
-    return true;
+    result = true;
+out:
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    /* k,p point to internal structrues and must not be freed after use */
+#else
+    BN_free(p);
+#endif
+    return result;
 }
 
 bool tpm2_openssl_load_public(const char *path, TPMI_ALG_PUBLIC alg,
@@ -1057,8 +1027,7 @@
         break;
         /* Skip AES here, as we can only load this one from a private file */
     default:
-        /* default try TSS */
-        result = files_load_public(path, pub);
+        LOG_ERR("Unkown public format: 0x%x", alg);
     }
 
     fclose(f);
@@ -1066,8 +1035,9 @@
     return result;
 }
 
-static bool load_private_ECC_from_key(EC_KEY *k, TPM2B_SENSITIVE *priv) {
+static bool load_private_ECC_from_key(EVP_PKEY *key, TPM2B_SENSITIVE *priv) {
 
+    bool result = false;
     /*
      * private data
      */
@@ -1075,22 +1045,45 @@
 
     TPM2B_ECC_PARAMETER *p = &priv->sensitiveArea.sensitive.ecc;
 
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    EC_KEY *k = EVP_PKEY_get0_EC_KEY(key);
+    if (!k) {
+        LOG_ERR("Could not retrieve ECC key");
+        goto out;
+    }
+
     const EC_GROUP *group = EC_KEY_get0_group(k);
     const BIGNUM *b = EC_KEY_get0_private_key(k);
-
     unsigned priv_bytes = (EC_GROUP_get_degree(group) + 7) / 8;
+#else
+    BIGNUM *b = NULL; /* the private key exponent */
+
+    int rc = EVP_PKEY_get_bn_param(key, OSSL_PKEY_PARAM_PRIV_KEY, &b);
+    if (!rc) {
+        LOG_ERR("Could not read ECC private key");
+        goto out;
+    }
+    unsigned priv_bytes = (EVP_PKEY_bits(key) + 7) / 8;
+#endif
+
     if (priv_bytes > sizeof(p->buffer)) {
         LOG_ERR("Expected ECC private portion to be less than or equal to %zu,"
                 " got: %u", sizeof(p->buffer), priv_bytes);
-        return false;
+        goto out;
     }
 
     p->size = BN_bn2binpad(b, p->buffer, priv_bytes);
     if (p->size != priv_bytes) {
-        return false;
+        goto out;
     }
-
-    return true;
+    result = true;
+out:
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+    /* k,b point to internal structrues and must not be freed after use */
+#else
+    BN_free(b);
+#endif
+    return result;
 }
 
 static tpm2_openssl_load_rc load_private_ECC_from_pem(FILE *f, const char *path,
@@ -1104,8 +1097,7 @@
         return lprc_error;
     }
 
-    EC_KEY *k = PEM_read_ECPrivateKey(f, NULL,
-    NULL, (void *) pass);
+    EVP_PKEY *k = PEM_read_PrivateKey(f, NULL, NULL, (void *) pass);
     free(pass);
     if (!k) {
         ERR_print_errors_fp(stderr);
@@ -1130,14 +1122,14 @@
     rc |= lprc_public;
 
 out:
-    EC_KEY_free(k);
+    EVP_PKEY_free(k);
     return rc;
 }
 
 static tpm2_openssl_load_rc load_private_RSA_from_pem(FILE *f, const char *path,
         const char *passin, TPM2B_PUBLIC *pub, TPM2B_SENSITIVE *priv) {
 
-    RSA *k = NULL;
+    EVP_PKEY *k = NULL;
 
     tpm2_openssl_load_rc rc = lprc_error;
 
@@ -1147,8 +1139,7 @@
         return lprc_error;
     }
 
-    k = PEM_read_RSAPrivateKey(f, NULL,
-    NULL, (void *) pass);
+    k = PEM_read_PrivateKey(f, NULL, NULL, (void *) pass);
     free(pass);
     if (!k) {
         ERR_print_errors_fp(stderr);
@@ -1170,7 +1161,7 @@
         rc |= lprc_public;
     }
 out:
-    RSA_free(k);
+    EVP_PKEY_free(k);
     return rc;
 }
 
@@ -1206,56 +1197,219 @@
     return lprc_private | lprc_public;
 }
 
-/**
- * Loads a private portion of a key, and possibly the public portion, as for RSA the public data is in
- * a private pem file.
- *
- * @param path
- *  The path to load from.
- * @param alg
- *  algorithm type to import.
- * @param pub
- *  The public structure to populate. Note that nameAlg must be populated.
- * @param priv
- *  The sensitive structure to populate.
- *
- * @returns
- *  A private object loading status
- */
+static tpm2_openssl_load_rc load_private_SM4_from_file(FILE *f,
+        const char *path, TPM2B_PUBLIC *pub, TPM2B_SENSITIVE *priv) {
+
+    unsigned long file_size = 0;
+    bool result = files_get_file_size(f, &file_size, path);
+    if (!result) {
+        return lprc_error;
+    }
+
+    result = tpm2_alg_util_is_sm4_size_valid(file_size);
+    if (!result) {
+        return lprc_error;
+    }
+
+    priv->sensitiveArea.sensitiveType = TPM2_ALG_SYMCIPHER;
+
+    TPM2B_SYM_KEY *s = &priv->sensitiveArea.sensitive.sym;
+    s->size = file_size;
+
+    result = files_read_bytes(f, s->buffer, s->size);
+    if (!result) {
+        return lprc_error;
+    }
+
+    result = load_public_SM4_from_file(f, path, pub, priv);
+    if (!result) {
+        return lprc_error;
+    }
+
+    return lprc_private | lprc_public;
+}
+
+static tpm2_openssl_load_rc load_private_KEYEDHASH_from_file(FILE *f,
+        const char *path, TPM2B_PUBLIC *pub, TPM2B_SENSITIVE *priv) {
+
+    unsigned long file_size = 0;
+    bool result = files_get_file_size(f, &file_size, path);
+    if (!result) {
+        return lprc_error;
+    }
+
+    priv->sensitiveArea.sensitiveType = TPM2_ALG_KEYEDHASH;
+
+    size_t max_size = pub->publicArea.parameters.keyedHashDetail.scheme.scheme == TPM2_ALG_NULL ?
+            KEYEDHASH_MAX_SIZE : HMAC_MAX_SIZE;
+    if (file_size > max_size || file_size == 0) {
+      LOG_ERR("Invalid %s key size, got %lu bytes, expected 1 to 128 bytes",
+                tpm2_alg_util_algtostr(
+                    pub->publicArea.parameters.keyedHashDetail.scheme.scheme,
+                    tpm2_alg_util_flags_any), file_size);
+      return lprc_error;
+    }
+
+    TPM2B_SENSITIVE_DATA *b = &priv->sensitiveArea.sensitive.bits;
+    b->size = file_size;
+
+    result = files_read_bytes(f, b->buffer, b->size);
+    if (!result) {
+        return lprc_error;
+    }
+
+    /*
+     * calculate the unique and we're done, this is the only thing left for public
+     * so no need for another function.
+     */
+    TPM2B_DIGEST *unique = &pub->publicArea.unique.keyedHash;
+    TPM2B_DIGEST *seed = &priv->sensitiveArea.seedValue;
+    TPM2B_PRIVATE_VENDOR_SPECIFIC *key = &priv->sensitiveArea.sensitive.any;
+    TPMI_ALG_HASH name_alg = pub->publicArea.nameAlg;
+
+    result = tpm2_util_calc_unique(name_alg, key, seed, unique);
+    if (!result) {
+        return lprc_error;
+    }
+
+    return lprc_private | lprc_public;
+}
+
 tpm2_openssl_load_rc tpm2_openssl_load_private(const char *path,
-        const char *pass, TPMI_ALG_PUBLIC alg, TPM2B_PUBLIC *pub,
+        const char *passin, const char *object_auth, TPM2B_PUBLIC *template, TPM2B_PUBLIC *pub,
         TPM2B_SENSITIVE *priv) {
 
+
     FILE *f = fopen(path, "r");
     if (!f) {
         LOG_ERR("Could not open file \"%s\", error: %s", path, strerror(errno));
         return 0;
     }
 
+    *pub = *template;
+
     tpm2_openssl_load_rc rc = lprc_error;
 
-    switch (alg) {
+    switch (template->publicArea.type) {
     case TPM2_ALG_RSA:
-        rc = load_private_RSA_from_pem(f, path, pass, pub, priv);
+        rc = load_private_RSA_from_pem(f, path, passin, pub, priv);
         break;
-    case TPM2_ALG_AES:
-        if (pass) {
+    case TPM2_ALG_SYMCIPHER:
+        if (passin) {
             LOG_ERR("No password can be used for protecting AES key");
             rc = lprc_error;
-        } else {
+        } else if (template->publicArea.parameters.asymDetail.symmetric.algorithm == TPM2_ALG_AES) {
             rc = load_private_AES_from_file(f, path, pub, priv);
+        } else if (template->publicArea.parameters.asymDetail.symmetric.algorithm == TPM2_ALG_SM4) {
+            rc = load_private_SM4_from_file(f, path, pub, priv);
+        } else {
+            LOG_ERR("Cannot handle non-aes or non-sm4 symmetric objects, got: 0x%x",
+                    template->publicArea.parameters.asymDetail.symmetric.algorithm);
+            rc = lprc_error;
         }
         break;
+    case TPM2_ALG_HMAC:
+        /* falls-thru */
+    case TPM2_ALG_KEYEDHASH:
+        if (passin) {
+            LOG_ERR("No password can be used for protecting %s key",
+                    TPM2_ALG_HMAC ? "HMAC" : "Keyed Hash");
+            rc = lprc_error;
+        } else {
+            rc = load_private_KEYEDHASH_from_file(f, path, pub, priv);
+	}
+      break;
     case TPM2_ALG_ECC:
-        rc = load_private_ECC_from_pem(f, path, pass, pub, priv);
+        rc = load_private_ECC_from_pem(f, path, passin, pub, priv);
         break;
     default:
-        LOG_ERR("Cannot handle algorithm, got: %s", tpm2_alg_util_algtostr(alg,
+        LOG_ERR("Cannot handle algorithm, got: %s", tpm2_alg_util_algtostr(template->publicArea.type,
             tpm2_alg_util_flags_any));
         rc = lprc_error;
     }
 
     fclose(f);
 
+    if (object_auth) {
+        tpm2_session *tmp;
+        tool_rc tmp_rc = tpm2_auth_util_from_optarg(NULL, object_auth, &tmp, true);
+        if (tmp_rc != tool_rc_success) {
+            LOG_ERR("Invalid key authorization");
+            return false;
+        }
+
+        const TPM2B_AUTH *auth = tpm2_session_get_auth_value(tmp);
+        priv->sensitiveArea.authValue = *auth;
+
+        tpm2_session_close(&tmp);
+    }
+
     return rc;
 }
+
+bool tpm2_openssl_import_keys(
+        TPM2B_PUBLIC *parent_pub,
+        TPM2B_ENCRYPTED_SECRET *encrypted_seed,
+        const char *object_auth_value,
+        const char *input_key_file,
+        const char *passin,
+        TPM2B_PUBLIC *template,
+        TPM2B_SENSITIVE *out_private,
+        TPM2B_PUBLIC *out_public
+    ) {
+
+    bool result;
+
+    /*
+     * The TPM Requires that the name algorithm for the child be less than the name
+     * algorithm of the parent when the parent's scheme is NULL.
+     *
+     * This check can be seen in the simulator at:
+     *   - File: CryptUtil.c
+     *   - Func: CryptSecretDecrypt()
+     *   - Line: 2019
+     *   - Decription: Limits the size of the hash algorithm to less then the parent's name-alg when scheme is NULL.
+     */
+    UINT16 hash_size = tpm2_alg_util_get_hash_size(template->publicArea.nameAlg);
+    UINT16 parent_hash_size = tpm2_alg_util_get_hash_size(
+            parent_pub->publicArea.nameAlg);
+    if (hash_size > parent_hash_size) {
+        LOG_WARN("Hash selected is larger then parent hash size, coercing to "
+                 "parent hash algorithm: %s",
+                tpm2_alg_util_algtostr(parent_pub->publicArea.nameAlg,
+                        tpm2_alg_util_flags_hash));
+        template->publicArea.nameAlg = parent_pub->publicArea.nameAlg;
+    }
+
+    /*
+     * Generate and encrypt seed, if requested
+     */
+    if (encrypted_seed)
+    {
+        TPM2B_DIGEST *seed = &out_private->sensitiveArea.seedValue;
+        static const unsigned char label = { 'D', 'U', 'P', 'L', 'I', 'C', 'A', 'T', 'E', '\0' };
+        result = tpm2_identity_util_share_secret_with_public_key(seed, parent_pub,
+            label, sizeof(label), encrypted_seed);
+        if (!result) {
+            LOG_ERR("Failed Seed Encryption\n");
+            return false;
+        }
+    }
+
+    /*
+     * Populate all the private and public data fields we can based on the key type and the PEM files read in.
+     */
+    tpm2_openssl_load_rc status = tpm2_openssl_load_private(input_key_file,
+            passin, object_auth_value, template, out_public, out_private);
+    if (status == lprc_error) {
+        return false;
+    }
+
+    if (!tpm2_openssl_did_load_public(status)) {
+        LOG_ERR("Did not find public key information in file: \"%s\"",
+                input_key_file);
+        return false;
+    }
+
+    return true;
+}

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_openssl.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_openssl.h Changed

@@ -10,13 +10,10 @@
 #include <openssl/err.h>
 #include <openssl/hmac.h>
 #include <openssl/rsa.h>
+#include "config.h"
 
 #include "pcr.h"
 
-#if (OPENSSL_VERSION_NUMBER < 0x1010000fL && !defined(LIBRESSL_VERSION_NUMBER)) || (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20700000L) /* OpenSSL 1.1.0 */
-#define LIB_TPM2_OPENSSL_OPENSSL_PRE11
-#endif
-
 #if OPENSSL_VERSION_NUMBER >= 0x10101000L
 #define EC_POINT_set_affine_coordinates_tss(group, tpm_pub_key, bn_x, bn_y, dmy) \
         EC_POINT_set_affine_coordinates(group, tpm_pub_key, bn_x, bn_y, dmy)
@@ -32,29 +29,6 @@
         EC_POINT_get_affine_coordinates_GFp(group, tpm_pub_key, bn_x, bn_y, dmy)
 #endif /* OPENSSL_VERSION_NUMBER >= 0x10101000L */
 
-#if defined(LIB_TPM2_OPENSSL_OPENSSL_PRE11)
-int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
-void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q);
-int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s);
-#endif
-
-/**
- * Function prototype for a hashing routine.
- *
- * This is a wrapper around OSSL SHA256|384 and etc digesters.
- *
- * @param d
- *  The data to digest.
- * @param n
- *  The length of the data to digest.
- * @param md
- *  The output message digest.
- * @return
- * A pointer to the digest or NULL on error.
- */
-typedef unsigned char *(*digester)(const unsigned char *d, size_t n,
-        unsigned char *md);
-
 static inline const char *tpm2_openssl_get_err(void) {
     return ERR_error_string(ERR_get_error(), NULL);
 }
@@ -75,21 +49,7 @@
  * @return
  *  A pointer to a message digester or NULL on failure.
  */
-const EVP_MD *tpm2_openssl_halg_from_tpmhalg(TPMI_ALG_HASH algorithm);
-
-/**
- * Start an openssl hmac session.
- * @return
- *  A valid session pointer or NULL on error.
- */
-HMAC_CTX *tpm2_openssl_hmac_new();
-
-/**
- * Free an hmac context created via tpm2_openssl_hmac_new().
- * @param ctx
- *  The context to release resources of.
- */
-void tpm2_openssl_hmac_free(HMAC_CTX *ctx);
+const EVP_MD *tpm2_openssl_md_from_tpmhalg(TPMI_ALG_HASH algorithm);
 
 /**
  * Hash a byte buffer.
@@ -171,34 +131,6 @@
 bool tpm2_openssl_pcr_extend(TPMI_ALG_HASH halg, BYTE *pcr,
         const BYTE *data, UINT16 length);
 
-/**
- * Obtains an OpenSSL EVP_CIPHER_CTX dealing with version
- * API changes in OSSL.
- *
- * @return
- *  An Initialized OpenSSL EVP_CIPHER_CTX.
- */
-EVP_CIPHER_CTX *tpm2_openssl_cipher_new(void);
-
-/**
- * Free's an EVP_CIPHER_CTX obtained via tpm2_openssl_cipher_new()
- * dealing with OSSL API version changes.
- * @param ctx
- *  The EVP_CIPHER_CTX to free.
- */
-void tpm2_openssl_cipher_free(EVP_CIPHER_CTX *ctx);
-
-/**
- * Returns a function pointer capable of performing the
- * given digest from a TPMI_HASH_ALG.
- *
- * @param halg
- *  The hashing algorithm to use.
- * @return
- *  NULL on failure or a valid digester on success.
- */
-digester tpm2_openssl_halg_to_digester(TPMI_ALG_HASH halg);
-
 typedef enum tpm2_openssl_load_rc tpm2_openssl_load_rc;
 enum tpm2_openssl_load_rc {
     lprc_error = 0, /* an error has occurred */
@@ -222,21 +154,17 @@
 }
 
 /**
- * Loads a private portion of a key, and possibly the public portion.
- * For asymmetric algorithms the public data is in  private PEM file.
- * For symmetric keys, the file type is raw. For asymmetric keys, the
- * file type is a PEM file.
- *
- * This ONLY supports AES, ECC and RSA.
- *
- * It populates the sensitive seed with a random value for symmetric keys.
+ * Loads a private portion of a key, and possibly the public portion, as for RSA the public data is in
+ * a private pem file.
  *
  * @param path
  *  The path to load from.
- * @param path
- *  The passphrase for the input file.
- * @param alg
- *  algorithm type to import.
+ * @param passin
+ *  If the path needs a password to decrypt like a password protected OpenSSL PEM file.
+ * @param object_auth
+ *  The auth value to set for the object, may be NULL.
+ * @param template
+ *  The public template to use to construct the TPM objects.
  * @param pub
  *  The public structure to populate. Note that nameAlg must be populated.
  * @param priv
@@ -246,10 +174,25 @@
  *  A private object loading status
  */
 tpm2_openssl_load_rc tpm2_openssl_load_private(const char *path,
-        const char *pass, TPMI_ALG_PUBLIC alg, TPM2B_PUBLIC *pub,
+        const char *passin, const char *object_auth, TPM2B_PUBLIC *template, TPM2B_PUBLIC *pub,
         TPM2B_SENSITIVE *priv);
 
 /**
+ * Load an OpenSSL private key and configure all of the flags based on
+ * a parent key, policy, attributes, and authorization.
+ */
+bool tpm2_openssl_import_keys(
+    TPM2B_PUBLIC *parent_pub,
+    TPM2B_ENCRYPTED_SECRET *encrypted_seed,
+    const char *object_auth_value,
+    const char *input_key_file,
+    const char *passin,
+    TPM2B_PUBLIC *template,
+    TPM2B_SENSITIVE *private,
+    TPM2B_PUBLIC *public
+);
+
+/**
  * Loads a public portion of a key from a file. Files can be the raw key, in the case
  * of symmetric ciphers, or a PEM file.
  *
@@ -266,18 +209,6 @@
         TPM2B_PUBLIC *pub);
 
 /**
- * Retrieves a public portion of an ECC key from a PEM file.
- *
- * @param f
- *  The FILE object that is open for reading the path.
- * @param path
- *  The path to load from.
- * @return
- *  The public structure.
- */
-EC_KEY* tpm2_openssl_get_public_ECC_from_pem(FILE *f, const char *path);
-
-/**
  * Maps an ECC curve to an openssl nid value.
  * @param curve
  *  The curve to map.

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_options.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_options.c Changed

@@ -119,8 +119,6 @@
 static bool execute_man(char *prog_name, bool show_errors) {
 
     pid_t pid;
-    int status;
-
     if ((pid = fork()) < 0) {
         LOG_ERR("Could not fork process to execute man, error: %s",
                 strerror(errno));
@@ -129,7 +127,6 @@
 
     #define MAX_TOOL_NAME_LEN 64
     if (pid == 0) {
-
         if (!show_errors) {
             /* redirect manpager errors to stderr */
             int fd = open("/dev/null", O_WRONLY);
@@ -141,29 +138,45 @@
             close(fd);
         }
 
+        /*
+         * Handle the case where tpm2 is specified without tool-name or help
+         */
         const char *manpage = basename(prog_name);
-        if (!strcmp(manpage, "tpm2")) {
-            /*
-             * Handle the case where tpm2 is specified without tool-name or help
-             */
+        bool is_only_tpm2 = (strcmp(manpage, "tpm2") == 0);
+        if (is_only_tpm2) {
             execlp("man", "man", "tpm2", NULL);
-        } else if (strncmp(manpage, "tpm2_", strlen("tpm2_"))) {
-            /*
-             * Handle the case where the tool is specified as tpm2< >tool-name
-             */
-            char man_tool_nameMAX_TOOL_NAME_LEN = {'t','p','m','2','_'};
-            strncat(man_tool_name, manpage,
+        }
+
+        /*
+         * Handle the case where the tool is specified as tpm2< >tool-name
+         */
+        bool is_tpm2_space_toolname =
+            (strncmp(manpage, "tpm2_", strlen("tpm2_")) != 0);
+        if (is_tpm2_space_toolname) {
+            uint8_t toolname_len =
                 strlen(manpage) < (MAX_TOOL_NAME_LEN - strlen("tpm2_")) ?
-                    strlen(manpage) : (MAX_TOOL_NAME_LEN - strlen("tpm2_")));
+                strlen(manpage) : MAX_TOOL_NAME_LEN - strlen("tpm2_");
+
+            char man_tool_nameMAX_TOOL_NAME_LEN = {'t','p','m','2','_'};
+
+            strncat(man_tool_name, manpage, toolname_len);
             execlp("man", "man", man_tool_name, NULL);
-        } else {
-            /*
-             * Handle the case where the tool is specified as tpm2<_>tool-name
-             */
+        }
+
+        /*
+         * Handle the case where the tool is specified as tpm2<_>tool-name
+         */
+        bool is_tpm2_underscore_toolname =
+            (!is_only_tpm2 && !is_tpm2_space_toolname);
+        if (is_tpm2_underscore_toolname) {
             execlp("man", "man", manpage, NULL);
         }
-    } else {
-        if (waitpid(pid, &status, 0) == -1) {
+    }
+
+    if (pid != 0) {
+        int status;
+        bool is_child_process_incomplete = (waitpid(pid, &status, 0) == -1);
+        if (is_child_process_incomplete) {
             LOG_ERR("Waiting for child process that executes man failed, error:"
                     " %s", strerror(errno));
             return false;
@@ -193,8 +206,7 @@
     unsigned int i;
     bool indent = true;
     char *command_copy;
-
-    if (!tool_opts) {
+    if (!tool_opts || !command) {
         return;
     }
 
@@ -234,16 +246,36 @@
     }
 }
 
-tpm2_option_code tpm2_handle_options(int argc, char **argv,
-        tpm2_options *tool_opts, tpm2_option_flags *flags,
-        TSS2_TCTI_CONTEXT **tcti) {
+static TSS2_RC tcti_fake_receive (TSS2_TCTI_CONTEXT *tctiContext, size_t *response_size,
+    unsigned char *response_buffer, int32_t timeout) {
 
-    tpm2_option_code rc = tpm2_option_code_err;
-    TSS2_RC rc_tcti;
-    bool result = false;
-    bool show_help = false;
-    bool manpager = true;
-    bool explicit_manpager = false;
+    (void) tctiContext;
+	(void) response_size;
+	(void) response_buffer;
+	(void) timeout;
+
+    LOG_ERR("Fake tcti's receive invoked. You shouldn't be here!");
+	return TSS2_TCTI_RC_NOT_IMPLEMENTED;
+}
+
+static void tcti_fake_finalize (TSS2_TCTI_CONTEXT *tctiContext) {
+	(void) tctiContext;
+}
+
+static TSS2_RC tcti_fake_transmit (TSS2_TCTI_CONTEXT *tcti_ctx, size_t size,
+    const uint8_t *cmd_buf) {
+
+	(void) tcti_ctx;
+	(void) size;
+	(void) cmd_buf;
+
+    LOG_ERR("Fake tcti's transmit invoked. You shouldn't be here!");
+	return TSS2_TCTI_RC_NOT_IMPLEMENTED;
+}
+
+tpm2_option_code tpm2_handle_options(int argc, char **argv,
+    tpm2_options *tool_opts, tpm2_option_flags *flags,
+    TSS2_TCTI_CONTEXT **tcti) {
 
     /*
      * Handy way to *try* and find all used options:
@@ -258,7 +290,6 @@
         { "enable-errata", no_argument,       NULL, 'Z' },
     };
 
-    const char *tcti_conf_option = NULL;
 
     /* handle any options */
     const char* common_short_opts = "T:h::vVQZ";
@@ -269,27 +300,35 @@
     }
 
     /* Get the options from the tool */
+    bool show_help = false;
+    tpm2_option_code rc = tpm2_option_code_continue;
+    bool result = false;
     if (tool_opts) {
         result = tpm2_options_cat(&opts, tool_opts);
         if (!result) {
+            rc = tpm2_option_code_err;
             goto out;
         }
     }
 
-    optind = 1;
-
     /* Parse the options, calling the tool callback if unknown */
+    const char *tcti_conf_option = NULL;
+    optind = 1;
     int c;
+    bool manpager = true;
+    bool explicit_manpager = false;
     while ((c = getopt_long(argc, argv, opts->short_opts, opts->long_opts, NULL))
             != -1) {
         switch (c) {
         case 'T':
             if (opts->flags & TPM2_OPTIONS_NO_SAPI) {
                 LOG_ERR("%s: tool doesn't support the TCTI option", argv0);
+                rc = tpm2_option_code_err;
                 goto out;
             }
             /* only attempt to get options from tcti option string */
             tcti_conf_option = optarg;
+            flags->tcti_none = !strcmp(tcti_conf_option, "none");
             break;
         case 'h':
             show_help = true;
@@ -300,7 +339,7 @@
             if (argvoptind - 1) {
                 if (!strcmp(argvoptind - 1, "--help=no-man") ||
                     !strcmp(argvoptind - 1, "-h=no-man") ||
-                    (argvoptind && !strcmp(argvoptind, "no-man"))) {
+                    (argc < optind && !strcmp(argvoptind, "no-man"))) {
                     manpager = false;
                     optind++;
                 /*
@@ -309,7 +348,7 @@
                  */
                 } else if (!strcmp(argvoptind - 1, "--help=man") ||
                            !strcmp(argvoptind - 1, "-h=man") ||
-                           (argvoptind && !strcmp(argvoptind, "man"))) {
+                           (argc < optind && !strcmp(argvoptind, "man"))) {
                     manpager = true;
                     explicit_manpager = true;
                     optind++;
@@ -318,7 +357,7 @@
                      * argv0 = "tool name"
                      * argv1 = "--help" argv2 = 0
                      */
-                    if (!argvoptind && argc == 2) {
+                    if (optind >= argc && argc == 2) {
                         manpager = false;
                     } else {
                         /*
@@ -329,8 +368,8 @@
                     }
                 }
             }
+            rc = tpm2_option_code_err;
             goto out;
-            break;
         case 'V':
             flags->verbose = 1;
             break;
@@ -346,15 +385,18 @@
             flags->enable_errata = 1;
             break;
         case '?':
+            rc = tpm2_option_code_err;
             goto out;
         default:
             /* NULL on_opt handler and unknown option specified is an error */
             if (!tool_opts || !tool_opts->callbacks.on_opt) {
                 LOG_ERR("Unknown option found: %c", c);
+                rc = tpm2_option_code_err;
                 goto out;
             }
             result = tool_opts->callbacks.on_opt(c, optarg);
             if (!result) {
+                rc = tpm2_option_code_err;
                 goto out;
             }
         }
@@ -367,47 +409,114 @@
     if (tool_argc && (!tool_opts || !tool_opts->callbacks.on_arg)) {
         LOG_ERR("Got arguments but the tool takes no arguments");
         show_help = true;
+        rc = tpm2_option_code_err;
         goto out;
     }
     /* have args and a handler to process */
     else if (tool_argc && tool_opts->callbacks.on_arg) {
         result = tool_opts->callbacks.on_arg(tool_argc, tool_args);
         if (!result) {
+            rc = tpm2_option_code_err;
             goto out;
         }
     }
 
     /* Only init a TCTI if the tool needs it and if the -h/--help option isn't present */
+    TSS2_RC rc_tcti;
     if (!show_help) {
 
-        /* tool doesn't request a sapi, don't initialize one */
-        if (!tool_opts || !(tool_opts->flags & TPM2_OPTIONS_NO_SAPI)) {
-
-            if (tcti_conf_option == NULL)
-                tcti_conf_option = tpm2_util_getenv(TPM2TOOLS_ENV_TCTI);
-            else if (!strcmp(tcti_conf_option, "none")) {
-                if (!tool_opts
-                        || !(tool_opts->flags & TPM2_OPTIONS_OPTIONAL_SAPI)) {
-                    LOG_ERR("Requested no tcti, but tool requires TCTI.");
-                    goto out;
-                }
-                goto none;
+        /*
+         * Cases to handle:
+         * SAPI 0 | NO_SAPI 1 | OPTIONAL_SAPI 2 | FAKE_TCTI 4
+         */
+
+        /*
+         * SAPI
+         */
+        bool is_sapi =
+            (!tool_opts || !tool_opts->flags);
+
+        /*
+         * NO_SAPI
+         */
+        bool is_no_sapi =
+            (tool_opts && tool_opts->flags & TPM2_OPTIONS_NO_SAPI);
+        /* tool doesn't use sapi, skip tcti checks and continue */
+        if (is_no_sapi) {
+            if (flags->tcti_none && !flags->quiet) {
+                LOG_WARN("Tool does not use SAPI. Continuing with tcti=none");
             }
-            rc_tcti = Tss2_TctiLdr_Initialize(tcti_conf_option, tcti);
-            if (rc_tcti != TSS2_RC_SUCCESS || !*tcti) {
-                LOG_ERR("Could not load tcti, got: \"%s\"", tcti_conf_option);
-                goto out;
+            goto out;
+        }
+
+        /*
+         * OPTIONAL_SAPI
+         */
+        bool is_optional_sapi =
+            (tool_opts && tool_opts->flags & TPM2_OPTIONS_OPTIONAL_SAPI);
+
+        /*
+         * Actions when tcti is "none"
+         */
+        bool is_tcti_from_env =
+            (!is_no_sapi && tcti_conf_option == 0);
+        if (is_tcti_from_env) {
+            tcti_conf_option = tpm2_util_getenv(TPM2TOOLS_ENV_TCTI);
+        }
+
+        if (flags->tcti_none && is_sapi) {
+            LOG_ERR("Requested no tcti, but tool requires TCTI.");
+            rc = tpm2_option_code_err;
+            goto out;
+        }
+
+        /* tool doesn't request a sapi, don't initialize one */
+        if (flags->tcti_none && is_optional_sapi) {
+            if (!flags->quiet) {
+                LOG_WARN("Tool optionally uses SAPI. Continuing with tcti=none");
             }
-            /*
-             * no loader requested ie --tcti=none is an error if tool
-             * doesn't indicate an optional SAPI
-             */
-            if (!flags->enable_errata) {
-                flags->enable_errata = !!tpm2_util_getenv(
-                        TPM2TOOLS_ENV_ENABLE_ERRATA);
+            goto none;
+        }
+
+        /*
+         * FAKE_TCTI
+         */
+        /* tool doesn't request a sapi but instead requires a fake tcti*/
+        #define TCTI_FAKE_MAGIC 0x09b366943a311b04ULL
+        static const TSS2_TCTI_CONTEXT_COMMON_V1 fake_tcti = {
+            .magic = TCTI_FAKE_MAGIC,
+            .version = 1,
+            .transmit = tcti_fake_transmit,
+            .receive = tcti_fake_receive,
+            .finalize = tcti_fake_finalize
+        };
+
+        bool is_optional_fake_tcti = (flags->tcti_none && tool_opts &&
+            tool_opts->flags & TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI);
+        if (is_optional_fake_tcti) {
+            if (!flags->quiet) {
+                LOG_WARN("Tool optionally uses SAPI. Continuing with tcti=fake");
             }
+            *tcti = (TSS2_TCTI_CONTEXT *)&fake_tcti;
+            goto none;
+        }
+
+        rc_tcti = Tss2_TctiLdr_Initialize(tcti_conf_option, tcti);
+        if (rc_tcti != TSS2_RC_SUCCESS || !*tcti) {
+            LOG_ERR("Could not load tcti, got: \"%s\"", tcti_conf_option);
+            rc = tpm2_option_code_err;
+            goto out;
+        }
+        /*
+         * no loader requested ie --tcti=none is an error if tool
+         * doesn't indicate an optional SAPI
+         */
+        if (!flags->enable_errata) {
+            flags->enable_errata = !!tpm2_util_getenv(
+                    TPM2TOOLS_ENV_ENABLE_ERRATA);
         }
     }
+
 none:
     rc = tpm2_option_code_continue;
 out:
@@ -430,7 +539,10 @@
         if (!did_manpager) {
             tpm2_print_usage(argv0, tool_opts);
         }
-        if (tcti_conf_option && strcmp(tcti_conf_option, "none")) {
+
+        bool is_tcti_not_none = tcti_conf_option ?
+            (strcmp(tcti_conf_option, "none") != 0) : false;
+        if (is_tcti_not_none) {
             TSS2_TCTI_INFO *info = NULL;
             rc_tcti = Tss2_TctiLdr_GetInfo(tcti_conf_option, &info);
             if (rc_tcti == TSS2_RC_SUCCESS && info) {

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_options.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_options.h Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_policy.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_policy.c Changed

@@ -6,6 +6,7 @@
 
 #include "files.h"
 #include "log.h"
+#include "tool_rc.h"
 #include "tpm2.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_openssl.h"
@@ -144,7 +145,7 @@
         // Read PCRs
         tool_rc rc = tpm2_pcr_read(ectx, ESYS_TR_NONE, ESYS_TR_NONE,
                 ESYS_TR_NONE, pcr_selections, &pcr_update_counter,
-                NULL, &pcr_val);
+                NULL, &pcr_val, NULL, TPM2_ALG_ERROR);
         if (rc != tool_rc_success) {
             return rc;
         }
@@ -174,7 +175,8 @@
 tool_rc tpm2_policy_build_policyauthorize(ESYS_CONTEXT *ectx,
         tpm2_session *policy_session, const char *policy_digest_path,
         const char *qualifying_data,
-        const char *verifying_pubkey_name_path, const char *ticket_path) {
+        const char *verifying_pubkey_name_path, const char *ticket_path,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
 
     bool result = true;
     TPM2B_DIGEST approved_policy = { .size = 0 };
@@ -236,7 +238,7 @@
     ESYS_TR sess_handle = tpm2_session_get_handle(policy_session);
     return tpm2_policy_authorize(ectx, sess_handle, ESYS_TR_NONE, ESYS_TR_NONE,
             ESYS_TR_NONE, &approved_policy, &policy_qualifier, &key_sign,
-            &check_ticket);
+            &check_ticket, cp_hash, parameter_hash_algorithm);
 }
 
 tool_rc tpm2_policy_build_policyor(ESYS_CONTEXT *ectx,
@@ -248,12 +250,13 @@
 }
 
 tool_rc tpm2_policy_build_policypassword(ESYS_CONTEXT *ectx,
-        tpm2_session *session) {
+        tpm2_session *session, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR policy_session_handle = tpm2_session_get_handle(session);
 
     return tpm2_policy_password(ectx, policy_session_handle, ESYS_TR_NONE,
-            ESYS_TR_NONE, ESYS_TR_NONE);
+            ESYS_TR_NONE, ESYS_TR_NONE, cp_hash, parameter_hash_algorithm);
 }
 
 tool_rc tpm2_policy_build_policynamehash(ESYS_CONTEXT *ectx,
@@ -281,19 +284,21 @@
 }
 
 tool_rc tpm2_policy_build_policyauthvalue(ESYS_CONTEXT *ectx,
-        tpm2_session *session) {
+        tpm2_session *session, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR policy_session_handle = tpm2_session_get_handle(session);
 
     return tpm2_policy_authvalue(ectx, policy_session_handle, ESYS_TR_NONE,
-            ESYS_TR_NONE, ESYS_TR_NONE);
+            ESYS_TR_NONE, ESYS_TR_NONE, cp_hash, parameter_hash_algorithm);
 }
 
 tool_rc tpm2_policy_build_policysecret(ESYS_CONTEXT *ectx,
         tpm2_session *policy_session, tpm2_loaded_object *auth_entity_obj,
         INT32 expiration, TPMT_TK_AUTH **policy_ticket,
         TPM2B_TIMEOUT **timeout, bool is_nonce_tpm,
-        const char *policy_qualifier_data, TPM2B_DIGEST *cp_hash) {
+        const char *policy_qualifier_data, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm) {
 
     /*
      * Qualifier data is optional. If not specified default to 0
@@ -322,7 +327,7 @@
 
     rc = tpm2_policy_secret(ectx, auth_entity_obj, policy_session_handle,
         expiration, policy_ticket, timeout, nonce_tpm, &policy_qualifier,
-        cp_hash);
+        cp_hash, parameter_hash_algorithm);
 
 tpm2_policy_build_policysecret_out:
     Esys_Free(nonce_tpm);
@@ -490,39 +495,43 @@
 }
 
 tool_rc tpm2_policy_get_digest(ESYS_CONTEXT *ectx, tpm2_session *session,
-        TPM2B_DIGEST **policy_digest) {
+    TPM2B_DIGEST **policy_digest, TPM2B_DIGEST *cphash,
+    TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR handle = tpm2_session_get_handle(session);
 
     return tpm2_policy_getdigest(ectx, handle, ESYS_TR_NONE, ESYS_TR_NONE,
-            ESYS_TR_NONE, policy_digest);
+            ESYS_TR_NONE, policy_digest, cphash, parameter_hash_algorithm);
 }
 
 tool_rc tpm2_policy_build_policycommandcode(ESYS_CONTEXT *ectx,
-        tpm2_session *session, uint32_t command_code) {
+        tpm2_session *session, uint32_t command_code, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR handle = tpm2_session_get_handle(session);
 
     return tpm2_policy_command_code(ectx, handle, ESYS_TR_NONE, ESYS_TR_NONE,
-            ESYS_TR_NONE, command_code);
+            ESYS_TR_NONE, command_code, cp_hash, parameter_hash_algorithm);
 }
 
-tool_rc tpm2_policy_build_policynvwritten(ESYS_CONTEXT *ectx,
-        tpm2_session *session, TPMI_YES_NO written_set) {
+tool_rc  tpm2_policy_build_policynvwritten(ESYS_CONTEXT *ectx,
+        tpm2_session *session, TPMI_YES_NO written_set, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR handle = tpm2_session_get_handle(session);
 
     return tpm2_policy_nv_written(ectx, handle, ESYS_TR_NONE, ESYS_TR_NONE,
-            ESYS_TR_NONE, written_set);
+            ESYS_TR_NONE, written_set, cp_hash, parameter_hash_algorithm);
 }
 
 tool_rc tpm2_policy_build_policylocality(ESYS_CONTEXT *ectx,
-        tpm2_session *session, TPMA_LOCALITY locality) {
+        tpm2_session *session, TPMA_LOCALITY locality, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR handle = tpm2_session_get_handle(session);
 
     return tpm2_policy_locality(ectx, handle, ESYS_TR_NONE, ESYS_TR_NONE,
-            ESYS_TR_NONE, locality);
+            ESYS_TR_NONE, locality, cp_hash, parameter_hash_algorithm);
 }
 
 tool_rc tpm2_policy_build_policyduplicationselect(ESYS_CONTEXT *ectx,
@@ -655,8 +664,9 @@
 tool_rc tpm2_policy_tool_finish(ESYS_CONTEXT *ectx, tpm2_session *session,
         const char *save_path) {
 
-    TPM2B_DIGEST *policy_digest = NULL;
-    tool_rc rc = tpm2_policy_get_digest(ectx, session, &policy_digest);
+    TPM2B_DIGEST *policy_digest = 0;
+    tool_rc rc = tpm2_policy_get_digest(ectx, session, &policy_digest, 0,
+        TPM2_ALG_ERROR);
     if (rc != tool_rc_success) {
         LOG_ERR("Could not build tpm policy");
         return rc;
@@ -682,3 +692,15 @@
     free(policy_digest);
     return rc;
 }
+
+tool_rc tpm2_policy_set_digest(const char *auth_policy, TPM2B_DIGEST *out_policy) {
+
+    if (!auth_policy) {
+        memset(out_policy, 0, sizeof(*out_policy));
+        return tool_rc_success;
+    }
+
+    out_policy->size = sizeof(out_policy->buffer);
+    bool res = tpm2_util_bin_from_hex_or_file(auth_policy, &out_policy->size, out_policy->buffer);
+    return res ? tool_rc_success : tool_rc_general_error;
+}

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_policy.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_policy.h Changed

@@ -51,7 +51,8 @@
 tool_rc tpm2_policy_build_policyauthorize(ESYS_CONTEXT *ectx,
         tpm2_session *policy_session, const char *policy_digest_path,
         const char *policy_qualifier,
-        const char *verifying_pubkey_name_path, const char *ticket_path);
+        const char *verifying_pubkey_name_path, const char *ticket_path,
+        TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm);
 
 /**
  * Compounds policies in an OR fashion
@@ -137,7 +138,8 @@
         tpm2_session *policy_session, tpm2_loaded_object *auth_entity_obj,
         INT32 expiration, TPMT_TK_AUTH **policy_ticket,
         TPM2B_TIMEOUT **timeout, bool is_nonce_tpm,
-        const char *policy_qualifier_path, TPM2B_DIGEST *cp_hash);
+        const char *policy_qualifier_path, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm);
 
 /**
  * Retrieves the policy digest for a session via PolicyGetDigest.
@@ -151,7 +153,8 @@
  *  tool_rc indicating status.
  */
 tool_rc tpm2_policy_get_digest(ESYS_CONTEXT *context, tpm2_session *session,
-        TPM2B_DIGEST **policy_digest);
+    TPM2B_DIGEST **policy_digest, TPM2B_DIGEST *cphash,
+    TPMI_ALG_HASH parameter_hash_algorithm);
 
 /**
  * Enables a policy that requires the object's authentication passphrase be
@@ -164,7 +167,8 @@
  *  tool_rc indicating status.
  */
 tool_rc tpm2_policy_build_policypassword(ESYS_CONTEXT *ectx,
-        tpm2_session *session);
+        tpm2_session *session, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm);
 
 /**
  * Enables a policy that requires the object's authvalue be provided.
@@ -177,7 +181,8 @@
  *  tool_rc indicating status.
  */
 tool_rc tpm2_policy_build_policyauthvalue(ESYS_CONTEXT *ectx,
-        tpm2_session *session);
+        tpm2_session *session, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm);
 
 /**
  * Enables a policy authorization by virtue of verifying a signature on optional
@@ -247,7 +252,8 @@
  *  A tool_rc indicating status.
  */
 tool_rc tpm2_policy_build_policycommandcode(ESYS_CONTEXT *ectx,
-        tpm2_session *session, uint32_t command_code);
+        tpm2_session *session, uint32_t command_code, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm);
 
 /**
  * Policy to restrict authorization to written state of the NV Index
@@ -262,7 +268,8 @@
  *  A tool_rc indicating status.
  */
 tool_rc tpm2_policy_build_policynvwritten(ESYS_CONTEXT *ectx,
-        tpm2_session *session, TPMI_YES_NO written_set);
+        tpm2_session *session, TPMI_YES_NO written_set, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm);
 
 /**
  * Policy to restrict tpm object authorization to specific locality
@@ -277,7 +284,8 @@
  *   A tool_rc indicating status.
  */
 tool_rc tpm2_policy_build_policylocality(ESYS_CONTEXT *ectx,
-        tpm2_session *session, TPMA_LOCALITY locality);
+        tpm2_session *session, TPMA_LOCALITY locality, TPM2B_DIGEST *cp_hash,
+        TPMI_ALG_HASH parameter_hash_algorithm);
 
 /**
  * Policy to restrict tpm object authorization to specific duplication target
@@ -318,4 +326,16 @@
 tool_rc tpm2_policy_tool_finish(ESYS_CONTEXT *ectx, tpm2_session *session,
         const char *save_path);
 
+/** Sets a TPM2B_DIGEST from a file if present or a hex string.
+ *
+ * @param auth_policy
+ *  Either a file path or a hex string. A NULL pointer causes out_policy to be memset
+ *  to 0.
+ * @param out_policy
+ *  The set policy
+ * @return
+ *  tool_rc_success on success, or any tool_rc failure on failure.
+ */
+tool_rc tpm2_policy_set_digest(const char *auth_policy, TPM2B_DIGEST *out_policy);
+
 #endif /* TPM2_POLICY_H_ */

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_session.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_session.c Changed

@@ -94,6 +94,10 @@
     data->path = path;
 }
 
+TPMI_ALG_HASH tpm2_session_data_get_authhash(tpm2_session_data *data) {
+    return data->auth_hash;
+}
+
 TPMI_ALG_HASH tpm2_session_get_authhash(tpm2_session *session) {
     return session->input->auth_hash;
 }
@@ -124,8 +128,7 @@
                     &session->input->nonce_caller : NULL;
 
     tool_rc rc = tpm2_start_auth_session(session->internal.ectx, d->key,
-            d->bind, ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, nonce,
-            d->session_type, &d->symmetric, d->auth_hash,
+            d->bind, nonce, d->session_type, &d->symmetric, d->auth_hash,
             &session->output.session_handle);
     if (rc != tool_rc_success) {
         return rc;
@@ -136,7 +139,7 @@
                 session->output.session_handle, d->attrs, 0xff);
         if (rc != tool_rc_success) {
             tool_rc tmp_rc = tpm2_flush_context(session->internal.ectx,
-                    session->output.session_handle);
+                    session->output.session_handle, NULL, TPM2_ALG_NULL);
             UNUSED(tmp_rc);
             return rc;
         }
@@ -145,7 +148,7 @@
     return tool_rc_success;
 }
 
-static void tpm2_session_free(tpm2_session **session) {
+void tpm2_session_free(tpm2_session **session) {
 
     tpm2_session *s = *session;
 
@@ -326,13 +329,7 @@
 
 tool_rc tpm2_session_close(tpm2_session **s) {
 
-    tpm2_session *session = *s;
-
-    FILE *session_file = NULL;
-
-    tool_rc rc = tool_rc_general_error;
-
-    if (!session) {
+    if (!*s) {
         return tool_rc_success;
     }
 
@@ -341,29 +338,26 @@
      *   - password sessions are implicit
      *   - hmac sessions live the life of the tool
      */
+    tool_rc rc = tool_rc_success;
+    tpm2_session *session = *s;
     if (session->output.session_handle == ESYS_TR_PASSWORD) {
-        rc = tool_rc_success;
-        goto out;
+        goto out2;
     }
 
-    bool flush = session->internal.is_final;
     const char *path = session->internal.path;
-    if (path) {
-        session_file = fopen(path, "w+b");
-        if (!session_file) {
-            LOG_ERR("Could not open path \"%s\", due to error: \"%s\"", path,
-                    strerror(errno));
-            goto out;
-        }
-    } else {
-        flush = true;
+    FILE *session_file = path ? fopen(path, "w+b") : NULL;
+    if (path && !session_file) {
+        LOG_ERR("Could not open path \"%s\", due to error: \"%s\"", path,
+                strerror(errno));
+        rc = tool_rc_general_error;
+        goto out;
     }
 
+    bool flush = path ? session->internal.is_final : true;
     if (flush) {
-
         rc = tpm2_flush_context(session->internal.ectx,
-                session->output.session_handle);
-        /* done use rc to inidcate status */
+                session->output.session_handle, NULL, TPM2_ALG_NULL);
+        /* done, use rc to indicate status */
         goto out;
     }
 
@@ -373,6 +367,7 @@
     bool result = files_write_header(session_file, SESSION_VERSION);
     if (!result) {
         LOG_ERR("Could not write context file header");
+        rc = tool_rc_general_error;
         goto out;
     }
 
@@ -382,6 +377,7 @@
             sizeof(session_type));
     if (!result) {
         LOG_ERR("Could not write session type");
+        rc = tool_rc_general_error;
         goto out;
     }
 
@@ -390,6 +386,7 @@
     result = files_write_16(session_file, hash);
     if (!result) {
         LOG_ERR("Could not write auth hash");
+        rc = tool_rc_general_error;
         goto out;
     }
 
@@ -399,29 +396,29 @@
      */
 
     ESYS_TR handle = tpm2_session_get_handle(session);
-
     LOG_INFO("Saved session: ESYS_TR(0x%x)", handle);
-
-    rc = files_save_tpm_context_to_file(session->internal.ectx,
-            tpm2_session_get_handle(session), session_file);
+    rc = files_save_tpm_context_to_file(session->internal.ectx, handle,
+    session_file);
     if (rc != tool_rc_success) {
         LOG_ERR("Could not write session context");
+        /* done, free session resources and use rc to indicate status */
     }
 
 out:
     if (session_file) {
         fclose(session_file);
     }
-
+out2:
     tpm2_session_free(s);
 
     return rc;
 }
 
-tool_rc tpm2_session_restart(ESYS_CONTEXT *context, tpm2_session *s) {
+tool_rc tpm2_session_restart(ESYS_CONTEXT *context, tpm2_session *s,
+    TPM2B_DIGEST *cp_hash, TPMI_ALG_HASH parameter_hash_algorithm) {
 
     ESYS_TR handle = tpm2_session_get_handle(s);
 
     return tpm2_policy_restart(context, handle, ESYS_TR_NONE, ESYS_TR_NONE,
-            ESYS_TR_NONE);
+            ESYS_TR_NONE, cp_hash, parameter_hash_algorithm);
 }

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_session.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_session.h Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_util.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_util.c Changed

@@ -6,6 +6,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <tss2/tss2_mu.h>
 
 #include "files.h"
 #include "log.h"
@@ -13,9 +14,12 @@
 #include "tpm2.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_attr_util.h"
+#include "tpm2_convert.h"
 #include "tpm2_openssl.h"
+#include "tpm2_session.h"
 #include "tpm2_tool.h"
 #include "tpm2_util.h"
+#include "tpm2_systemdeps.h"
 
 // verify that the quote digest equals the digest we calculated
 bool tpm2_util_verify_digests(TPM2B_DIGEST *quoteDigest,
@@ -45,11 +49,7 @@
         return false;
     }
 
-    if ((result->size + append->size) < result->size) {
-        return false;
-    }
-
-    if ((result->size + append->size) > TPM2_MAX_DIGEST_BUFFER) {
+    if (((UINT32)result->size + append->size) > TPM2_MAX_DIGEST_BUFFER) {
         return false;
     }
 
@@ -579,13 +579,20 @@
     memcpy(buf.buffer, seed->buffer, seed->size);
     memcpy(&buf.bufferseed->size, key->buffer, key->size);
 
-    digester d = tpm2_openssl_halg_to_digester(name_alg);
-    if (!d) {
+    const EVP_MD *md = tpm2_openssl_md_from_tpmhalg(name_alg);
+    if (!md) {
+        LOG_ERR("Algorithm not supported: %x", name_alg);
         return false;
     }
 
-    unique_data->size = tpm2_alg_util_get_hash_size(name_alg);
-    d(buf.buffer, buf.size, unique_data->buffer);
+    unsigned int hash_size;
+    int rc = EVP_Digest(buf.buffer, buf.size, unique_data->buffer, &hash_size,
+                        md, NULL);
+    if (!rc) {
+        LOG_ERR("Hash calculation failed");
+        return false;
+    }
+    unique_data->size = hash_size;
 
     return true;
 }
@@ -944,7 +951,7 @@
     // QNB ≔ HB (QNA || NAMEB)
     bool result = false;
 
-    const EVP_MD *md = tpm2_openssl_halg_from_tpmhalg(halg);
+    const EVP_MD *md = tpm2_openssl_md_from_tpmhalg(halg);
 
     EVP_MD_CTX *mdctx = EVP_MD_CTX_create();
     if (!mdctx) {
@@ -993,3 +1000,333 @@
     EVP_MD_CTX_destroy(mdctx);
     return result;
 }
+
+bool tpm2_safe_read_from_stdin(int length, char *data) {
+    int rc;
+
+    char *buf = malloc(length);
+    char *read_data = malloc(length);
+
+    if (buf == fgets(buf, length, stdin)) {
+        rc = sscanf(buf, "%s", read_data);
+        if (rc != 1) {
+            free(buf);
+            free(read_data);
+            return false;
+        }
+    }
+    else {
+        free(buf);
+        free(read_data);
+        return false;
+    }
+
+    strcpy(data, read_data);
+    free(buf);
+    free(read_data);
+    return true;
+}
+
+bool tpm2_pem_encoded_key_to_fingerprint(const char *pem_encoded_key,
+    char *fingerprint) {
+
+    bool is_pemkey_len_valid = strlen(pem_encoded_key) > 1024 ? false : true;
+    if (!is_pemkey_len_valid) {
+        return false;
+    }
+
+    char str1024 = "";
+    strcpy(str, pem_encoded_key);
+
+    /* walk through other tokens */
+    char base641024 = "";
+    char *token = strtok(str, "\n");
+    while ( token != NULL ) {
+        if (!strstr(token, "-----")) {
+            bool is_base64_overrun = (strlen(base64) + strlen(token)) > 1024 ?
+                true : false;
+            if (is_base64_overrun) {
+                return false;
+            }
+            strcat(base64, token);
+        }
+        token = strtok(NULL, "\n");
+    }
+
+    BYTE buffer1024;
+    size_t buffer_length = 0;
+    int rc = tpm2_base64_decode(base64, buffer, &buffer_length);
+    if(!rc){
+        LOG_ERR("%s", "tpm2_base64_decode");
+        return false;
+    }
+
+    TPM2B_DIGEST digest;
+    rc = tpm2_openssl_hash_compute_data(TPM2_ALG_SHA256, buffer,
+        buffer_length, &digest);
+    if(!rc){
+        LOG_ERR("%s", "tpm2_openssl_hash_compute_data");
+        return false;
+    }
+
+    rc = tpm2_base64_encode(buffer, buffer_length, base64);
+    if(!rc){
+        LOG_ERR("%s", "tpm2_base64_decode");
+        return false;
+    }
+    strcpy(fingerprint, "SHA256:");
+    strcat(fingerprint, base64);
+
+    fingerprintstrlen(fingerprint)-1 = 0; // remove trailing \n
+
+    return true;
+}
+
+#define MAX_SESSION_CNT 3
+tool_rc tpm2_util_aux_sessions_setup(ESYS_CONTEXT *ectx, uint8_t session_cnt,
+    const char **session_path, ESYS_TR *session_handle,
+    tpm2_session **session) {
+
+    /*
+     * If no aux sessions were specified, simply return.
+     */
+    if (!session_cnt) {
+        return tool_rc_success;
+    }
+
+    if (session_cnt > MAX_SESSION_CNT) {
+        LOG_ERR("A max of 3 sessions allowed");
+        return tool_rc_general_error;
+    }
+
+    uint8_t session_idx = 0;
+    for (session_idx = 0; session_idx < (session_cnt); session_idx++) {
+        if (session_pathsession_idx) {
+                tool_rc rc = tpm2_session_restore(ectx,
+                    session_pathsession_idx, false, &sessionsession_idx);
+            if (rc != tool_rc_success) {
+                LOG_ERR("Could not restore aux-session #%s",
+                session_pathsession_idx);
+                return rc;
+            }
+            session_handlesession_idx =
+                tpm2_session_get_handle(sessionsession_idx);
+        }
+    }
+
+    return tool_rc_success;
+}
+
+static TPMI_ALG_HASH calc_phash_alg_from_phash_path(const char **phash_path) {
+
+    if (!*phash_path) {
+        return TPM2_ALG_ERROR;
+    }
+
+    /*
+     * Expecting single token, so tokenize just once.
+     */
+    char *str = malloc(strlen(*phash_path) + 1);
+    strcpy(str, *phash_path);
+    char *token = strtok(str, ":");
+
+    TPMI_ALG_HASH hashalg = tpm2_alg_util_from_optarg(
+        token, tpm2_alg_util_flags_hash);
+    /*
+     * Adjust the pHash path to skip the <halg>:
+     */
+    if (hashalg != TPM2_ALG_ERROR) {
+        *phash_path += strlen(token) + 1;
+    }
+
+    free(str);
+    return hashalg;
+}
+
+static TPMI_ALG_HASH tpm2_util_calc_phash_algorithm_from_session_types(
+    ESYS_CONTEXT *ectx, tpm2_session **sessions) {
+
+    TPMI_ALG_HASH rethash = TPM2_ALG_ERROR;
+
+    size_t session_idx = 0;
+    for (session_idx = 0; session_idx < MAX_SESSION_CNT; session_idx++) {
+        if(!sessionssession_idx) {
+            continue;
+        }
+
+        /*
+         * Ignore password sessions
+         */
+        ESYS_TR session_handle = tpm2_session_get_handle(sessionssession_idx);
+        if(session_handle == ESYS_TR_PASSWORD) {
+            continue;
+        }
+
+        /*
+         * Ignore trial sessions
+         */
+        TPM2_SE session_type = tpm2_session_get_type(sessionssession_idx);
+        if (session_type != TPM2_SE_HMAC && session_type != TPM2_SE_POLICY) {
+            continue;
+        }
+
+        /*
+         * If this is an audit session, use that session halg.
+         * Note: Audit sessions are always HMAC type.
+         */
+        if (session_type == TPM2_SE_HMAC) {
+            TPMA_SESSION attrs = 0;
+            tool_rc tmp_rc = tpm2_sess_get_attributes(ectx, session_handle,
+                &attrs);
+            UNUSED(tmp_rc);
+
+            if (attrs & TPMA_SESSION_AUDIT) {
+                rethash = tpm2_session_get_authhash(sessionssession_idx);
+                break;
+            }
+        }
+
+        /*
+         * If no other sessions remain, simply use (policy)sessions halg.
+         */
+        rethash = tpm2_session_get_authhash(sessionssession_idx);
+    }
+
+    return rethash;
+}
+
+/*
+ * It should be noted that the auths aren't checked when calculating the pHash,
+ * instead the sessions are consumed to determine the pHash algorithm.
+ *
+ * 1. If phash_path is preceded with <halg>: use that as phash-halg return
+ * Otherwise
+ *
+ *  Consume session only if it is a policy-session or an hmac-session
+ *  1. If only hmac or policy session is specified, return that session's halg
+ *  2. If hmac-session with audit is specified, return that session's halg
+ *  3. If policy-session, then return policy-session's halg
+ *
+ * Otherwise
+ *  return SHA256
+ *
+ */
+TPMI_ALG_HASH tpm2_util_calculate_phash_algorithm(ESYS_CONTEXT *ectx,
+    const char **cphash_path, TPM2B_DIGEST *cp_hash, const char **rphash_path,
+    TPM2B_DIGEST *rp_hash, tpm2_session **sessions) {
+
+    /* <halg> specified in pHash path */
+    TPMI_ALG_HASH cphash_alg = cphash_path ? calc_phash_alg_from_phash_path(
+        cphash_path) : TPM2_ALG_ERROR;
+
+    TPMI_ALG_HASH rphash_alg = rphash_path ? calc_phash_alg_from_phash_path(
+        rphash_path) : TPM2_ALG_ERROR;
+    /*
+     * Default to cphash_alg if both are specified.
+     * This removes the conflict if cphash_alg and rphash_alg don't match.
+     * This also sets the cphash_alg if only rphash_alg is specified and vice
+     * versa.
+     */
+    TPMI_ALG_HASH phash_alg = cphash_alg != TPM2_ALG_ERROR ? cphash_alg :
+        (rphash_alg != TPM2_ALG_ERROR ? rphash_alg : TPM2_ALG_ERROR);
+
+    if (phash_alg != TPM2_ALG_ERROR) {
+        goto out;
+    }
+
+    /* <halg> determined from the sessions */
+    if (sessions) {
+        phash_alg = tpm2_util_calc_phash_algorithm_from_session_types(ectx,
+            sessions);
+    }
+
+out:
+    /* <halg> defaults to TPM2_ALG_SHA256 if cannot find from path or sessions */
+    if (phash_alg == TPM2_ALG_ERROR) {
+        phash_alg = TPM2_ALG_SHA256;
+    }
+
+    /*
+     * Side-effect: Set the size of the cp_hash and/or rp_hash
+     */
+    if (cphash_path && cp_hash) {
+        cp_hash->size = tpm2_alg_util_get_hash_size(phash_alg);
+    }
+
+    if (rphash_path && rp_hash) {
+        rp_hash->size = tpm2_alg_util_get_hash_size(phash_alg);
+    }
+
+    return phash_alg;
+}
+
+void tpm2_util_tpms_nv_pin_counter_parameters_to_yaml(TPMS_NV_PIN_COUNTER_PARAMETERS *pin_params, int indent) {
+    print_yaml_indent(indent);
+    tpm2_tool_output("pinCount: %u\n", pin_params->pinCount);
+    print_yaml_indent(indent);
+    tpm2_tool_output("pinLimit: %u\n", pin_params->pinLimit);
+}
+
+void tpm2_util_tpm2_nv_to_yaml(TPM2B_NV_PUBLIC *nv_public, UINT8 *data, UINT16 size, int indent) {
+    int ds, i;
+    UINT64 v;
+    char *algstr;
+    TPMS_NV_PIN_COUNTER_PARAMETERS pin_params;
+
+    TPM2_NT nt = (nv_public->nvPublic.attributes & TPMA_NV_TPM2_NT_MASK) >> TPMA_NV_TPM2_NT_SHIFT;
+    switch (nt) {
+    case TPM2_NT_COUNTER:
+        memcpy(&v, data, sizeof(UINT64));
+        v = be64toh(v);
+        print_yaml_indent(indent);
+        tpm2_tool_output("counter: %" PRIu64 "\n", v);
+        break;
+    case TPM2_NT_BITS:
+        memcpy(&v, data, sizeof(UINT64));
+        v = be64toh(v);
+        print_yaml_indent(indent);
+        tpm2_tool_output("bits: ");
+        bool first = true;
+        for (int i=0;i < 64;i++) {
+	    if (!(((UINT64) 1 << i) & v)) {
+	        continue;
+	    }
+	    if (first) {
+	        first = false;
+	        tpm2_tool_output(" %u", i);
+	    } else {
+	        tpm2_tool_output(", %u", i);
+	    }
+        }
+        tpm2_tool_output(" \n");
+        break;
+    case TPM2_NT_EXTEND:
+        algstr = (char *) tpm2_alg_util_algtostr(nv_public->nvPublic.nameAlg, tpm2_alg_util_flags_any);
+        ds = tpm2_alg_util_get_hash_size(nv_public->nvPublic.nameAlg);
+        print_yaml_indent(indent);
+        tpm2_tool_output("%s: 0x", algstr);
+        for (i=0;i < ds;i++) {
+	    tpm2_tool_output("%02X", datai);
+        }
+        tpm2_tool_output("\n");
+        break;
+    case TPM2_NT_PIN_FAIL:
+        Tss2_MU_TPMS_NV_PIN_COUNTER_PARAMETERS_Unmarshal(data, size, NULL, &pin_params);
+	print_yaml_indent(indent);
+	tpm2_tool_output("pinfail:\n");
+	tpm2_util_tpms_nv_pin_counter_parameters_to_yaml(&pin_params, indent + 1);
+	break;
+    case TPM2_NT_PIN_PASS:
+        Tss2_MU_TPMS_NV_PIN_COUNTER_PARAMETERS_Unmarshal(data, size, NULL, &pin_params);
+	print_yaml_indent(indent);
+	tpm2_tool_output("pinpass:\n");
+	tpm2_util_tpms_nv_pin_counter_parameters_to_yaml(&pin_params, indent + 1);
+	break;
+    default:
+        print_yaml_indent(indent);
+	tpm2_tool_output("data: ");
+	tpm2_util_hexdump(data, size);
+	tpm2_tool_output("\n");
+	break;
+    }
+}

_service:tar_scm:tpm2-tools-5.0.tar.gz/lib/tpm2_util.h -> _service:tar_scm:tpm2-tools-5.4.tar.gz/lib/tpm2_util.h Changed

@@ -6,11 +6,19 @@
 #include <stdbool.h>
 #include <stdint.h>
 #include <stdio.h>
+#include <string.h>
 
 #include <tss2/tss2_esys.h>
 
+#include "config.h"
 #include "tpm2_session.h"
 
+#if defined(FUZZING) || defined(UNIT_TESTING) || !defined(NDEBUG)
+#define TEST_WEAK __attribute__((weak))
+#else
+#define TEST_WEAK
+#endif
+
 #if defined (__GNUC__)
 #define COMPILER_ATTR(...) __attribute__((__VA_ARGS__))
 #else
@@ -87,6 +95,11 @@
     BYTE buffer0;
 } TPM2B;
 
+#define DEFAULT_CREATE_ATTRS \
+     TPMA_OBJECT_DECRYPT|TPMA_OBJECT_SIGN_ENCRYPT|TPMA_OBJECT_FIXEDTPM \
+    |TPMA_OBJECT_FIXEDPARENT|TPMA_OBJECT_SENSITIVEDATAORIGIN \
+    |TPMA_OBJECT_USERWITHAUTH
+
 int tpm2_util_hex_to_byte_structure(const char *in_str, UINT16 *byte_length,
         BYTE *byte_buffer);
 
@@ -218,6 +231,39 @@
     return tpm2_util_hexdump(buffer->buffer, buffer->size);
 }
 
+static inline bool _cmp_tpm2b(UINT16 size_a, const BYTE *buf_a, UINT16 size_b, const BYTE *buf_b,
+        size_t max_a, size_t max_b) {
+
+    /*
+     * overall buffers should be the same size (same object kind of check and to ensure we don't
+     * overflow a buffer
+     */
+    return max_a == max_b &&
+            /* size should be the same */
+            size_a == size_b &&
+            /* memory should be the same */
+            !memcmp(buf_a, buf_b, size_a);
+}
+
+/**
+ * Compare imple TPM2B a with b
+ *
+ * Compares simple TPM2B structures, which are structures
+ * that only have a size and buffer contents with eachother.
+ * Examples of simple TPM2B's are TPM2B_AUTH, TPM2B_DIGEST, etc.
+ *
+ * @param a
+ *  A simple TPM2B to compare
+ * @param b
+ *  A simple TPM2B to compare
+ * @returns
+ *  true if they are the same, false otherwise.
+ */
+#define cmp_tpm2b(field, a, b) \
+    _cmp_tpm2b((a)->size, (a)->field, (b)->size, (b)->field, \
+        sizeof((a)->field), \
+        sizeof((b)->field))
+
 /**
  * Prints a TPM2B as a hex dump to the FILE specified. Does NOT
  * respect -Q like tpm2_util_print_tpm2b().
@@ -298,7 +344,7 @@
 UINT16 tpm2_util_ntoh_16(UINT16 data);
 
 /**
- * Just like string_bytes_endian_ntoh_16 but for 32 bit values.
+ * Just like tpm2_util_ntoh_16 but for 32 bit values.
  */
 UINT32 tpm2_util_ntoh_32(UINT32 data);
 
@@ -456,4 +502,61 @@
 bool tpm2_calq_qname(TPM2B_NAME *pqname,
         TPMI_ALG_HASH halg, TPM2B_NAME *name, TPM2B_NAME *qname);
 
+/**
+ * Reads safely from stdin.
+ *
+ * @param length
+ *  Maximum length to read.
+ * @param data
+ *  The output data that was read, valid on success.
+ * @return
+ *  True on success, false otherwise.
+ */
+bool tpm2_safe_read_from_stdin(int length, char *data);
+
+
+/**
+ * Converts a PEM-encoded public key to its sha256 representation (fingerprint).
+ * The resulting Base64-encoded fingerprint format is based on the SSH:
+ * '''
+ *      ssh-keygen -lf id_ecdsa.pub
+ *          256 SHA256:wTUOtZnoSGKwq36mPIN20rCK0Fc1y0zCvHxI2eAvVxU
+ * '''
+ *
+ * @param pem_encoded_key
+ *  The PEM-encoded public key.
+ * @param fingerprint
+ *  The resulting fingerprint, valid on success.
+ * @return
+ *  True on success, false otherwise.
+ */
+bool tpm2_pem_encoded_key_to_fingerprint(const char* pem_encoded_key, char*
+    fingerprint);
+
+/**
+ * Restores session handles to be used as auxilary sessions in addition to the
+ * possible authorization sessions with a command.
+ *
+ * @param ectx
+ *  The ESAPI context
+ * @param session_cnt
+ *  Total number of sessions to restore
+ * @param session_path
+ *  An array of string data specifying the individual session file path
+ * @param session_handle
+ *  An array of session handles updated as a result resuming sessions
+ * @param session
+ *  An array of session structures updated as a result of resuming sessions
+ * @return
+ *  Success: tool_rc_success, Faiure: tool_rc_general_error
+ */
+tool_rc tpm2_util_aux_sessions_setup( ESYS_CONTEXT *ectx,
+    uint8_t session_cnt, const char **session_path, ESYS_TR *session_handle,
+    tpm2_session **session);
+
+TPMI_ALG_HASH tpm2_util_calculate_phash_algorithm(ESYS_CONTEXT *ectx,
+    const char **cphash_path, TPM2B_DIGEST *cp_hash, const char **rphash_path,
+    TPM2B_DIGEST *rp_hash, tpm2_session **sessions);
+
+void tpm2_util_tpm2_nv_to_yaml(TPM2B_NV_PUBLIC *, UINT8 *, UINT16, int);
 #endif /* STRING_BYTES_H */

_service:tar_scm:tpm2-tools-5.0.tar.gz/ltmain.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/ltmain.sh Changed

@@ -31,7 +31,7 @@
 
 PROGRAM=libtool
 PACKAGE=libtool
-VERSION="2.4.6 Debian-2.4.6-2"
+VERSION="2.4.6 Debian-2.4.6-14"
 package_revision=2.4.6
 
 
@@ -387,7 +387,7 @@
 # putting '$debug_cmd' at the start of all your functions, you can get
 # bash to show function call trace with:
 #
-#    debug_cmd='eval echo "${FUNCNAME0} $*" >&2' bash your-script-name
+#    debug_cmd='echo "${FUNCNAME0} $*" >&2' bash your-script-name
 debug_cmd=${debug_cmd-":"}
 exit_cmd=:
 
@@ -1370,7 +1370,7 @@
 #! /bin/sh
 
 # Set a version string for this script.
-scriptversion=2014-01-07.03; # UTC
+scriptversion=2015-10-07.11; # UTC
 
 # A portable, pluggable option parser for Bourne shell.
 # Written by Gary V. Vaughan, 2010
@@ -1530,6 +1530,8 @@
 {
     $debug_cmd
 
+    _G_rc_run_hooks=false
+
     case " $hookable_fns " in
       *" $1 "*) ;;
       *) func_fatal_error "'$1' does not support hook funcions.n" ;;
@@ -1538,16 +1540,16 @@
     eval _G_hook_fns=\$$1_hooks; shift
 
     for _G_hook in $_G_hook_fns; do
-      eval $_G_hook '"$@"'
-
-      # store returned options list back into positional
-      # parameters for next 'cmd' execution.
-      eval _G_hook_result=\$${_G_hook}_result
-      eval set dummy "$_G_hook_result"; shift
+      if eval $_G_hook '"$@"'; then
+        # store returned options list back into positional
+        # parameters for next 'cmd' execution.
+        eval _G_hook_result=\$${_G_hook}_result
+        eval set dummy "$_G_hook_result"; shift
+        _G_rc_run_hooks=:
+      fi
     done
 
-    func_quote_for_eval ${1+"$@"}
-    func_run_hooks_result=$func_quote_for_eval_result
+    $_G_rc_run_hooks && func_run_hooks_result=$_G_hook_result
 }
 
 
@@ -1557,10 +1559,16 @@
 ## --------------- ##
 
 # In order to add your own option parsing hooks, you must accept the
-# full positional parameter list in your hook function, remove any
-# options that you action, and then pass back the remaining unprocessed
+# full positional parameter list in your hook function, you may remove/edit
+# any options that you action, and then pass back the remaining unprocessed
 # options in '<hooked_function_name>_result', escaped suitably for
-# 'eval'.  Like this:
+# 'eval'.  In this case you also must return $EXIT_SUCCESS to let the
+# hook's caller know that it should pay attention to
+# '<hooked_function_name>_result'.  Returning $EXIT_FAILURE signalizes that
+# arguments are left untouched by the hook and therefore caller will ignore the
+# result variable.
+#
+# Like this:
 #
 #    my_options_prep ()
 #    {
@@ -1570,9 +1578,11 @@
 #        usage_message=$usage_message'
 #      -s, --silent       don'\''t print informational messages
 #    '
-#
-#        func_quote_for_eval ${1+"$@"}
-#        my_options_prep_result=$func_quote_for_eval_result
+#        # No change in '$@' (ignored completely by this hook).  There is
+#        # no need to do the equivalent (but slower) action:
+#        # func_quote_for_eval ${1+"$@"}
+#        # my_options_prep_result=$func_quote_for_eval_result
+#        false
 #    }
 #    func_add_hook func_options_prep my_options_prep
 #
@@ -1581,25 +1591,37 @@
 #    {
 #        $debug_cmd
 #
+#        args_changed=false
+#
 #        # Note that for efficiency, we parse as many options as we can
 #        # recognise in a loop before passing the remainder back to the
 #        # caller on the first unrecognised argument we encounter.
 #        while test $# -gt 0; do
 #          opt=$1; shift
 #          case $opt in
-#            --silent|-s) opt_silent=: ;;
+#            --silent|-s) opt_silent=:
+#                         args_changed=:
+#                         ;;
 #            # Separate non-argument short options:
 #            -s*)         func_split_short_opt "$_G_opt"
 #                         set dummy "$func_split_short_opt_name" \
 #                             "-$func_split_short_opt_arg" ${1+"$@"}
 #                         shift
+#                         args_changed=:
 #                         ;;
-#            *)            set dummy "$_G_opt" "$*"; shift; break ;;
+#            *)           # Make sure the first unrecognised option "$_G_opt"
+#                         # is added back to "$@", we could need that later
+#                         # if $args_changed is true.
+#                         set dummy "$_G_opt" ${1+"$@"}; shift; break ;;
 #          esac
 #        done
 #
-#        func_quote_for_eval ${1+"$@"}
-#        my_silent_option_result=$func_quote_for_eval_result
+#        if $args_changed; then
+#          func_quote_for_eval ${1+"$@"}
+#          my_silent_option_result=$func_quote_for_eval_result
+#        fi
+#
+#        $args_changed
 #    }
 #    func_add_hook func_parse_options my_silent_option
 #
@@ -1611,16 +1633,32 @@
 #        $opt_silent && $opt_verbose && func_fatal_help "\
 #    '--silent' and '--verbose' options are mutually exclusive."
 #
-#        func_quote_for_eval ${1+"$@"}
-#        my_option_validation_result=$func_quote_for_eval_result
+#        false
 #    }
 #    func_add_hook func_validate_options my_option_validation
 #
-# You'll alse need to manually amend $usage_message to reflect the extra
+# You'll also need to manually amend $usage_message to reflect the extra
 # options you parse.  It's preferable to append if you can, so that
 # multiple option parsing hooks can be added safely.
 
 
+# func_options_finish ARG...
+# ----------------------------
+# Finishing the option parse loop (call 'func_options' hooks ATM).
+func_options_finish ()
+{
+    $debug_cmd
+
+    _G_func_options_finish_exit=false
+    if func_run_hooks func_options ${1+"$@"}; then
+      func_options_finish_result=$func_run_hooks_result
+      _G_func_options_finish_exit=:
+    fi
+
+    $_G_func_options_finish_exit
+}
+
+
 # func_options ARG...
 # ---------------------
 # All the functions called inside func_options are hookable. See the
@@ -1630,17 +1668,28 @@
 {
     $debug_cmd
 
-    func_options_prep ${1+"$@"}
-    eval func_parse_options \
-        ${func_options_prep_result+"$func_options_prep_result"}
-    eval func_validate_options \
-        ${func_parse_options_result+"$func_parse_options_result"}
+    _G_rc_options=false
 
-    eval func_run_hooks func_options \
-        ${func_validate_options_result+"$func_validate_options_result"}
+    for my_func in options_prep parse_options validate_options options_finish
+    do
+      if eval func_$my_func '${1+"$@"}'; then
+        eval _G_res_var='$'"func_${my_func}_result"
+        eval set dummy "$_G_res_var" ; shift
+        _G_rc_options=:
+      fi
+    done
 
-    # save modified positional parameters for caller
-    func_options_result=$func_run_hooks_result
+    # Save modified positional parameters for caller.  As a top-level
+    # options-parser function we always need to set the 'func_options_result'
+    # variable (regardless the $_G_rc_options value).
+    if $_G_rc_options; then
+      func_options_result=$_G_res_var
+    else
+      func_quote_for_eval ${1+"$@"}
+      func_options_result=$func_quote_for_eval_result
+    fi
+
+    $_G_rc_options
 }
 
 
@@ -1649,9 +1698,9 @@
 # All initialisations required before starting the option parse loop.
 # Note that when calling hook functions, we pass through the list of
 # positional parameters.  If a hook function modifies that list, and
-# needs to propogate that back to rest of this script, then the complete
+# needs to propagate that back to rest of this script, then the complete
 # modified list must be put in 'func_run_hooks_result' before
-# returning.
+# returning $EXIT_SUCCESS (otherwise $EXIT_FAILURE is returned).
 func_hookable func_options_prep
 func_options_prep ()
 {
@@ -1661,10 +1710,14 @@
     opt_verbose=false
     opt_warning_types=
 
-    func_run_hooks func_options_prep ${1+"$@"}
+    _G_rc_options_prep=false
+    if func_run_hooks func_options_prep ${1+"$@"}; then
+      _G_rc_options_prep=:
+      # save modified positional parameters for caller
+      func_options_prep_result=$func_run_hooks_result
+    fi
 
-    # save modified positional parameters for caller
-    func_options_prep_result=$func_run_hooks_result
+    $_G_rc_options_prep
 }
 
 
@@ -1678,18 +1731,20 @@
 
     func_parse_options_result=
 
+    _G_rc_parse_options=false
     # this just eases exit handling
     while test $# -gt 0; do
       # Defer to hook functions for initial option parsing, so they
       # get priority in the event of reusing an option name.
-      func_run_hooks func_parse_options ${1+"$@"}
-
-      # Adjust func_parse_options positional parameters to match
-      eval set dummy "$func_run_hooks_result"; shift
+      if func_run_hooks func_parse_options ${1+"$@"}; then
+        eval set dummy "$func_run_hooks_result"; shift
+        _G_rc_parse_options=:
+      fi
 
       # Break out of the loop if we already parsed every option.
       test $# -gt 0 || break
 
+      _G_match_parse_options=:
       _G_opt=$1
       shift
       case $_G_opt in
@@ -1704,7 +1759,10 @@
 		      ;;
 
         --warnings|--warning|-W)
-                      test $# = 0 && func_missing_arg $_G_opt && break
+                      if test $# = 0 && func_missing_arg $_G_opt; then
+                        _G_rc_parse_options=:
+                        break
+                      fi
                       case " $warning_categories $1" in
                         *" $1 "*)
                           # trailing space prevents matching last $1 above
@@ -1757,15 +1815,25 @@
                       shift
                       ;;
 
-        --)           break ;;
+        --)           _G_rc_parse_options=: ; break ;;
         -*)           func_fatal_help "unrecognised option: '$_G_opt'" ;;
-        *)            set dummy "$_G_opt" ${1+"$@"}; shift; break ;;
+        *)            set dummy "$_G_opt" ${1+"$@"}; shift
+                      _G_match_parse_options=false
+                      break
+                      ;;
       esac
+
+      $_G_match_parse_options && _G_rc_parse_options=:
     done
 
-    # save modified positional parameters for caller
-    func_quote_for_eval ${1+"$@"}
-    func_parse_options_result=$func_quote_for_eval_result
+
+    if $_G_rc_parse_options; then
+      # save modified positional parameters for caller
+      func_quote_for_eval ${1+"$@"}
+      func_parse_options_result=$func_quote_for_eval_result
+    fi
+
+    $_G_rc_parse_options
 }
 
 
@@ -1778,16 +1846,21 @@
 {
     $debug_cmd
 
+    _G_rc_validate_options=false
+
     # Display all warnings if -W was not given.
     test -n "$opt_warning_types" || opt_warning_types=" $warning_categories"
 
-    func_run_hooks func_validate_options ${1+"$@"}
+    if func_run_hooks func_validate_options ${1+"$@"}; then
+      # save modified positional parameters for caller
+      func_validate_options_result=$func_run_hooks_result
+      _G_rc_validate_options=:
+    fi
 
     # Bail if the options were screwed!
     $exit_cmd $EXIT_FAILURE
 
-    # save modified positional parameters for caller
-    func_validate_options_result=$func_run_hooks_result
+    $_G_rc_validate_options
 }
 
 
@@ -2068,7 +2141,7 @@
        compiler:       $LTCC
        compiler flags: $LTCFLAGS
        linker:         $LD (gnu? $with_gnu_ld)
-       version:        $progname $scriptversion Debian-2.4.6-2
+       version:        $progname $scriptversion Debian-2.4.6-14
        automake:       `($AUTOMAKE --version) 2>/dev/null |$SED 1q`
        autoconf:       `($AUTOCONF --version) 2>/dev/null |$SED 1q`
 
@@ -2270,6 +2343,8 @@
     nonopt=
     preserve_args=
 
+    _G_rc_lt_options_prep=:
+
     # Shorthand for --mode=foo, only valid as the first argument
     case $1 in
     clean|clea|cle|cl)
@@ -2293,11 +2368,18 @@
     uninstall|uninstal|uninsta|uninst|unins|unin|uni|un|u)
       shift; set dummy --mode uninstall ${1+"$@"}; shift
       ;;
+    *)
+      _G_rc_lt_options_prep=false
+      ;;
     esac
 
-    # Pass back the list of options.
-    func_quote_for_eval ${1+"$@"}
-    libtool_options_prep_result=$func_quote_for_eval_result
+    if $_G_rc_lt_options_prep; then
+      # Pass back the list of options.
+      func_quote_for_eval ${1+"$@"}
+      libtool_options_prep_result=$func_quote_for_eval_result
+    fi
+
+    $_G_rc_lt_options_prep
 }
 func_add_hook func_options_prep libtool_options_prep
 
@@ -2309,9 +2391,12 @@
 {
     $debug_cmd
 
+    _G_rc_lt_parse_options=false
+
     # Perform our own loop to consume as many options as possible in
     # each iteration.
     while test $# -gt 0; do
+      _G_match_lt_parse_options=:
       _G_opt=$1
       shift
       case $_G_opt in
@@ -2386,15 +2471,22 @@
                         func_append preserve_args " $_G_opt"
                         ;;
 
-	# An option not handled by this hook function:
-        *)		set dummy "$_G_opt" ${1+"$@"};	shift; break  ;;
+        # An option not handled by this hook function:
+        *)              set dummy "$_G_opt" ${1+"$@"} ; shift
+                        _G_match_lt_parse_options=false
+                        break
+                        ;;
       esac
+      $_G_match_lt_parse_options && _G_rc_lt_parse_options=:
     done
 
+    if $_G_rc_lt_parse_options; then
+      # save modified positional parameters for caller
+      func_quote_for_eval ${1+"$@"}
+      libtool_parse_options_result=$func_quote_for_eval_result
+    fi
 
-    # save modified positional parameters for caller
-    func_quote_for_eval ${1+"$@"}
-    libtool_parse_options_result=$func_quote_for_eval_result
+    $_G_rc_lt_parse_options
 }
 func_add_hook func_parse_options libtool_parse_options
 
@@ -7275,10 +7367,13 @@
       # -specs=*             GCC specs files
       # -stdlib=*            select c++ std lib with clang
       # -fsanitize=*         Clang/GCC memory and address sanitizer
+      # -fuse-ld=*           Linker select flags for GCC
+      # -static-*            direct GCC to link specific libraries statically
+      # -fcilkplus           Cilk Plus language extension features for C/C++
       -64|-mips0-9|-r0-90-9*|-xarch=*|-xtarget=*|+DA*|+DD*|-q*|-m*| \
       -t45*|-txscale*|-p|-pg|--coverage|-fprofile-*|-F*|@*|-tp=*|--sysroot=*| \
       -O*|-g*|-flto*|-fwhopr*|-fuse-linker-plugin|-fstack-protector*|-stdlib=*| \
-      -specs=*|-fsanitize=*)
+      -specs=*|-fsanitize=*|-fuse-ld=*|-static-*|-fcilkplus)
         func_quote_for_eval "$arg"
 	arg=$func_quote_for_eval_result
         func_append compile_command " $arg"

_service:tar_scm:tpm2-tools-5.0.tar.gz/m4/ax_ac_append_to_file.m4 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/m4/ax_ac_append_to_file.m4 Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/m4/ax_ac_print_to_file.m4 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/m4/ax_ac_print_to_file.m4 Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/m4/ax_am_macros_static.m4 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/m4/ax_am_macros_static.m4 Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/m4/ax_check_compile_flag.m4 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/m4/ax_check_compile_flag.m4 Changed

@@ -29,33 +29,12 @@
 #   Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
 #   Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
 #
-#   This program is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by the
-#   Free Software Foundation, either version 3 of the License, or (at your
-#   option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-#   Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <https://www.gnu.org/licenses/>.
-#
-#   As a special exception, the respective Autoconf Macro's copyright owner
-#   gives unlimited permission to copy, distribute and modify the configure
-#   scripts that are the output of Autoconf when processing the Macro. You
-#   need not follow the terms of the GNU General Public License when using
-#   or distributing such scripts, even though portions of the text of the
-#   Macro appear in them. The GNU General Public License (GPL) does govern
-#   all other use of the material that constitutes the Autoconf Macro.
-#
-#   This special exception to the GPL applies to versions of the Autoconf
-#   Macro released by the Autoconf Archive. When you make and distribute a
-#   modified version of the Autoconf Macro, you may extend this special
-#   exception to the GPL to apply to your modified version as well.
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved.  This file is offered as-is, without any
+#   warranty.
 
-#serial 5
+#serial 6
 
 AC_DEFUN(AX_CHECK_COMPILE_FLAG,
 AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_IF

_service:tar_scm:tpm2-tools-5.0.tar.gz/m4/ax_check_enable_debug.m4 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/m4/ax_check_enable_debug.m4 Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/m4/ax_check_gnu_make.m4 Added

@@ -0,0 +1,95 @@
+# ===========================================================================
+#    https://www.gnu.org/software/autoconf-archive/ax_check_gnu_make.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_CHECK_GNU_MAKE(run-if-true,run-if-false)
+#
+# DESCRIPTION
+#
+#   This macro searches for a GNU version of make. If a match is found:
+#
+#     * The makefile variable `ifGNUmake' is set to the empty string, otherwise
+#       it is set to "#". This is useful for including a special features in a
+#       Makefile, which cannot be handled by other versions of make.
+#     * The makefile variable `ifnGNUmake' is set to #, otherwise
+#       it is set to the empty string. This is useful for including a special
+#       features in a Makefile, which can be handled
+#       by other versions of make or to specify else like clause.
+#     * The variable `_cv_gnu_make_command` is set to the command to invoke
+#       GNU make if it exists, the empty string otherwise.
+#     * The variable `ax_cv_gnu_make_command` is set to the command to invoke
+#       GNU make by copying `_cv_gnu_make_command`, otherwise it is unset.
+#     * If GNU Make is found, its version is extracted from the output of
+#       `make --version` as the last field of a record of space-separated
+#       columns and saved into the variable `ax_check_gnu_make_version`.
+#     * Additionally if GNU Make is found, run shell code run-if-true
+#       else run shell code run-if-false.
+#
+#   Here is an example of its use:
+#
+#   Makefile.in might contain:
+#
+#     # A failsafe way of putting a dependency rule into a makefile
+#     $(DEPEND):
+#             $(CC) -MM $(srcdir)/*.c > $(DEPEND)
+#
+#     @ifGNUmake@ ifeq ($(DEPEND),$(wildcard $(DEPEND)))
+#     @ifGNUmake@ include $(DEPEND)
+#     @ifGNUmake@ else
+#     fallback code
+#     @ifGNUmake@ endif
+#
+#   Then configure.in would normally contain:
+#
+#     AX_CHECK_GNU_MAKE()
+#     AC_OUTPUT(Makefile)
+#
+#   Then perhaps to cause gnu make to override any other make, we could do
+#   something like this (note that GNU make always looks for GNUmakefile
+#   first):
+#
+#     if  ! test x$_cv_gnu_make_command = x ; then
+#             mv Makefile GNUmakefile
+#             echo .DEFAULT: > Makefile ;
+#             echo \  $_cv_gnu_make_command \$@ >> Makefile;
+#     fi
+#
+#   Then, if any (well almost any) other make is called, and GNU make also
+#   exists, then the other make wraps the GNU make.
+#
+# LICENSE
+#
+#   Copyright (c) 2008 John Darrington <j.darrington@elvis.murdoch.edu.au>
+#   Copyright (c) 2015 Enrico M. Crisostomo <enrico.m.crisostomo@gmail.com>
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved. This file is offered as-is, without any
+#   warranty.
+
+#serial 11
+
+AC_DEFUN(AX_CHECK_GNU_MAKE,dnl
+  AC_PROG_AWK
+  AC_CACHE_CHECK(for GNU make,_cv_gnu_make_command,dnl
+    _cv_gnu_make_command="" ;
+dnl Search all the common names for GNU make
+    for a in "$MAKE" make gmake gnumake ; do
+      if test -z "$a" ; then continue ; fi ;
+      if "$a" --version 2> /dev/null | grep GNU 2>&1 > /dev/null ; then
+        _cv_gnu_make_command=$a ;
+        AX_CHECK_GNU_MAKE_HEADLINE=$("$a" --version 2> /dev/null | grep "GNU Make")
+        ax_check_gnu_make_version=$(echo ${AX_CHECK_GNU_MAKE_HEADLINE} | ${AWK} -F " " '{ print $(NF); }')
+        break ;
+      fi
+    done ;)
+dnl If there was a GNU version, then set @ifGNUmake@ to the empty string, '#' otherwise
+  AS_VAR_IF(_cv_gnu_make_command, "", AS_VAR_SET(ifGNUmake, "#"),   AS_VAR_SET(ifGNUmake, ""))
+  AS_VAR_IF(_cv_gnu_make_command, "", AS_VAR_SET(ifnGNUmake, ""),   AS_VAR_SET(ifGNUmake, "#"))
+  AS_VAR_IF(_cv_gnu_make_command, "", AS_UNSET(ax_cv_gnu_make_command), AS_VAR_SET(ax_cv_gnu_make_command, ${_cv_gnu_make_command}))
+  AS_VAR_IF(_cv_gnu_make_command, "",$2,$1)
+  AC_SUBST(ifGNUmake)
+  AC_SUBST(ifnGNUmake)
+)

_service:tar_scm:tpm2-tools-5.0.tar.gz/m4/ax_check_link_flag.m4 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/m4/ax_check_link_flag.m4 Changed

@@ -29,33 +29,12 @@
 #   Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
 #   Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
 #
-#   This program is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by the
-#   Free Software Foundation, either version 3 of the License, or (at your
-#   option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-#   Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <https://www.gnu.org/licenses/>.
-#
-#   As a special exception, the respective Autoconf Macro's copyright owner
-#   gives unlimited permission to copy, distribute and modify the configure
-#   scripts that are the output of Autoconf when processing the Macro. You
-#   need not follow the terms of the GNU General Public License when using
-#   or distributing such scripts, even though portions of the text of the
-#   Macro appear in them. The GNU General Public License (GPL) does govern
-#   all other use of the material that constitutes the Autoconf Macro.
-#
-#   This special exception to the GPL applies to versions of the Autoconf
-#   Macro released by the Autoconf Archive. When you make and distribute a
-#   modified version of the Autoconf Macro, you may extend this special
-#   exception to the GPL to apply to your modified version as well.
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved.  This file is offered as-is, without any
+#   warranty.
 
-#serial 5
+#serial 6
 
 AC_DEFUN(AX_CHECK_LINK_FLAG,
 AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_IF

_service:tar_scm:tpm2-tools-5.0.tar.gz/m4/ax_code_coverage.m4 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/m4/ax_code_coverage.m4 Changed

@@ -12,11 +12,11 @@
 #   CODE_COVERAGE_CXXFLAGS and CODE_COVERAGE_LIBS which should be included
 #   in the CPPFLAGS, CFLAGS CXXFLAGS and LIBS/LIBADD variables of every
 #   build target (program or library) which should be built with code
-#   coverage support. Also defines CODE_COVERAGE_RULES which should be
-#   substituted in your Makefile; and $enable_code_coverage which can be
-#   used in subsequent configure output. CODE_COVERAGE_ENABLED is defined
-#   and substituted, and corresponds to the value of the
-#   --enable-code-coverage option, which defaults to being disabled.
+#   coverage support. Also add rules using AX_ADD_AM_MACRO_STATIC; and
+#   $enable_code_coverage which can be used in subsequent configure output.
+#   CODE_COVERAGE_ENABLED is defined and substituted, and corresponds to the
+#   value of the --enable-code-coverage option, which defaults to being
+#   disabled.
 #
 #   Test also for gcov program and create GCOV variable that could be
 #   substituted.
@@ -32,25 +32,24 @@
 #
 #   Makefile.am:
 #
-#     @CODE_COVERAGE_RULES@
+#     include $(top_srcdir)/aminclude_static.am
+#
 #     my_program_LIBS = ... $(CODE_COVERAGE_LIBS) ...
 #     my_program_CPPFLAGS = ... $(CODE_COVERAGE_CPPFLAGS) ...
 #     my_program_CFLAGS = ... $(CODE_COVERAGE_CFLAGS) ...
 #     my_program_CXXFLAGS = ... $(CODE_COVERAGE_CXXFLAGS) ...
 #
-#   This results in a "check-code-coverage" rule being added to any
-#   Makefile.am which includes "@CODE_COVERAGE_RULES@" (assuming the module
-#   has been configured with --enable-code-coverage). Running `make
-#   check-code-coverage` in that directory will run the module's test suite
-#   (`make check`) and build a code coverage report detailing the code which
-#   was touched, then print the URI for the report.
+#     clean-local: code-coverage-clean
+#     distclean-local: code-coverage-dist-clean
 #
-#   In earlier versions of this macro, CODE_COVERAGE_LDFLAGS was defined
-#   instead of CODE_COVERAGE_LIBS. They are both still defined, but use of
-#   CODE_COVERAGE_LIBS is preferred for clarity; CODE_COVERAGE_LDFLAGS is
-#   deprecated. They have the same value.
+#   This results in a "check-code-coverage" rule being added to any
+#   Makefile.am which do "include $(top_srcdir)/aminclude_static.am"
+#   (assuming the module has been configured with --enable-code-coverage).
+#   Running `make check-code-coverage` in that directory will run the
+#   module's test suite (`make check`) and build a code coverage report
+#   detailing the code which was touched, then print the URI for the report.
 #
-#   This code was derived from Makefile.decl in GLib, originally licenced
+#   This code was derived from Makefile.decl in GLib, originally licensed
 #   under LGPLv2.1+.
 #
 # LICENSE
@@ -60,7 +59,7 @@
 #   Copyright (c) 2012 Christian Persch
 #   Copyright (c) 2012 Paolo Borelli
 #   Copyright (c) 2012 Dan Winship
-#   Copyright (c) 2015 Bastien ROUCARIES
+#   Copyright (c) 2015,2018 Bastien ROUCARIES
 #
 #   This library is free software; you can redistribute it and/or modify it
 #   under the terms of the GNU Lesser General Public License as published by
@@ -75,107 +74,22 @@
 #   You should have received a copy of the GNU Lesser General Public License
 #   along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-#serial 25
-
-AC_DEFUN(AX_CODE_COVERAGE,
-	dnl Check for --enable-code-coverage
-	AC_REQUIRE(AC_PROG_SED)
-
-	# allow to override gcov location
-	AC_ARG_WITH(gcov,
-	  AS_HELP_STRING(--with-gcov=GCOV, use given GCOV for coverage (GCOV=gcov).),
-	  _AX_CODE_COVERAGE_GCOV_PROG_WITH=$with_gcov,
-	  _AX_CODE_COVERAGE_GCOV_PROG_WITH=gcov)
-
-	AC_MSG_CHECKING(whether to build with code coverage support)
-	AC_ARG_ENABLE(code-coverage,
-	  AS_HELP_STRING(--enable-code-coverage,
-	  Whether to enable code coverage support),,
-	  enable_code_coverage=no)
-
-	AM_CONDITIONAL(CODE_COVERAGE_ENABLED, test x$enable_code_coverage = xyes)
-	AC_SUBST(CODE_COVERAGE_ENABLED, $enable_code_coverage)
-	AC_MSG_RESULT($enable_code_coverage)
-
-	AS_IF( test "$enable_code_coverage" = "yes" , 
-		# check for gcov
-		AC_CHECK_TOOL(GCOV,
-		  $_AX_CODE_COVERAGE_GCOV_PROG_WITH,
-		  :)
-		AS_IF(test "X$GCOV" = "X:",
-		  AC_MSG_ERROR(gcov is needed to do coverage))
-		AC_SUBST(GCOV)
-
-		dnl Check if gcc is being used
-		AS_IF( test "$GCC" = "no" , 
-			AC_MSG_ERROR(not compiling with gcc, which is required for gcov code coverage)
-		)
-
-		AC_CHECK_PROG(LCOV, lcov, lcov)
-		AC_CHECK_PROG(GENHTML, genhtml, genhtml)
-
-		AS_IF( test -z "$LCOV" , 
-			AC_MSG_ERROR(To enable code coverage reporting you must have lcov installed)
-		)
-
-		AS_IF( test -z "$GENHTML" , 
-			AC_MSG_ERROR(Could not find genhtml from the lcov package)
-		)
-
-		dnl Build the code coverage flags
-		dnl Define CODE_COVERAGE_LDFLAGS for backwards compatibility
-		CODE_COVERAGE_CPPFLAGS="-DNDEBUG"
-		CODE_COVERAGE_CFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
-		CODE_COVERAGE_CXXFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
-		CODE_COVERAGE_LIBS="-lgcov"
-		CODE_COVERAGE_LDFLAGS="$CODE_COVERAGE_LIBS"
-
-		AC_SUBST(CODE_COVERAGE_CPPFLAGS)
-		AC_SUBST(CODE_COVERAGE_CFLAGS)
-		AC_SUBST(CODE_COVERAGE_CXXFLAGS)
-		AC_SUBST(CODE_COVERAGE_LIBS)
-		AC_SUBST(CODE_COVERAGE_LDFLAGS)
+#serial 32
 
-		CODE_COVERAGE_RULES_CHECK='
-	-$(A''M_V_at)$(MAKE) $(AM_MAKEFLAGS) -k check
-	$(A''M_V_at)$(MAKE) $(AM_MAKEFLAGS) code-coverage-capture
-'
-		CODE_COVERAGE_RULES_CAPTURE='
-	$(code_coverage_v_lcov_cap)$(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --capture --output-file "$(CODE_COVERAGE_OUTPUT_FILE).tmp" --test-name "$(call code_coverage_sanitize,$(PACKAGE_NAME)-$(PACKAGE_VERSION))" --no-checksum --compat-libtool $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_OPTIONS)
-	$(code_coverage_v_lcov_ign)$(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --remove "$(CODE_COVERAGE_OUTPUT_FILE).tmp" "/tmp/*" $(CODE_COVERAGE_IGNORE_PATTERN) --output-file "$(CODE_COVERAGE_OUTPUT_FILE)" $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_RMOPTS)
-	-@rm -f $(CODE_COVERAGE_OUTPUT_FILE).tmp
-	$(code_coverage_v_genhtml)LANG=C $(GENHTML) $(code_coverage_quiet) $(addprefix --prefix ,$(CODE_COVERAGE_DIRECTORY)) --output-directory "$(CODE_COVERAGE_OUTPUT_DIRECTORY)" --title "$(PACKAGE_NAME)-$(PACKAGE_VERSION) Code Coverage" --legend --show-details "$(CODE_COVERAGE_OUTPUT_FILE)" $(CODE_COVERAGE_GENHTML_OPTIONS)
-	@echo "file://$(abs_builddir)/$(CODE_COVERAGE_OUTPUT_DIRECTORY)/index.html"
-'
-		CODE_COVERAGE_RULES_CLEAN='
-clean: code-coverage-clean
-distclean: code-coverage-clean
-code-coverage-clean:
-	-$(LCOV) --directory $(top_builddir) -z
-	-rm -rf $(CODE_COVERAGE_OUTPUT_FILE) $(CODE_COVERAGE_OUTPUT_FILE).tmp $(CODE_COVERAGE_OUTPUT_DIRECTORY)
-	-find . $ -name "*.gcda" -o -name "*.gcno" -o -name "*.gcov" $ -delete
-'
-	, 
-		CODE_COVERAGE_RULES_CHECK='
-	@echo "Need to reconfigure with --enable-code-coverage"
-'
-		CODE_COVERAGE_RULES_CAPTURE="$CODE_COVERAGE_RULES_CHECK"
-		CODE_COVERAGE_RULES_CLEAN=''
-	)
-
-CODE_COVERAGE_RULES='
+m4_define(_AX_CODE_COVERAGE_RULES,
+AX_ADD_AM_MACRO_STATIC(
 # Code coverage
 #
 # Optional:
 #  - CODE_COVERAGE_DIRECTORY: Top-level directory for code coverage reporting.
 #    Multiple directories may be specified, separated by whitespace.
-#    (Default: $(top_builddir))
+#    (Default: \$(top_builddir))
 #  - CODE_COVERAGE_OUTPUT_FILE: Filename and path for the .info file generated
 #    by lcov for code coverage. (Default:
-#    $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info)
+#    \$(PACKAGE_NAME)-\$(PACKAGE_VERSION)-coverage.info)
 #  - CODE_COVERAGE_OUTPUT_DIRECTORY: Directory for generated code coverage
 #    reports to be created. (Default:
-#    $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage)
+#    \$(PACKAGE_NAME)-\$(PACKAGE_VERSION)-coverage)
 #  - CODE_COVERAGE_BRANCH_COVERAGE: Set to 1 to enforce branch coverage,
 #    set to 0 to disable it and leave empty to stay with the default.
 #    (Default: empty)
@@ -198,67 +112,161 @@
 #    instance. (Default: $CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT)
 #  - CODE_COVERAGE_IGNORE_PATTERN: Extra glob pattern of files to ignore
 #
-# The generated report will be titled using the $(PACKAGE_NAME) and
-# $(PACKAGE_VERSION). In order to add the current git hash to the title,
+# The generated report will be titled using the \$(PACKAGE_NAME) and
+# \$(PACKAGE_VERSION). In order to add the current git hash to the title,
 # use the git-version-gen script, available online.
-
 # Optional variables
-CODE_COVERAGE_DIRECTORY ?= $(top_builddir)
-CODE_COVERAGE_OUTPUT_FILE ?= $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info
-CODE_COVERAGE_OUTPUT_DIRECTORY ?= $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage
+# run only on top dir
+if CODE_COVERAGE_ENABLED
+ ifeq (\$(abs_builddir), \$(abs_top_builddir))
+CODE_COVERAGE_DIRECTORY ?= \$(top_builddir)
+CODE_COVERAGE_OUTPUT_FILE ?= \$(PACKAGE_NAME)-\$(PACKAGE_VERSION)-coverage.info
+CODE_COVERAGE_OUTPUT_DIRECTORY ?= \$(PACKAGE_NAME)-\$(PACKAGE_VERSION)-coverage
+
 CODE_COVERAGE_BRANCH_COVERAGE ?=
-CODE_COVERAGE_LCOV_SHOPTS_DEFAULT ?= $(if $(CODE_COVERAGE_BRANCH_COVERAGE),\
---rc lcov_branch_coverage=$(CODE_COVERAGE_BRANCH_COVERAGE))
-CODE_COVERAGE_LCOV_SHOPTS ?= $(CODE_COVERAGE_LCOV_SHOPTS_DEFAULT)
-CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH ?= --gcov-tool "$(GCOV)"
-CODE_COVERAGE_LCOV_OPTIONS_DEFAULT ?= $(CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH)
-CODE_COVERAGE_LCOV_OPTIONS ?= $(CODE_COVERAGE_LCOV_OPTIONS_DEFAULT)
+CODE_COVERAGE_LCOV_SHOPTS_DEFAULT ?= \$(if \$(CODE_COVERAGE_BRANCH_COVERAGE),\
+--rc lcov_branch_coverage=\$(CODE_COVERAGE_BRANCH_COVERAGE))
+CODE_COVERAGE_LCOV_SHOPTS ?= \$(CODE_COVERAGE_LCOV_SHOPTS_DEFAULT)
+CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH ?= --gcov-tool \"\$(GCOV)\"
+CODE_COVERAGE_LCOV_OPTIONS_DEFAULT ?= \$(CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH)
+CODE_COVERAGE_LCOV_OPTIONS ?= \$(CODE_COVERAGE_LCOV_OPTIONS_DEFAULT)
 CODE_COVERAGE_LCOV_RMOPTS_DEFAULT ?=
-CODE_COVERAGE_LCOV_RMOPTS ?= $(CODE_COVERAGE_LCOV_RMOPTS_DEFAULT)
+CODE_COVERAGE_LCOV_RMOPTS ?= \$(CODE_COVERAGE_LCOV_RMOPTS_DEFAULT)
 CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT ?=\
-$(if $(CODE_COVERAGE_BRANCH_COVERAGE),\
---rc genhtml_branch_coverage=$(CODE_COVERAGE_BRANCH_COVERAGE))
-CODE_COVERAGE_GENHTML_OPTIONS ?= $(CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT)
+\$(if \$(CODE_COVERAGE_BRANCH_COVERAGE),\
+--rc genhtml_branch_coverage=\$(CODE_COVERAGE_BRANCH_COVERAGE))
+CODE_COVERAGE_GENHTML_OPTIONS ?= \$(CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT)
 CODE_COVERAGE_IGNORE_PATTERN ?=
 
-GITIGNOREFILES ?=
-GITIGNOREFILES += $(CODE_COVERAGE_OUTPUT_FILE) $(CODE_COVERAGE_OUTPUT_DIRECTORY)
-
-code_coverage_v_lcov_cap = $(code_coverage_v_lcov_cap_$(V))
-code_coverage_v_lcov_cap_ = $(code_coverage_v_lcov_cap_$(AM_DEFAULT_VERBOSITY))
-code_coverage_v_lcov_cap_0 = @echo "  LCOV   --capture"\
- $(CODE_COVERAGE_OUTPUT_FILE);
-code_coverage_v_lcov_ign = $(code_coverage_v_lcov_ign_$(V))
-code_coverage_v_lcov_ign_ = $(code_coverage_v_lcov_ign_$(AM_DEFAULT_VERBOSITY))
-code_coverage_v_lcov_ign_0 = @echo "  LCOV   --remove /tmp/*"\
- $(CODE_COVERAGE_IGNORE_PATTERN);
-code_coverage_v_genhtml = $(code_coverage_v_genhtml_$(V))
-code_coverage_v_genhtml_ = $(code_coverage_v_genhtml_$(AM_DEFAULT_VERBOSITY))
-code_coverage_v_genhtml_0 = @echo "  GEN   " $(CODE_COVERAGE_OUTPUT_DIRECTORY);
-code_coverage_quiet = $(code_coverage_quiet_$(V))
-code_coverage_quiet_ = $(code_coverage_quiet_$(AM_DEFAULT_VERBOSITY))
+GITIGNOREFILES = \$(GITIGNOREFILES) \$(CODE_COVERAGE_OUTPUT_FILE) \$(CODE_COVERAGE_OUTPUT_DIRECTORY)
+code_coverage_v_lcov_cap = \$(code_coverage_v_lcov_cap_\$(V))
+code_coverage_v_lcov_cap_ = \$(code_coverage_v_lcov_cap_\$(AM_DEFAULT_VERBOSITY))
+code_coverage_v_lcov_cap_0 = @echo \"  LCOV   --capture\" \$(CODE_COVERAGE_OUTPUT_FILE);
+code_coverage_v_lcov_ign = \$(code_coverage_v_lcov_ign_\$(V))
+code_coverage_v_lcov_ign_ = \$(code_coverage_v_lcov_ign_\$(AM_DEFAULT_VERBOSITY))
+code_coverage_v_lcov_ign_0 = @echo \"  LCOV   --remove /tmp/*\" \$(CODE_COVERAGE_IGNORE_PATTERN);
+code_coverage_v_genhtml = \$(code_coverage_v_genhtml_\$(V))
+code_coverage_v_genhtml_ = \$(code_coverage_v_genhtml_\$(AM_DEFAULT_VERBOSITY))
+code_coverage_v_genhtml_0 = @echo \"  GEN   \" \"\$(CODE_COVERAGE_OUTPUT_DIRECTORY)\";
+code_coverage_quiet = \$(code_coverage_quiet_\$(V))
+code_coverage_quiet_ = \$(code_coverage_quiet_\$(AM_DEFAULT_VERBOSITY))
 code_coverage_quiet_0 = --quiet
 
 # sanitizes the test-name: replaces with underscores: dashes and dots
-code_coverage_sanitize = $(subst -,_,$(subst .,_,$(1)))
+code_coverage_sanitize = \$(subst -,_,\$(subst .,_,\$(1)))
 
 # Use recursive makes in order to ignore errors during check
-check-code-coverage:'"$CODE_COVERAGE_RULES_CHECK"'
+check-code-coverage:
+	-\$(AM_V_at)\$(MAKE) \$(AM_MAKEFLAGS) -k check
+	\$(AM_V_at)\$(MAKE) \$(AM_MAKEFLAGS) code-coverage-capture
 
 # Capture code coverage data
-code-coverage-capture: code-coverage-capture-hook'"$CODE_COVERAGE_RULES_CAPTURE"'
+code-coverage-capture: code-coverage-capture-hook
+	\$(code_coverage_v_lcov_cap)\$(LCOV) \$(code_coverage_quiet) \$(addprefix --directory ,\$(CODE_COVERAGE_DIRECTORY)) --capture --output-file \"\$(CODE_COVERAGE_OUTPUT_FILE).tmp\" --test-name \"\$(call code_coverage_sanitize,\$(PACKAGE_NAME)-\$(PACKAGE_VERSION))\" --no-checksum --compat-libtool \$(CODE_COVERAGE_LCOV_SHOPTS) \$(CODE_COVERAGE_LCOV_OPTIONS)
+	\$(code_coverage_v_lcov_ign)\$(LCOV) \$(code_coverage_quiet) \$(addprefix --directory ,\$(CODE_COVERAGE_DIRECTORY)) --remove \"\$(CODE_COVERAGE_OUTPUT_FILE).tmp\" \"/tmp/*\" \$(CODE_COVERAGE_IGNORE_PATTERN) --output-file \"\$(CODE_COVERAGE_OUTPUT_FILE)\" \$(CODE_COVERAGE_LCOV_SHOPTS) \$(CODE_COVERAGE_LCOV_RMOPTS)
+	-@rm -f \"\$(CODE_COVERAGE_OUTPUT_FILE).tmp\"
+	\$(code_coverage_v_genhtml)LANG=C \$(GENHTML) \$(code_coverage_quiet) \$(addprefix --prefix ,\$(CODE_COVERAGE_DIRECTORY)) --output-directory \"\$(CODE_COVERAGE_OUTPUT_DIRECTORY)\" --title \"\$(PACKAGE_NAME)-\$(PACKAGE_VERSION) Code Coverage\" --legend --show-details \"\$(CODE_COVERAGE_OUTPUT_FILE)\" \$(CODE_COVERAGE_GENHTML_OPTIONS)
+	@echo \"file://\$(abs_builddir)/\$(CODE_COVERAGE_OUTPUT_DIRECTORY)/index.html\"
+
+code-coverage-clean:
+	-\$(LCOV) --directory \$(top_builddir) -z
+	-rm -rf \"\$(CODE_COVERAGE_OUTPUT_FILE)\" \"\$(CODE_COVERAGE_OUTPUT_FILE).tmp\" \"\$(CODE_COVERAGE_OUTPUT_DIRECTORY)\"
+	-find . \$ -name \"*.gcda\" -o -name \"*.gcno\" -o -name \"*.gcov\" \$ -delete
+
+code-coverage-dist-clean:
+
+AM_DISTCHECK_CONFIGURE_FLAGS = \$(AM_DISTCHECK_CONFIGURE_FLAGS) --disable-code-coverage
+ else # ifneq (\$(abs_builddir), \$(abs_top_builddir))
+check-code-coverage:
 
+code-coverage-capture: code-coverage-capture-hook
+
+code-coverage-clean:
+
+code-coverage-dist-clean:
+ endif # ifeq (\$(abs_builddir), \$(abs_top_builddir))
+else #! CODE_COVERAGE_ENABLED
+# Use recursive makes in order to ignore errors during check
+check-code-coverage:
+	@echo \"Need to reconfigure with --enable-code-coverage\"
+# Capture code coverage data
+code-coverage-capture: code-coverage-capture-hook
+	@echo \"Need to reconfigure with --enable-code-coverage\"
+
+code-coverage-clean:
+
+code-coverage-dist-clean:
+
+endif #CODE_COVERAGE_ENABLED
 # Hook rule executed before code-coverage-capture, overridable by the user
 code-coverage-capture-hook:
 
-'"$CODE_COVERAGE_RULES_CLEAN"'
+.PHONY: check-code-coverage code-coverage-capture code-coverage-dist-clean code-coverage-clean code-coverage-capture-hook
+)
+)
+
+AC_DEFUN(_AX_CODE_COVERAGE_ENABLED,
+	AX_CHECK_GNU_MAKE(,AC_MSG_ERROR(not using GNU make that is needed for coverage))
+	AC_REQUIRE(AX_ADD_AM_MACRO_STATIC)
+	# check for gcov
+	AC_CHECK_TOOL(GCOV,
+		  $_AX_CODE_COVERAGE_GCOV_PROG_WITH,
+		  :)
+	AS_IF(test "X$GCOV" = "X:",
+	      AC_MSG_ERROR(gcov is needed to do coverage))
+	AC_SUBST(GCOV)
+
+	dnl Check if gcc is being used
+	AS_IF( test "$GCC" = "no" , 
+		AC_MSG_ERROR(not compiling with gcc, which is required for gcov code coverage)
+	      )
+
+	AC_CHECK_PROG(LCOV, lcov, lcov)
+	AC_CHECK_PROG(GENHTML, genhtml, genhtml)
+
+	AS_IF( test x"$LCOV" = x , 
+		AC_MSG_ERROR(To enable code coverage reporting you must have lcov installed)
+	      )
+
+	AS_IF( test x"$GENHTML" = x , 
+		AC_MSG_ERROR(Could not find genhtml from the lcov package)
+	)
+
+	dnl Build the code coverage flags
+	dnl Define CODE_COVERAGE_LDFLAGS for backwards compatibility
+	CODE_COVERAGE_CPPFLAGS="-DNDEBUG"
+	CODE_COVERAGE_CFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
+	CODE_COVERAGE_CXXFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
+	CODE_COVERAGE_LIBS="-lgcov"
 
-A''M_DISTCHECK_CONFIGURE_FLAGS ?=
-A''M_DISTCHECK_CONFIGURE_FLAGS += --disable-code-coverage
+	AC_SUBST(CODE_COVERAGE_CPPFLAGS)
+	AC_SUBST(CODE_COVERAGE_CFLAGS)
+	AC_SUBST(CODE_COVERAGE_CXXFLAGS)
+	AC_SUBST(CODE_COVERAGE_LIBS)
+)
+
+AC_DEFUN(AX_CODE_COVERAGE,
+	dnl Check for --enable-code-coverage
+
+	# allow to override gcov location
+	AC_ARG_WITH(gcov,
+	  AS_HELP_STRING(--with-gcov=GCOV, use given GCOV for coverage (GCOV=gcov).),
+	  _AX_CODE_COVERAGE_GCOV_PROG_WITH=$with_gcov,
+	  _AX_CODE_COVERAGE_GCOV_PROG_WITH=gcov)
+
+	AC_MSG_CHECKING(whether to build with code coverage support)
+	AC_ARG_ENABLE(code-coverage,
+	  AS_HELP_STRING(--enable-code-coverage,
+	  Whether to enable code coverage support),,
+	  enable_code_coverage=no)
+
+	AM_CONDITIONAL(CODE_COVERAGE_ENABLED, test "x$enable_code_coverage" = xyes)
+	AC_SUBST(CODE_COVERAGE_ENABLED, $enable_code_coverage)
+	AC_MSG_RESULT($enable_code_coverage)
 
-.PHONY: check-code-coverage code-coverage-capture code-coverage-capture-hook code-coverage-clean
-'
+	AS_IF( test "x$enable_code_coverage" = xyes , 
+		_AX_CODE_COVERAGE_ENABLED
+	      )
 
-	AC_SUBST(CODE_COVERAGE_RULES)
-	m4_ifdef(_AM_SUBST_NOTMAKE, _AM_SUBST_NOTMAKE(CODE_COVERAGE_RULES))
+	_AX_CODE_COVERAGE_RULES
 )

_service:tar_scm:tpm2-tools-5.0.tar.gz/m4/libtool.m4 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/m4/libtool.m4 Changed

@@ -1041,8 +1041,8 @@
 _LT_EOF
       echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD
       $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD
-      echo "$AR cru libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
-      $AR cru libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
+      echo "$AR cr libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
+      $AR cr libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
       echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD
       $RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD
       cat > conftest.c << _LT_EOF
@@ -1492,7 +1492,7 @@
 m4_defun(_LT_PROG_AR,
 AC_CHECK_TOOLS(AR, ar, false)
 : ${AR=ar}
-: ${AR_FLAGS=cru}
+: ${AR_FLAGS=cr}
 _LT_DECL(, AR, 1, The archiver)
 _LT_DECL(, AR_FLAGS, 1, Flags to create an archive)
 
@@ -4063,7 +4063,8 @@
   if AC_TRY_EVAL(ac_compile); then
     # Now try to grab the symbols.
     nlist=conftest.nm
-    if AC_TRY_EVAL(NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) && test -s "$nlist"; then
+    $ECHO "$as_me:$LINENO: $NM conftest.$ac_objext | $lt_cv_sys_global_symbol_pipe > $nlist" >&AS_MESSAGE_LOG_FD
+    if eval "$NM" conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist 2>&AS_MESSAGE_LOG_FD && test -s "$nlist"; then
       # Try sorting and uniquifying the output.
       if sort "$nlist" | uniq > "$nlist"T; then
 	mv -f "$nlist"T "$nlist"
@@ -4703,6 +4704,12 @@
 	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
 	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
         ;;
+      # flang / f18. f95 an alias for gfortran or flang on Debian
+      flang* | f18* | f95*)
+	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
+	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
+	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
+        ;;
       # icc used to be incompatible with GCC.
       # ICC 10 doesn't accept -KPIC any more.
       icc* | ifort*)
@@ -6438,7 +6445,7 @@
       # Commands to make compiler produce verbose output that lists
       # what "hidden" libraries, object files and flags are used when
       # linking a shared library.
-      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 
     else
       GXX=no
@@ -6813,7 +6820,7 @@
             # explicitly linking system object files so we need to strip them
             # from the output so that they don't get included in the library
             # dependencies.
-            output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+            output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
             ;;
           *)
             if test yes = "$GXX"; then
@@ -6878,7 +6885,7 @@
 	    # explicitly linking system object files so we need to strip them
 	    # from the output so that they don't get included in the library
 	    # dependencies.
-	    output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+	    output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
 	    ;;
           *)
 	    if test yes = "$GXX"; then
@@ -7217,7 +7224,7 @@
 	      # Commands to make compiler produce verbose output that lists
 	      # what "hidden" libraries, object files and flags are used when
 	      # linking a shared library.
-	      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 
 	    else
 	      # FIXME: insert proper C++ library support
@@ -7301,7 +7308,7 @@
 	        # Commands to make compiler produce verbose output that lists
 	        # what "hidden" libraries, object files and flags are used when
 	        # linking a shared library.
-	        output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	        output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	      else
 	        # g++ 2.7 appears to require '-G' NOT '-shared' on this
 	        # platform.
@@ -7312,7 +7319,7 @@
 	        # Commands to make compiler produce verbose output that lists
 	        # what "hidden" libraries, object files and flags are used when
 	        # linking a shared library.
-	        output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	        output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	      fi
 
 	      _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $wl$libdir'

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/common/alg.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/common/alg.md Changed

@@ -8,7 +8,7 @@
 ## Simple specifiers
 These are strings with no additional specification data. When creating objects,
 non-specified portions of an object are assumed to defaults. You can find the
-list of known "Simple Specifiers Below".
+list of known "Simple Specifiers" below.
 
 ### Asymmetric
   * rsa
@@ -17,6 +17,7 @@
 ### Symmetric
   * aes
   * camellia
+  * sm4
 
 ### Hashing Algorithms
   * sha1
@@ -38,6 +39,7 @@
   * ecdsa
   * ecdaa
   * ecschnorr
+  * sm2
 
 ### Asymmetric Encryption Schemes
   * oaep
@@ -70,15 +72,20 @@
       specified, defaults to *null*.
   * aes192`<mode>` - Same as aes128`<mode>`, except for a 192 bit key size.
   * aes256`<mode>` - Same as aes128`<mode>`, except for a 256 bit key size.
+  * sm4 - Default SM4: sm4128
+  * sm4128 or sm4_128 `<mode>` - 128 bit SM4 with optional mode (*ctr*|*ofb*|*cbc*|*cfb*|*ecb*). If mode is not
+      specified, defaults to *null*.
   * ecc - Elliptical Curve, defaults to ecc256.
-  * ecc192 - 192 bit ECC
-  * ecc224 - 224 bit ECC
-  * ecc256 - 256 bit ECC
-  * ecc384 - 384 bit ECC
-  * ecc521 - 521 bit ECC
+  * ecc192 or ecc_nist_p192 - 192 bit ECC NIST curve
+  * ecc224 or ecc_nist_p224 - 224 bit ECC NIST curve
+  * ecc256 or ecc_nist_p256 - 256 bit ECC NIST curve
+  * ecc384 or ecc_nist_p384 - 384 bit ECC NIST curve
+  * ecc521 or ecc_nist_p521 - 521 bit ECC NIST curve
+  * ecc_sm2 or ecc_sm2_p256 - 256 bit SM2 curve
   * rsa - Default RSA: rsa2048
   * rsa1024 - RSA with 1024 bit keysize.
   * rsa2048 - RSA with 2048 bit keysize.
+  * rsa3072 - RSA with 3072 bit keysize.
   * rsa4096 - RSA with 4096 bit keysize.
 
 ### Scheme Specifiers
@@ -98,6 +105,7 @@
   * rsapss
   * ecdsa
   * ecschnorr
+  * sm2
 
 #### Multiple Option Scheme Specifiers
 This scheme specifier is followed by a count (max size UINT16) then followed by a dash(-) and a valid hash algorithm.

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/common/authorizations.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/common/authorizations.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/common/footer.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/common/footer.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/common/nv-attrs.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/common/nv-attrs.md Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/man/common/pcrs_format.md Added

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2.1 Changed

@@ -1,265 +1,268 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2\f(1) \- A single small executable that combines the various
+\fBtpm2\fR(1) \- A single small executable that combines the various
 tpm2\-tools much like a BusyBox that provides a fairly complete
 environment for any small or embedded system.
 .SH SYNOPSIS
 .PP
-\fBtpm2\f \fIOPTIONS\f \fIARGUMENTS\f
+\fBtpm2\fR \fIOPTIONS\fR \fIARGUMENTS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2\f(1) \- To ease installation of tpm2\-tools in initrd or
+\fBtpm2\fR(1) \- To ease installation of tpm2\-tools in initrd or
 embedded systems where size\-optimization and limited resources are
 important, it is convenient to have a single executable that can
 dispatch the various TPM2 functionalities specified by the argument
 which is one of the available tool names.
 .PP
 The options and arguments that follow are either the \fBcommon
-options\f or those specific to the \fBtool name\f.
+options\fR or those specific to the \fBtool name\fR.
 .PP
-It is important to note that individual tools with prefix \fBtpm2_\f
-can still be invoked, however, they are now soft\-linked to this
-\fBtpm2\f executable.
+It is important to note that individual tools with prefix
+\fBtpm2_\fR can still be invoked, however, they are now soft\-linked
+to this \fBtpm2\fR executable.
 And so unlike BusyBox, full functionality of the individual tools is
 available in the executable.
-For example: \fBtpm2_getrandom 8\f can alternatively be specified as
-\fBtpm2 getrandom 8\f.
+For example: \fBtpm2_getrandom 8\fR can alternatively be specified
+as \fBtpm2 getrandom 8\fR.
 .SH ARGUMENTS
 .PP
 List of possible tool names.
 NOTE: Specify only one of these.
 Look at examples.
 .PP
-\fBcertifyX509certutil\f
+\fBcertifyX509certutil\fR
 .PP
-\fBcheckquote\f
+\fBcheckquote\fR
 .PP
-\fBeventlog\f
+\fBeventlog\fR
 .PP
-\fBprint\f
+\fBprint\fR
 .PP
-\fBrc_decode\f
+\fBrc_decode\fR
 .PP
-\fBactivatecredential\f
+\fBactivatecredential\fR
 .PP
-\fBcertify\f
+\fBcertify\fR
 .PP
-\fBchangeauth\f
+\fBchangeauth\fR
 .PP
-\fBchangeeps\f
+\fBchangeeps\fR
 .PP
-\fBchangepps\f
+\fBchangepps\fR
 .PP
-\fBclear\f
+\fBclear\fR
 .PP
-\fBclearcontrol\f
+\fBclearcontrol\fR
 .PP
-\fBclockrateadjust\f
+\fBclockrateadjust\fR
 .PP
-\fBcreate\f
+\fBcreate\fR
 .PP
-\fBcreateak\f
+\fBcreateak\fR
 .PP
-\fBcreateek\f
+\fBcreateek\fR
 .PP
-\fBcreatepolicy\f
+\fBcreatepolicy\fR
 .PP
-\fBsetprimarypolicy\f
+\fBsetprimarypolicy\fR
 .PP
-\fBcreateprimary\f
+\fBcreateprimary\fR
 .PP
-\fBdictionarylockout\f
+\fBdictionarylockout\fR
 .PP
-\fBduplicate\f
+\fBduplicate\fR
 .PP
-\fBgetcap\f
+\fBgetcap\fR
 .PP
-\fBgettestresult\f
+\fBgettestresult\fR
 .PP
-\fBencryptdecrypt\f
+\fBencryptdecrypt\fR
 .PP
-\fBevictcontrol\f
+\fBevictcontrol\fR
 .PP
-\fBflushcontext\f
+\fBflushcontext\fR
 .PP
-\fBgetekcertificate\f
+\fBgetekcertificate\fR
 .PP
-\fBgetrandom\f
+\fBgetrandom\fR
 .PP
-\fBgettime\f
+\fBgettime\fR
 .PP
-\fBhash\f
+\fBhash\fR
 .PP
-\fBhierarchycontrol\f
+\fBhierarchycontrol\fR
 .PP
-\fBhmac\f
+\fBhmac\fR
 .PP
-\fBimport\f
+\fBimport\fR
 .PP
-\fBincrementalselftest\f
+\fBincrementalselftest\fR
 .PP
-\fBload\f
+\fBload\fR
 .PP
-\fBloadexternal\f
+\fBloadexternal\fR
 .PP
-\fBmakecredential\f
+\fBmakecredential\fR
 .PP
-\fBnvdefine\f
+\fBnvdefine\fR
 .PP
-\fBnvextend\f
+\fBnvextend\fR
 .PP
-\fBnvincrement\f
+\fBnvincrement\fR
 .PP
-\fBnvreadpublic\f
+\fBnvreadpublic\fR
 .PP
-\fBnvread\f
+\fBnvread\fR
 .PP
-\fBnvreadlock\f
+\fBnvreadlock\fR
 .PP
-\fBnvundefine\f
+\fBnvundefine\fR
 .PP
-\fBnvwrite\f
+\fBnvwrite\fR
 .PP
-\fBnvwritelock\f
+\fBnvwritelock\fR
 .PP
-\fBnvsetbits\f
+\fBnvsetbits\fR
 .PP
-\fBpcrallocate\f
+\fBpcrallocate\fR
 .PP
-\fBpcrevent\f
+\fBpcrevent\fR
 .PP
-\fBpcrextend\f
+\fBpcrextend\fR
 .PP
-\fBpcrread\f
+\fBpcrread\fR
 .PP
-\fBpcrreset\f
+\fBpcrreset\fR
 .PP
-\fBpolicypcr\f
+\fBpolicypcr\fR
 .PP
-\fBpolicyauthorize\f
+\fBpolicyauthorize\fR
 .PP
-\fBpolicyauthorizenv\f
+\fBpolicyauthorizenv\fR
 .PP
-\fBpolicynv\f
+\fBpolicynv\fR
 .PP
-\fBpolicycountertimer\f
+\fBpolicycountertimer\fR
 .PP
-\fBpolicyor\f
+\fBpolicyor\fR
 .PP
-\fBpolicynamehash\f
+\fBpolicynamehash\fR
 .PP
-\fBpolicytemplate\f
+\fBpolicytemplate\fR
 .PP
-\fBpolicycphash\f
+\fBpolicycphash\fR
 .PP
-\fBpolicypassword\f
+\fBpolicypassword\fR
 .PP
-\fBpolicysigned\f
+\fBpolicysigned\fR
 .PP
-\fBpolicyticket\f
+\fBpolicyticket\fR
 .PP
-\fBpolicyauthvalue\f
+\fBpolicyauthvalue\fR
 .PP
-\fBpolicysecret\f
+\fBpolicysecret\fR
 .PP
-\fBpolicyrestart\f
+\fBpolicyrestart\fR
 .PP
-\fBpolicycommandcode\f
+\fBpolicycommandcode\fR
 .PP
-\fBpolicynvwritten\f
+\fBpolicynvwritten\fR
 .PP
-\fBpolicyduplicationselect\f
+\fBpolicyduplicationselect\fR
 .PP
-\fBpolicylocality\f
+\fBpolicylocality\fR
 .PP
-\fBquote\f
+\fBquote\fR
 .PP
-\fBreadclock\f
+\fBreadclock\fR
 .PP
-\fBreadpublic\f
+\fBreadpublic\fR
 .PP
-\fBrsadecrypt\f
+\fBrsadecrypt\fR
 .PP
-\fBrsaencrypt\f
+\fBrsaencrypt\fR
 .PP
-\fBsend\f
+\fBsend\fR
 .PP
-\fBselftest\f
+\fBselftest\fR
 .PP
-\fBsetclock\f
+\fBsessionconfig\fR
 .PP
-\fBshutdown\f
+\fBsetclock\fR
 .PP
-\fBsign\f
+\fBshutdown\fR
 .PP
-\fBcertifycreation\f
+\fBsign\fR
 .PP
-\fBnvcertify\f
+\fBcertifycreation\fR
 .PP
-\fBstartauthsession\f
+\fBnvcertify\fR
 .PP
-\fBstartup\f
+\fBstartauthsession\fR
 .PP
-\fBstirrandom\f
+\fBstartup\fR
 .PP
-\fBtestparms\f
+\fBstirrandom\fR
 .PP
-\fBunseal\f
+\fBtestparms\fR
 .PP
-\fBverifysignature\f
+\fBunseal\fR
 .PP
-\fBsetcommandauditstatus\f
+\fBverifysignature\fR
 .PP
-\fBgetcommandauditdigest\f
+\fBsetcommandauditstatus\fR
 .PP
-\fBgetsessionauditdigest\f
+\fBgetcommandauditdigest\fR
 .PP
-\fBgeteccparameters\f
+\fBgetsessionauditdigest\fR
 .PP
-\fBecephemeral\f
+\fBgeteccparameters\fR
 .PP
-\fBcommit\f
+\fBecephemeral\fR
 .PP
-\fBecdhkeygen\f
+\fBcommit\fR
 .PP
-\fBecdhzgen\f
+\fBecdhkeygen\fR
 .PP
-\fBzgen2phase\f
+\fBecdhzgen\fR
+.PP
+\fBzgen2phase\fR
 .SS References
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -267,18 +270,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -295,84 +298,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -380,15 +390,15 @@
 .IP
 .nf
 \fC
-tpm2\ getrandom\ 8\ |\ xxd\ \-p
-\f
+tpm2 getrandom 8 | xxd \-p
+\fR
 .fi
 .SS Send a TPM Startup Command with flags TPM2_SU_CLEAR
 .IP
 .nf
 \fC
-tpm2\ startup\ \-c
-\f
+tpm2 startup \-c
+\fR
 .fi
 .SH Returns
 .PP
@@ -411,4 +421,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_activatecredential.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_activatecredential.1 Changed

@@ -1,17 +1,17 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_activatecredential" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_activatecredential\f(1) \- Enables access to the credential
+\fBtpm2_activatecredential\fR(1) \- Enables access to the credential
 qualifier to recover the credential secret.
 .SH SYNOPSIS
 .PP
-\fBtpm2_activatecredential\f \fIOPTIONS\f
+\fBtpm2_activatecredential\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_activatecredential\f(1) \- Enables the association of a
+\fBtpm2_activatecredential\fR(1) \- Enables the association of a
 credential with an object in a way that ensures that the TPM has
 validated the parameters of the credentialed object.
 In an attestation scheme , this guarantees the registrar that the
@@ -19,62 +19,77 @@
 TPM.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-credentialedkey\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-credentialedkey\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Object associated with the created certificate by CA.
 .RE
 .IP \bu 2
-\fB\-C\f, \fB\-\-credentialkey\-context\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-credentialkey\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The loaded object used to decrypt the random seed.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-credentialedkey\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-credentialedkey\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
-The auth value of the credentialed object specified with \fB\-c\f.
+The auth value of the credentialed object specified with \fB\-c\fR.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-credentialkey\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-credentialkey\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
-The auth value of the credential object specified with \fB\-C\f.
+The auth value of the credential object specified with \fB\-C\fR.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-credential\-blob\f=\fIFILE\f:
+\fB\-i\fR, \fB\-\-credential\-blob\fR=\fIFILE\fR:
 .RS 2
 .PP
 The input file path containing the credential blob and secret created
-with the \fBtpm2_makecredential\f(1) tool.
+with the \fBtpm2_makecredential\fR(1) tool.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-certinfo\-data\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-certinfo\-data\fR=\fIFILE\fR:
 .RS 2
 .PP
 The output file path to save the decrypted credential secret
 information.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash, unless rphash is also required.
+.RE
+.IP \bu 2
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
 .RE
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -87,8 +102,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -97,45 +111,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -143,69 +157,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -214,40 +230,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -255,18 +272,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -283,112 +300,119 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-echo\ "12345678"\ >\ secret.data
+echo \dq12345678\dq > secret.data
 
-tpm2_createek\ \-Q\ \-c\ 0x81010001\ \-G\ rsa\ \-u\ ek.pub
+tpm2_createek \-Q \-c 0x81010001 \-G rsa \-u ek.pub
 
-tpm2_createak\ \-C\ 0x81010001\ \-c\ ak.ctx\ \-G\ rsa\ \-g\ sha256\ \-s\ rsassa\ \-u\ ak.pub\ \\
-\-n\ ak.name\ \-p\ akpass>\ ak.out
+tpm2_createak \-C 0x81010001 \-c ak.ctx \-G rsa \-g sha256 \-s rsassa \-u ak.pub \rs
+\-n ak.name \-p akpass> ak.out
 
-file_size=`stat\ \-\-printf="%s"\ ak.name`
-loaded_key_name=`cat\ ak.name\ |\ xxd\ \-p\ \-c\ $file_size`
+file_size=\gastat \-\-printf=\dq%s\dq ak.name\ga
+loaded_key_name=\gacat ak.name | xxd \-p \-c $file_size\ga
 
-tpm2_makecredential\ \-Q\ \-e\ ek.pub\ \ \-s\ secret.data\ \-n\ $loaded_key_name\ \\
-\-o\ mkcred.out
+tpm2_makecredential \-Q \-e ek.pub  \-s secret.data \-n $loaded_key_name \rs
+\-o mkcred.out
 
-tpm2_startauthsession\ \-\-policy\-session\ \-S\ session.ctx
+tpm2_startauthsession \-\-policy\-session \-S session.ctx
 
-tpm2_policysecret\ \-S\ session.ctx\ \-c\ e
+tpm2_policysecret \-S session.ctx \-c e
 
-tpm2_activatecredential\ \-Q\ \-c\ ak.ctx\ \-C\ 0x81010001\ \-i\ mkcred.out\ \\
-\-o\ actcred.out\ \-p\ akpass\ \-P"session:session.ctx"
+tpm2_activatecredential \-Q \-c ak.ctx \-C 0x81010001 \-i mkcred.out \rs
+\-o actcred.out \-p akpass \-P\dqsession:session.ctx\dq
 
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -411,4 +435,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_certify.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_certify.1 Changed

@@ -1,95 +1,124 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_certify" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_certify\f(1) \- Prove that an object is loaded in the TPM.
+\fBtpm2_certify\fR(1) \- Prove that an object is loaded in the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_certify\f \fIOPTIONS\f
+\fBtpm2_certify\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_certify\f(1) \- Proves that an object with a specific
-\fINAME\f is loaded in the TPM.
+\fBtpm2_certify\fR(1) \- Proves that an object with a specific
+\fINAME\fR is loaded in the TPM.
 By certifying that the object is loaded, the TPM warrants that a public
-area with a given \fINAME\f is self\-consistent and associated with
+area with a given \fINAME\fR is self\-consistent and associated with
 a valid sensitive area.
 .PP
-If a relying party has a public area that has the same \fINAME\f as
-a \fINAME\f certified with this command, then the values in that
+If a relying party has a public area that has the same \fINAME\fR as
+a \fINAME\fR certified with this command, then the values in that
 public area are correct.
 An object that only has its public area loaded cannot be certified.
 .SH OPTIONS
 .PP
 These options control the certification:
 .IP \bu 2
-\fB\-c\f, \fB\-\-certifiedkey\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-certifiedkey\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The object to be certified.
 .RE
 .IP \bu 2
-\fB\-C\f, \fB\-\-signingkey\-context\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-signingkey\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The key used to sign the attestation structure.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-certifiedkey\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-certifiedkey\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value provided for the object specified with \-c.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm to use in signature generation.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-signingkey\-auth\f=\fIAUTH\f:
+\fB\-\-scheme\fR=\fIALGORITHM\fR:
+.RS 2
+.PP
+The signing scheme used to sign the message.
+Optional.
+Signing schemes should follow the \lqformatting standards\rq, see
+section \lqAlgorithm Specifiers\rq.
+Also, see section \lqSupported Signing Schemes\rq for a list of
+supported signature schemes.
+If specified, the signature scheme must match the key type.
+If left unspecified, a default signature scheme for the key type will be
+used.
+.RE
+.IP \bu 2
+\fB\-p\fR, \fB\-\-signingkey\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the signing key specified with \-C.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-attestation\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-attestation\fR=\fIFILE\fR:
 .RS 2
 .PP
 Output file name for the attestation data.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-signature\f=\fIFILE\f:
+\fB\-s\fR, \fB\-\-signature\fR=\fIFILE\fR:
 .RS 2
 .PP
 Output file name for the signature data.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-format\f=\fIFORMAT\f:
+\fB\-f\fR, \fB\-\-format\fR=\fIFORMAT\fR:
 .RS 2
 .PP
 Format selection for the signature output file.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash, unless rphash is also required.
+.RE
+.IP \bu 2
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
 .RE
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -102,8 +131,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -112,45 +140,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -158,69 +186,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -229,13 +259,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -246,7 +276,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -257,6 +287,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -290,6 +322,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -317,7 +351,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -326,27 +360,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -354,21 +396,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -381,6 +425,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -393,59 +439,59 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH Signature Format Specifiers
 .PP
 Format selection for the signature output file.
-\fBtss\f (the default) will output a binary blob according to the
+\fBtss\fR (the default) will output a binary blob according to the
 TPM 2.0 specification and any potential compiler padding.
-The option \fBplain\f will output the plain signature data as
+The option \fBplain\fR will output the plain signature data as
 defined by the used cryptographic algorithm.
-signature \fIFORMAT\f.
+signature \fIFORMAT\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -453,18 +499,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -481,84 +527,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -567,15 +620,15 @@
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-Q\ \-C\ e\ \-g\ sha256\ \-G\ rsa\ \-c\ primary.ctx
+tpm2_createprimary \-Q \-C e \-g sha256 \-G rsa \-c primary.ctx
 
-tpm2_create\ \-Q\ \-g\ sha256\ \-G\ rsa\ \-u\ certify.pub\ \-r\ certify.priv\ \-C\ primary.ctx
+tpm2_create \-Q \-g sha256 \-G rsa \-u certify.pub \-r certify.priv \-C primary.ctx
 
-tpm2_load\ \-Q\ \-C\ primary.ctx\ \-u\ certify.pub\ \-r\ certify.priv\ \-n\ certify.name\ \\
-\-c\ certify.ctx
+tpm2_load \-Q \-C primary.ctx \-u certify.pub \-r certify.priv \-n certify.name \rs
+\-c certify.ctx
 
-tpm2_certify\ \-Q\ \-c\ primary.ctx\ \-C\ certify.ctx\ \-g\ sha256\ \-o\ attest.out\ \-s\ sig.out
-\f
+tpm2_certify \-Q \-c primary.ctx \-C certify.ctx \-g sha256 \-o attest.out \-s sig.out
+\fR
 .fi
 .SH Returns
 .PP
@@ -598,4 +651,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_certifyX509certutil.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_certifyX509certutil.1 Changed

@@ -1,17 +1,17 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_certifyX509certutil" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_certifyX509certutil\f(1) \- Generate partial X509
+\fBtpm2_certifyX509certutil\fR(1) \- Generate partial X509
 certificate.
 .SH SYNOPSIS
 .PP
-\fBtpm2_certifyX509certutil\f \fIOPTIONS\f
+\fBtpm2_certifyX509certutil\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_certifyX509certutil\f(1) \- Generates a partial certificate
+\fBtpm2_certifyX509certutil\fR(1) \- Generates a partial certificate
 that is suitable as the third input parameter for TPM2_certifyX509
 command.
 The certificate data is written into a file in DER format and can be
@@ -19,87 +19,88 @@
 .IP
 .nf
 \fC
-openssl\ asn1parse\ \-in\ partial_cert.der\ \-inform\ DER
-\f
+openssl asn1parse \-in partial_cert.der \-inform DER
+\fR
 .fi
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-o\f, \fB\-\-outcert\f=\fISTRING\f: The output file
+\fB\-o\fR, \fB\-\-outcert\fR=\fISTRING\fR: The output file
 where the certificate will be written to.
 The default is partial_cert.der Optional parameter.
 .IP \bu 2
-\fB\-d\f, \fB\-\-days\f=\fINUMBER\f: The number of days the
-certificate will be valid starting from today.
+\fB\-d\fR, \fB\-\-days\fR=\fINUMBER\fR: The number of days
+the certificate will be valid starting from today.
 The default is 3560 (10 years) Optional parameter.
 .IP \bu 2
-\fB\-i\f, \fB\-\-issuer\f=\fISTRING\f: The ISSUER entry for
-the cert in the following format: \-\-issuer="C=US;O=org;OU=Org
-unit;CN=cname" Supported fields are:
+\fB\-i\fR, \fB\-\-issuer\fR=\fISTRING\fR: The ISSUER entry
+for the cert in the following format: \enissuer=\lqC=US;O=org;OU=Org
+unit;CN=cname\rq Supported fields are:
 .RS 2
 .IP \bu 2
-C \- "Country", max size = 2
+C \- \lqCountry\rq, max size = 2
 .IP \bu 2
-O \- "Org", max size = 8
+O \- \lqOrg\rq, max size = 8
 .IP \bu 2
-OU \- "Org Unit", max size = 8
+OU \- \lqOrg Unit\rq, max size = 8
 .IP \bu 2
-CN \- "Common Name", max size = 8 The files need to be separated with
-semicolon.
+CN \- \lqCommon Name\rq, max size = 8 The files need to be separated
+with semicolon.
 At list one supported field is required for the option to be valid.
 Optional parameter.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-subject\f=\fISTRING\f: The SUBJECT for the
-cert in the following format: \-\-subject="C=US;O=org;OU=Org
-unit;CN=cname" Supported fields are:
+\fB\-s\fR, \fB\-\-subject\fR=\fISTRING\fR: The SUBJECT for
+the cert in the following format: \ensubject=\lqC=US;O=org;OU=Org
+unit;CN=cname\rq Supported fields are:
 .RS 2
 .IP \bu 2
-C \- "Country", max size = 2
+C \- \lqCountry\rq, max size = 2
 .IP \bu 2
-O \- "Org", max size = 8
+O \- \lqOrg\rq, max size = 8
 .IP \bu 2
-OU \- "Org Unit", max size = 8
+OU \- \lqOrg Unit\rq, max size = 8
 .IP \bu 2
-CN \- "Common Name", max size = 8 The files need to be separated with
-semicolon.
+CN \- \lqCommon Name\rq, max size = 8 The files need to be separated
+with semicolon.
 At list one supported field is required for the option to be valid.
 Optional parameter.
 .RE
 .IP \bu 2
-\fBARGUMENT\f No arguments required.
+\fBARGUMENT\fR No arguments required.
 .SS References
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -109,8 +110,8 @@
 .IP
 .nf
 \fC
-tpm2\ certifyX509certutil\ \-o\ partial_cert.der\ \-d\ 356
-\f
+tpm2 certifyX509certutil \-o partial_cert.der \-d 356
+\fR
 .fi
 .SH Returns
 .PP
@@ -133,4 +134,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_certifycreation.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_certifycreation.1 Changed

@@ -1,89 +1,89 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_certifycreation" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_certifycreation\f(1) \- Attest the association between a
+\fBtpm2_certifycreation\fR(1) \- Attest the association between a
 loaded public area and the provided hash of the creation data.
 .SH SYNOPSIS
 .PP
-\fBtpm2_certifycreation\f \fIOPTIONS\f
+\fBtpm2_certifycreation\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_certifycreation\f(1) \- Attest the association between a
+\fBtpm2_certifycreation\fR(1) \- Attest the association between a
 loaded public area and the provided hash of the creation data.
 The creation data and the creation ticket is produced when creating the
 object.
-The object itself is created with either \fBTPM2_CreatePrimary\f or
-\fBTPM2_Create\f commands.
+The object itself is created with either \fBTPM2_CreatePrimary\fR or
+\fBTPM2_Create\fR commands.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-signingkey\-context\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-signingkey\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Context object pointing to the key used that signs the attestation.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-signingkey\-auth\f\fIAUTH\f:
+\fB\-P\fR, \fB\-\-signingkey\-auth\fR_AUTH_:
 .RS 2
 .PP
 Optional authorization value to use for the key specified by
-\fB\-C\f.
+\fB\-C\fR.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-certifiedkey\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-certifiedkey\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Context object pointing to the key that has to be certified.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm used to digest the creation data.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-scheme\f=\fIALGORITHM\f:
+\fB\-s\fR, \fB\-\-scheme\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The signing scheme used to sign the attestation data.
 .RE
 .IP \bu 2
-\fB\-d\f, \fB\-\-creation\-hash\f=\fIFILE\f
+\fB\-d\fR, \fB\-\-creation\-hash\fR=\fIFILE\fR
 .RS 2
 .PP
 File containing the digest of the creation data.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-ticket\f=\fIFILE\f:
+\fB\-t\fR, \fB\-\-ticket\fR=\fIFILE\fR:
 .RS 2
 .PP
 The ticket file to validate that the creation data was produced by the
 TPM.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-signature\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-signature\fR=\fIFILE\fR:
 .RS 2
 .PP
 File containing the signature of the attestation data for the certified
 key.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-format\f=\fIFORMAT\f:
+\fB\-f\fR, \fB\-\-format\fR=\fIFORMAT\fR:
 .RS 2
 .PP
 Output signature format selection.
 .RE
 .IP \bu 2
-\fB\-\-attestation\f=\fIFILE\f:
+\fB\enattestation\fR=\fIFILE\fR:
 .RS 2
 .PP
 The attestation data of the type TPM2_CREATION_INFO signed with signing
 key.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-qualification\f=\fIFILE_OR_HEX\f:
+\fB\-q\fR, \fB\-\-qualification\fR=\fIFILE_OR_HEX\fR:
 .RS 2
 .PP
 Optional, the policy qualifier data that the signer can choose to
@@ -91,24 +91,39 @@
 Can either be a path or hex string.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash, unless rphash is also required.
+.RE
+.IP \bu 2
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
 .RE
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -121,8 +136,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -131,45 +145,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -177,69 +191,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -248,13 +264,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -265,7 +281,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -276,6 +292,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -309,6 +327,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -336,7 +356,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -345,27 +365,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
+.IP \bu 2
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -373,21 +401,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -400,6 +430,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -412,51 +444,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -464,18 +496,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -492,107 +524,114 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 # Signature Format Specifiers
 .RE
 .PP
 Format selection for the signature output file.
-\fBtss\f (the default) will output a binary blob according to the
+\fBtss\fR (the default) will output a binary blob according to the
 TPM 2.0 specification and any potential compiler padding.
-The option \fBplain\f will output the plain signature data as
+The option \fBplain\fR will output the plain signature data as
 defined by the used cryptographic algorithm.
 .SH EXAMPLES
 .SS Certify creation data of a primary key.
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx\ \-\-creation\-data\ create.dat\ \\
-\-d\ create.dig\ \-t\ create.ticket
+tpm2_createprimary \-C o \-c prim.ctx \-\-creation\-data create.dat \rs
+\-d create.dig \-t create.ticket
 
-tpm2_create\ \-G\ rsa\ \-u\ rsa.pub\ \-r\ rsa.priv\ \-C\ prim.ctx\ \-c\ signing_key.ctx
+tpm2_create \-G rsa \-u rsa.pub \-r rsa.priv \-C prim.ctx \-c signing_key.ctx
 
-tpm2_certifycreation\ \-C\ signing_key.ctx\ \-c\ prim.ctx\ \-d\ create.dig\ \\
-\-t\ create.ticket\ \-g\ sha256\ \-o\ sig.nature\ \-\-attestation\ attestat.ion\ \-f\ plain\ \\
-\-s\ rsassa
-\f
+tpm2_certifycreation \-C signing_key.ctx \-c prim.ctx \-d create.dig \rs
+\-t create.ticket \-g sha256 \-o sig.nature \-\-attestation attestat.ion \-f plain \rs
+\-s rsassa
+\fR
 .fi
 .SH Returns
 .PP
@@ -615,4 +654,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_changeauth.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_changeauth.1 Changed

@@ -1,17 +1,17 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_changeauth" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_changeauth\f \- Changes authorization values for TPM
+\fBtpm2_changeauth\fR \- Changes authorization values for TPM
 objects.
 .SH SYNOPSIS
 .PP
-\fBtpm2_changeauth\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_changeauth\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_changeauth\f \- Configures authorization values for the
+\fBtpm2_changeauth\fR \- Configures authorization values for the
 various hierarchies, NV indices, transient and persistent objects.
 .PP
 Note: For non\-permanent objects (Transient objects and Persistent
@@ -19,23 +19,23 @@
 handles) created prior to changing auth are not invalidated.
 .SH OPTIONS
 .PP
-Passwords should follow the "password authorization formatting
-standards", see section "Authorization Formatting".
+Passwords should follow the \lqpassword authorization formatting
+standards\rq, see section \lqAuthorization Formatting\rq.
 .IP \bu 2
-\fB\-c\f, \fB\-\-object\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-object\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The key context object to be used for the operation.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-object\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-object\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The old authorization value for the TPM object specified with
-\fB\-c\f.
+\fB\-c\fR.
 .RE
 .IP \bu 2
-\fB\-C\f, \fB\-\-parent\-context\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-parent\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The parent object.
@@ -43,53 +43,68 @@
 persistent object.
 .RE
 .IP \bu 2
-\fB\-r\f, \fB\-\-private\f=\fIFILE\f: The output file which
-contains the new sensitive portion of the object whose auth was being
-changed.
+\fB\-r\fR, \fB\-\-private\fR=\fIFILE\fR: The output file
+which contains the new sensitive portion of the object whose auth was
+being changed.
 # Protection Details
 .PP
 Objects that can move outside of TPM need to be protected
 (confidentiality and integrity).
 For instance, transient objects require that TPM protected data (key or
 seal material) be stored outside of the TPM.
-This is seen in tools like tpm2_create(1), where the \fB\-r\f option
-outputs this protected data.
+This is seen in tools like tpm2_create(1), where the \fB\-r\fR
+option outputs this protected data.
 This blob contains the sensitive portions of the object.
 The sensitive portions of the object are protected by the parent object,
-using the parent\aqs symmetric encryption details to encrypt the
+using the parent\cqs symmetric encryption details to encrypt the
 sensitive data and HMAC it.
 .PP
 In\-depth details can be found in sections 23 of:
 .IP \bu 2
 https://trustedcomputinggroup.org/wp\-content/uploads/TPM\-Rev\-2.0\-Part\-1\-Architecture\-01.38.pdf
 .PP
-Notably Figure 20, is relevant, even though it\aqs specifically
+Notably Figure 20, is relevant, even though it\cqs specifically
 referring to duplication blobs, the process is identical.
 .PP
 If the output is from tpm2_duplicate(1), the output will be slightly
 different, as described fully in section 23.
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash, unless rphash is also required.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the \fIAUTH\f
-to be set for the object specified with \fB\-c\f.
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
+.RE
+.IP \bu 2
+\fBARGUMENT\fR the command line argument specifies the
+\fIAUTH\fR to be set for the object specified with \fB\-c\fR.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -102,8 +117,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -112,45 +126,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -158,69 +172,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -229,40 +245,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -270,18 +287,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -298,84 +315,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -383,39 +407,39 @@
 .IP
 .nf
 \fC
-tpm2_changeauth\ \-c\ owner\ newpass
-tpm2_changeauth\ \-c\ endorsement\ newpass
-tpm2_changeauth\ \-c\ lockout\ newpass
-\f
+tpm2_changeauth \-c owner newpass
+tpm2_changeauth \-c endorsement newpass
+tpm2_changeauth \-c lockout newpass
+\fR
 .fi
 .SS Change owner, endorsement and lockout authorizations
 .IP
 .nf
 \fC
-tpm2_changeauth\ \-c\ o\ \-p\ newpass\ newerpass
-tpm2_changeauth\ \-c\ e\ \-p\ newpass\ newerpass
-tpm2_changeauth\ \-c\ l\ \-p\ newpass\ newerpass
-\f
+tpm2_changeauth \-c o \-p newpass newerpass
+tpm2_changeauth \-c e \-p newpass newerpass
+tpm2_changeauth \-c l \-p newpass newerpass
+\fR
 .fi
 .SS Set owner authorization to empty password
 .IP
 .nf
 \fC
-tpm2_changeauth\ \-c\ o\ \-p\ oldpass
-\f
+tpm2_changeauth \-c o \-p oldpass
+\fR
 .fi
 .SS Modify authorization for a loadable transient object
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-Q\ \-C\ o\ \-c\ prim.ctx
+tpm2_createprimary \-Q \-C o \-c prim.ctx
 
-tpm2_create\ \-Q\ \-g\ sha256\ \-G\ aes\ \-u\ key.pub\ \-r\ key.priv\ \-C\ prim.ctx
+tpm2_create \-Q \-g sha256 \-G aes \-u key.pub \-r key.priv \-C prim.ctx
 
-tpm2_load\ \-C\ prim.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-n\ key.name\ \-c\ key.ctx
+tpm2_load \-C prim.ctx \-u key.pub \-r key.priv \-n key.name \-c key.ctx
 
-tpm2_changeauth\ \-c\ key.ctx\ \-C\ prim.ctx\ \-r\ key.priv\ newkeyauth
-\f
+tpm2_changeauth \-c key.ctx \-C prim.ctx \-r key.priv newkeyauth
+\fR
 .fi
 .SS Modify authorization for a NV Index
 .PP
@@ -423,19 +447,19 @@
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx
+tpm2_startauthsession \-S session.ctx
 
-tpm2_policycommandcode\ \-S\ session.ctx\ \-L\ policy.nvchange\ TPM2_CC_NV_ChangeAuth
-tpm2_flushcontext\ session.ctx
+tpm2_policycommandcode \-S session.ctx \-L policy.nvchange TPM2_CC_NV_ChangeAuth
+tpm2_flushcontext session.ctx
 
 NVIndex=0x1500015
-tpm2_nvdefine\ \ \ $NVIndex\ \-C\ o\ \-s\ 32\ \-a\ "authread|authwrite"\ \-L\ policy.nvchange
-tpm2_startauthsession\ \\\-\-policy\-session\ \-S\ session.ctx
+tpm2_nvdefine   $NVIndex \-C o \-s 32 \-a \dqauthread|authwrite\dq \-L policy.nvchange
+tpm2_startauthsession \rs\-\-policy\-session \-S session.ctx
 
-tpm2_policycommandcode\ \-S\ session.ctx\ \-L\ policy.nvchange\ TPM2_CC_NV_ChangeAuth
+tpm2_policycommandcode \-S session.ctx \-L policy.nvchange TPM2_CC_NV_ChangeAuth
 
-tpm2_changeauth\ \-p\ session:session.ctx\ \-c\ $NVIndex\ newindexauth
-\f
+tpm2_changeauth \-p session:session.ctx \-c $NVIndex newindexauth
+\fR
 .fi
 .SH Returns
 .PP
@@ -458,4 +482,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_changeeps.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_changeeps.1 Changed

@@ -1,26 +1,53 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_changeeps" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_changeeps\f(1) \- Replaces the active endorsement primary
+\fBtpm2_changeeps\fR(1) \- Replaces the active endorsement primary
 seed with a new one generated off the TPM2 RNG.
 .SH SYNOPSIS
 .PP
-\fBtpm2_changeeps\f \fIOPTIONS\f
+\fBtpm2_changeeps\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_changeeps\f(1) \- Replaces the active endorsement primary
+\fBtpm2_changeeps\fR(1) \- Replaces the active endorsement primary
 seed with a new one generated off the TPM2 RNG.
 The Transient and Persistent objects under the endorsement hierarchy are
 lost.
 This command requires platform auth.
 .SH OPTIONS
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f specifies the \fIAUTH\f for the
-platform.
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR
+.RS 2
+.PP
+Specifies the \fIAUTH\fR for the platform.
 hierarchy.
+.RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash, unless rphash is also required.
+.RE
+.IP \bu 2
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
+.RE
 .SS References
 .SH Authorization Formatting
 .PP
@@ -30,45 +57,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -76,69 +103,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -147,24 +176,24 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -181,84 +210,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -267,7 +303,7 @@
 .nf
 \fC
 tpm2_changeeps
-\f
+\fR
 .fi
 .SH Returns
 .PP
@@ -288,17 +324,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_changepps.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_changepps.1 Changed

@@ -1,25 +1,49 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_changepps" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_changepps\f(1) \- Replaces the active platform primary seed
+\fBtpm2_changepps\fR(1) \- Replaces the active platform primary seed
 with a new one generated off the TPM2 RNG.
 .SH SYNOPSIS
 .PP
-\fBtpm2_changepps\f \fIOPTIONS\f
+\fBtpm2_changepps\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_changepps\f(1) \- Replaces the active platform primary seed
+\fBtpm2_changepps\fR(1) \- Replaces the active platform primary seed
 with a new one generated off the TPM2 RNG.
 The Transient and Persistent objects under the platform hierarchy are
 lost whilst retaining the NV objects.
 .SH OPTIONS
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f specifies the \fIAUTH\f for the
+\fB\-p\fR, \fB\-\-auth\fR specifies the \fIAUTH\fR for the
 platform.
 hierarchy.
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash, unless rphash is also required.
+.RE
+.IP \bu 2
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
+.RE
 .SS References
 .SH Authorization Formatting
 .PP
@@ -29,45 +53,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -75,69 +99,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -146,24 +172,24 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -180,84 +206,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -266,7 +299,7 @@
 .nf
 \fC
 tpm2_changepps
-\f
+\fR
 .fi
 .SH Returns
 .PP
@@ -287,17 +320,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_checkquote.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_checkquote.1 Changed

@@ -1,16 +1,16 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_checkquote" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_checkquote\f(1) \- Validates a quote provided by a TPM.
+\fBtpm2_checkquote\fR(1) \- Validates a quote provided by a TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_checkquote\f \fIOPTIONS\f
+\fBtpm2_checkquote\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_checkquote\f(1) \- Uses the public portion of the provided
+\fBtpm2_checkquote\fR(1) \- Uses the public portion of the provided
 key to validate a quote generated by a TPM.
 This will validate the signature against the quote message and, if
 provided, verify that the qualifying data and PCR values match those in
@@ -18,51 +18,51 @@
 The PCR values can be provided with or without the TPML_PCR_SELECTION
 information.
 An example of PCR values without the PCR selection information is the
-output from \fBtpm2_pcrread\f.
+output from \fBtpm2_pcrread\fR.
 If PCR value is specified without the PCR selection information, then
-the PCR selection string must be specified using the \fB\-l\f option
-to interpret the PCR data.
+the PCR selection string must be specified using the \fB\-l\fR
+option to interpret the PCR data.
 .SH OPTIONS
 .IP \bu 2
-\fB\-u\f, \fB\-\-public\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 File input for the public portion of the signature verification key.
-Either the \fIpem\f file or \fItss\f public format file.
+Either the \fIpem\fR file or \fItss\fR public format file.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm used to digest the message.
 .RE
 .IP \bu 2
-\fB\-m\f, \fB\-\-message\f=\fIFILE\f:
+\fB\-m\fR, \fB\-\-message\fR=\fIFILE\fR:
 .RS 2
 .PP
 The quote message that makes up the data that is signed by the TPM.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-signature\f=\fIFILE\f:
+\fB\-s\fR, \fB\-\-signature\fR=\fIFILE\fR:
 .RS 2
 .PP
 The input signature file of the signature to be validated.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-pcr\f=\fIFILE\f:
+\fB\-f\fR, \fB\-\-pcr\fR=\fIFILE\fR:
 .RS 2
 .PP
 Optional PCR input file to save the list of PCR values that were
 included in the quote.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-pcr\-list\f=\fIPCR\f:
+\fB\-l\fR, \fB\-\-pcr\-list\fR=\fIPCR\fR:
 .RS 2
 .PP
-The list of PCR banks and selected PCRs\aq ids for each bank.
+The list of PCR banks and selected PCRs\cq ids for each bank.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-qualification\f=\fIHEX_STRING_OR_PATH\f:
+\fB\-q\fR, \fB\-\-qualification\fR=\fIHEX_STRING_OR_PATH\fR:
 .RS 2
 .PP
 Qualification data for the quote.
@@ -70,15 +70,15 @@
 This is typically used to add a nonce against replay attacks.
 .RE
 .IP \bu 2
-\fB\-F\f, \fB\-\-format\f=\fIFORMAT\f:
+\fB\-F\fR, \fB\-\-format\fR=\fIFORMAT\fR:
 .RS 2
 .PP
-\fBDEPRECATED\f and \fBIGNORED \f as it\aqs superfluous.
+\fBDEPRECATED\fR and \fBIGNORED \fR as it\cqs superfluous.
 .RE
 .SS References
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -89,7 +89,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -100,6 +100,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -133,6 +135,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -160,7 +164,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -169,27 +173,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -197,21 +209,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -224,6 +238,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -236,59 +252,59 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH Signature Format Specifiers
 .PP
 Format selection for the signature output file.
-\fBtss\f (the default) will output a binary blob according to the
+\fBtss\fR (the default) will output a binary blob according to the
 TPM 2.0 specification and any potential compiler padding.
-The option \fBplain\f will output the plain signature data as
+The option \fBplain\fR will output the plain signature data as
 defined by the used cryptographic algorithm.
-signature \fIFORMAT\f.
+signature \fIFORMAT\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -296,18 +312,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -324,84 +340,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -409,17 +432,17 @@
 .IP
 .nf
 \fC
-tpm2_createek\ \-c\ 0x81010001\ \-G\ rsa\ \-u\ ekpub.pem\ \-f\ pem
+tpm2_createek \-c 0x81010001 \-G rsa \-u ekpub.pem \-f pem
 
-tpm2_createak\ \-C\ 0x81010001\ \-c\ ak.ctx\ \-G\ rsa\ \-s\ rsassa\ \-g\ sha256\ \\
-\-u\ akpub.pem\ \-f\ pem\ \-n\ ak.name
+tpm2_createak \-C 0x81010001 \-c ak.ctx \-G rsa \-s rsassa \-g sha256 \rs
+\-u akpub.pem \-f pem \-n ak.name
 
-tpm2_quote\ \-c\ ak.ctx\ \-l\ sha256:15,16,22\ \-q\ abc123\ \-m\ quote.msg\ \-s\ quote.sig\ \\
-\ \ \-o\ quote.pcrs\ \-g\ sha256
+tpm2_quote \-c ak.ctx \-l sha256:15,16,22 \-q abc123 \-m quote.msg \-s quote.sig \rs
+  \-o quote.pcrs \-g sha256
 
-tpm2_checkquote\ \-u\ akpub.pem\ \-m\ quote.msg\ \-s\ quote.sig\ \-f\ quote.pcrs\ \-g\ sha256\ \\
-\ \ \-q\ abc123
-\f
+tpm2_checkquote \-u akpub.pem \-m quote.msg \-s quote.sig \-f quote.pcrs \-g sha256 \rs
+  \-q abc123
+\fR
 .fi
 .SH Returns
 .PP
@@ -442,4 +465,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_clear.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_clear.1 Changed

@@ -1,36 +1,36 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_clear" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_clear\f(1) \- Clears lockout, endorsement and owner
+\fBtpm2_clear\fR(1) \- Clears lockout, endorsement and owner
 hierarchy authorization values.
 .SH SYNOPSIS
 .PP
-\fBtpm2_clear\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_clear\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_clear\f(1) \- Send a clear command to the TPM to clear the 3
-hierarchy authorization values.
+\fBtpm2_clear\fR(1) \- Send a clear command to the TPM to clear the
+3 hierarchy authorization values.
 As an argument takes the auth value for either platform or lockout
 hierarchy
 .PP
-\fBNOTE\f: All objects created under the respective hierarchies are
+\fBNOTE\fR: All objects created under the respective hierarchies are
 lost.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-auth\-hierarchy\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-auth\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Specifies the hierarchy the tools should operate on.
 By default it operates on the lockout hierarchy.
 .PP
 \fBNOTE : Operating on platform hierarchy require platform
-authentication.\f
+authentication.\fR
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -39,18 +39,18 @@
 the command, it simply returns a cpHash.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the \fIAUTH\f
-to be set for the object specified with \fB\-c\f.
+\fBARGUMENT\fR the command line argument specifies the
+\fIAUTH\fR to be set for the object specified with \fB\-c\fR.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -63,8 +63,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -73,45 +72,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -119,69 +118,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -190,40 +191,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -231,18 +233,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -259,84 +261,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -344,15 +353,15 @@
 .IP
 .nf
 \fC
-tpm2_clear\ lockoutpasswd
-\f
+tpm2_clear lockoutpasswd
+\fR
 .fi
 .SS Clear the authorization values on the platform hierarchy
 .IP
 .nf
 \fC
-tpm2_clear\ \-c\ p
-\f
+tpm2_clear \-c p
+\fR
 .fi
 .SH Returns
 .PP
@@ -375,4 +384,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_clearcontrol.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_clearcontrol.1 Changed

@@ -1,20 +1,20 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_clearcontrol" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_clearcontrol\f(1) \- Set/ Clear TPMA_PERMANENT.disableClear
+\fBtpm2_clearcontrol\fR(1) \- Set/ Clear TPMA_PERMANENT.disableClear
 attribute to effectively block/ unblock lockout authorization handle for
 issuing TPM clear.
 .SH SYNOPSIS
 .PP
-\fBtpm2_clearcontrol\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_clearcontrol\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_clearcontrol\f(1) \- Allows user with knowledge of either
+\fBtpm2_clearcontrol\fR(1) \- Allows user with knowledge of either
 lockout auth and or platform hierarchy auth to set disableClear which
-prevents the lockout authorization\aqs capability to execute
+prevents the lockout authorization\cqs capability to execute
 tpm2_clear.
 Only user with authorization knowledge of the platform hierarchy can
 clear the disableClear.
@@ -24,7 +24,7 @@
 with tpm2_clear command.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Specifies what auth handle, either platform hierarchy or lockout the
@@ -33,17 +33,18 @@
 Specify the handle as p|l|platform|lockout.
 .PP
 \fBNOTE : Operating on platform hierarchy require platform
-authentication.\f
+authentication.\fR
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
-The authorization value of the hierarchy specified with \fB\-C\f.
-This tool only respects the \fIPassword\f and \fIHMAC\f options.
+The authorization value of the hierarchy specified with \fB\-C\fR.
+This tool only respects the \fIPassword\fR and \fIHMAC\fR
+options.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -52,18 +53,18 @@
 the command, it simply returns a cpHash.
 .RE
 .IP \bu 2
-\fBARGUMENT\f ** Specify an integer 0|1 or string c|s to clear or
+\fBARGUMENT\fR ** Specify an integer 0|1 or string c|s to clear or
 set the disableClear attribute.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -76,8 +77,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -86,45 +86,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -132,69 +132,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -203,40 +205,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -244,18 +247,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -272,102 +275,107 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
-.SS Set the disableClear to block the lockout authorization\aqs access
-to TPM clear
+.SS Set the disableClear to block the lockout authorization\cqs access to TPM clear
 .IP
 .nf
 \fC
-tpm2_clearcontrol\ \-C\ l\ s
-\f
+tpm2_clearcontrol \-C l s
+\fR
 .fi
-.SS Clear the disableClear to unblock lockout authorization for TPM
-clear
+.SS Clear the disableClear to unblock lockout authorization for TPM clear
 .IP
 .nf
 \fC
-tpm2_clearcontrol\ \-C\ p\ c
-\f
+tpm2_clearcontrol \-C p c
+\fR
 .fi
 .SH Returns
 .PP
@@ -390,4 +398,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_clockrateadjust.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_clockrateadjust.1 Changed

@@ -1,17 +1,17 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_clockrateadjust" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_clockrateadjust\f(1) \- Sets the clock rate period on the
+\fBtpm2_clockrateadjust\fR(1) \- Sets the clock rate period on the
 TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_clockrateadjust\f \fIOPTIONS\f \fBADJUSTER\f
+\fBtpm2_clockrateadjust\fR \fIOPTIONS\fR \fBADJUSTER\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_clockrateadjust\f(1) \- Adjusts the rate at which clock and
+\fBtpm2_clockrateadjust\fR(1) \- Adjusts the rate at which clock and
 time are updated on the TPM so one can better match real time.
 With no argument, the command is invoked but the clock rate is not
 altered.
@@ -19,7 +19,7 @@
 The command can either increase or decrease the clock period via 3
 distinct granularities: course, medium and fine.
 To specify this, the argument can be a string of 1 to 3 characters of
-\fIall\f \aqs\aq or \aqf\aq.
+\fIall\fR `s' or `f'.
 .SS Valid Adjuster Arguments
 .IP \bu 2
 s \- slows down the clock period one fine increment.
@@ -35,21 +35,21 @@
 fff \- speeds up the clock period one course increment.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The hierarchy to use for authorization, either platform or owner.
 Defaults to the owner hierarchy if not specified.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy specified by option
-\fB\-c\f.
+\fB\-c\fR.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -61,12 +61,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -79,8 +79,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -89,45 +88,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -135,69 +134,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -206,40 +207,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -247,18 +249,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -275,84 +277,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -362,16 +371,16 @@
 .IP
 .nf
 \fC
-tpm2_clockrateadjust\ \-p\ ownerpw\ ss
-\f
+tpm2_clockrateadjust \-p ownerpw ss
+\fR
 .fi
 .PP
 Speed up the clock one course increment using the platform password.
 .IP
 .nf
 \fC
-tpm2_clockrateadjust\ \-c\ p\ \-p\ platformpw\ fff
-\f
+tpm2_clockrateadjust \-c p \-p platformpw fff
+\fR
 .fi
 .SH Returns
 .PP
@@ -394,4 +403,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_commit.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_commit.1 Changed

@@ -1,17 +1,17 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_commit" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_commit\f(1) \- Performs the first part of an ECC anonymous
+\fBtpm2_commit\fR(1) \- Performs the first part of an ECC anonymous
 signing operation.
 .SH SYNOPSIS
 .PP
-\fBtpm2_commit\f \fIOPTIONS\f
+\fBtpm2_commit\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_commit\f(1) \- Performs the first part of an ECC anonymous
+\fBtpm2_commit\fR(1) \- Performs the first part of an ECC anonymous
 signing operation.
 The TPM will perform the point multiplications on the provided points
 and return intermediate signing values.
@@ -21,66 +21,75 @@
 TPM_ALG_ECDAA is the only supported anonymous scheme.
 .SH OPTIONS
 .IP \bu 2
-\fBARGUMENT\f=\fIFILE\f:
+\fBARGUMENT\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specify the input data used to derive the x coordinate of the basepoint.
 .RE
 .IP \bu 2
-\fB\-\-basepoint\-y\f=\fIFILE\f:
+\fB\-\-basepoint\-y\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specify the y coordinate of the basepoint.
 .RE
 .IP \bu 2
-\fB\-\-eccpoint\-P\f=\fIFILE\f:
+\fB\-\-eccpoint\-P\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specify a point on the curve used by sign handle.
 .RE
 .IP \bu 2
-\fB\-\-eccpoint\-K\f=\fIFILE\f:
+\fB\-\-eccpoint\-K\fR=\fIFILE\fR:
 .RS 2
 .PP
-Output ECC point K ≔ ds(x2, y2).
+Output ECC point K \u2254 ds(x2, y2).
 .RE
 .IP \bu 2
-\fB\-\-eccpoint\-L\f=\fIFILE\f:
+\fB\-\-eccpoint\-L\fR=\fIFILE\fR:
 .RS 2
 .PP
-Output ECC point L ≔ r(x2, y2).
+Output ECC point L \u2254 r(x2, y2).
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-public\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
-Output ECC point E ≔ rP1.
+Output ECC point E \u2254 rP1.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-counter\f=\fIFILE\f
+\fB\-t\fR, \fB\-\-counter\fR=\fIFILE\fR
 .RS 2
 .PP
 Specify file path to save the least\-significant 16 bits of commit
 count.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the created object.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-context\f=\fIFILE\f:
+\fB\-c\fR, \fB\-\-context\fR=\fIFILE\fR:
 .RS 2
 .PP
 Context object pointing to the the key used for signing.
 Either a file or a handle number.
-See section "Context Object Format".
+See section \lqContext Object Format\rq.
+.RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
 .RE
 .SS References
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -91,7 +100,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -102,6 +111,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -135,6 +146,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -162,7 +175,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -171,27 +184,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
+.IP \bu 2
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -199,21 +220,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -226,6 +249,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -238,51 +263,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -290,18 +315,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -318,97 +343,104 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx\ \-Q
+tpm2_createprimary \-C o \-c prim.ctx \-Q
 
-tpm2_create\ \-C\ prim.ctx\ \-c\ key.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-G\ ecc256:ecdaa
+tpm2_create \-C prim.ctx \-c key.ctx \-u key.pub \-r key.priv \-G ecc256:ecdaa
 
-tpm2_commit\ \-c\ key.ctx\ \-t\ count.er\ \\
-\-\-eccpoint\-K\ K.bin\ \-\-eccpoint\-L\ L.bin\ \-u\ E.bin
-\f
+tpm2_commit \-c key.ctx \-t count.er \rs
+\-\-eccpoint\-K K.bin \-\-eccpoint\-L L.bin \-u E.bin
+\fR
 .fi
 .SH Returns
 .PP
@@ -431,4 +463,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_create.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_create.1 Changed

@@ -1,108 +1,109 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_create" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_create\f(1) \- Create a child object.
+\fBtpm2_create\fR(1) \- Create a child object.
 .SH SYNOPSIS
 .PP
-\fBtpm2_create\f \fIOPTIONS\f
+\fBtpm2_create\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_create\f(1) \- Create a child object.
+\fBtpm2_create\fR(1) \- Create a child object.
 The object can either be a key or a sealing object.
 A sealing object allows to seal user data to the TPM, with a maximum
 size of 128 bytes.
-Additionally it will load the created object if the \fB\-c\f is
+Additionally it will load the created object if the \fB\-c\fR is
 specified.
 .SH OPTIONS
 .PP
 These options for creating the TPM entity:
 .IP \bu 2
-\fB\-C\f, \fB\-\-parent\-context\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-parent\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The parent of the object to be created.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-parent\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-parent\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value of the parent object specified with
-\fB\-C\f.
+\fB\-C\fR.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-key\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-key\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the created object.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm for generating the objects name.
 This is optional and defaults to sha256 when not specified.
 .RE
 .IP \bu 2
-\fB\-G\f, \fB\-\-key\-algorithm\f=\fIALGORITHM\f:
+\fB\-G\fR, \fB\-\-key\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The key algorithm associated with this object.
-It defaults to "rsa" if not specified.
+It defaults to \lqrsa\rq if not specified.
 .RE
 .IP \bu 2
-\fB\-a\f, \fB\-\-attributes\f=\fIATTRIBUTES\f:
+\fB\-a\fR, \fB\-\-attributes\fR=\fIATTRIBUTES\fR:
 .RS 2
 .PP
 The object attributes, optional.
 The default for created objects is:
 .PP
-\fCTPMA_OBJECT_SIGN_ENCRYPT|TPMA_OBJECT_DECRYPT|TPMA_OBJECT_FIXEDTPM|\ \ TPMA_OBJECT_FIXEDPARENT|TPMA_OBJECT_SENSITIVEDATAORIGIN|\ \ TPMA_OBJECT_USERWITHAUTH\f
+\fCTPMA_OBJECT_SIGN_ENCRYPT|TPMA_OBJECT_DECRYPT|TPMA_OBJECT_FIXEDTPM|  TPMA_OBJECT_FIXEDPARENT|TPMA_OBJECT_SENSITIVEDATAORIGIN|  TPMA_OBJECT_USERWITHAUTH\fR
 .PP
-When \fB\-i\f is specified for sealing,
-\fCTPMA_OBJECT_SIGN_ENCRYPT\f and \fCTPMA_OBJECT_DECRYPT\f are
+When \fB\-i\fR is specified for sealing,
+\fCTPMA_OBJECT_SIGN_ENCRYPT\fR and \fCTPMA_OBJECT_DECRYPT\fR are
 removed from the default attribute set.
 The algorithm is set in a way where the the object is only good for
 sealing and unsealing.
 I.e.
 one cannot use an object for sealing and cryptography operations.
 .PP
-When \fB\-L\f is specified for adding policy based authorization
+When \fB\-L\fR is specified for adding policy based authorization
 information AND no string password is specified, the attribute
-\fCTPMA_OBJECT_USERWITHAUTH\f is cleared unless an explicit choice
-is made by setting of the attribute with \fB\-a\f option.
-This prevents creation of objects with inadvertant auth model where in
-user intended to enforce a policy but inadvertantly created an object
+\fCTPMA_OBJECT_USERWITHAUTH\fR is cleared unless an explicit choice
+is made by setting of the attribute with \fB\-a\fR option.
+This prevents creation of objects with inadvertent auth model where in
+user intended to enforce a policy but inadvertently created an object
 with empty auth which can be used instead of policy authorization.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-sealing\-input\f=\fIFILE\f or
-\fISTDIN\f:
+\fB\-i\fR, \fB\-\-sealing\-input\fR=\fIFILE\fR or
+\fISTDIN\fR:
 .RS 2
 .PP
 The data file to be sealed, optional.
 If file is \-, read from stdin.
-When sealing data only the \fITPM_ALG_KEYEDHASH\f algorithm with a
+When sealing data only the \fITPM_ALG_KEYEDHASH\fR algorithm with a
 NULL scheme is allowed.
-Thus, \fB\-G\f cannot be specified.
+Thus, \fB\-G\fR cannot be specified.
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR or
+\fIHEX_STRING\fR:
 .RS 2
 .PP
-The input policy file, optional.
+The input policy file or a hex string, optional.
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-public\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 The output file which contains the public portion of the created object,
 optional.
 .RE
 .IP \bu 2
-\fB\-r\f, \fB\-\-private\f=\fIFILE\f:
+\fB\-r\fR, \fB\-\-private\fR=\fIFILE\fR:
 .RS 2
 .PP
 The output file which contains the sensitive portion of the object,
@@ -114,60 +115,60 @@
 (confidentiality and integrity).
 For instance, transient objects require that TPM protected data (key or
 seal material) be stored outside of the TPM.
-This is seen in tools like tpm2_create(1), where the \fB\-r\f option
-outputs this protected data.
+This is seen in tools like tpm2_create(1), where the \fB\-r\fR
+option outputs this protected data.
 This blob contains the sensitive portions of the object.
 The sensitive portions of the object are protected by the parent object,
-using the parent\aqs symmetric encryption details to encrypt the
+using the parent\cqs symmetric encryption details to encrypt the
 sensitive data and HMAC it.
 .PP
 In\-depth details can be found in sections 23 of:
 .IP \bu 2
 https://trustedcomputinggroup.org/wp\-content/uploads/TPM\-Rev\-2.0\-Part\-1\-Architecture\-01.38.pdf
 .PP
-Notably Figure 20, is relevant, even though it\aqs specifically
+Notably Figure 20, is relevant, even though it\cqs specifically
 referring to duplication blobs, the process is identical.
 .PP
 If the output is from tpm2_duplicate(1), the output will be slightly
 different, as described fully in section 23.
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIFILE\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIFILE\fR:
 .RS 2
 .PP
 The output file which contains the key context, optional.
 The key context is analogous to the context file produced by
-\fBtpm2_load\f(1), however is generated via a
-\fBtpm2_createloaded\f(1) command.
-This option can be used to avoid the normal \fBtpm2_create\f(1) and
-\fBtpm2_load\f(1) command sequences and do it all in one command,
+\fBtpm2_load\fR(1), however is generated via a
+\fBtpm2_createloaded\fR(1) command.
+This option can be used to avoid the normal \fBtpm2_create\fR(1) and
+\fBtpm2_load\fR(1) command sequences and do it all in one command,
 atomically.
 .RE
 .IP \bu 2
-\fB\-\-creation\-data\f=\fIFILE\f:
+\fB\-\-creation\-data\fR=\fIFILE\fR:
 .RS 2
 .PP
 An optional file output that saves the creation data for certification.
 .IP \bu 2
-\fB\-\-template\-data\f=\fIFILE\f:
+\fB\-\-template\-data\fR=\fIFILE\fR:
 .PP
 An optional file output that saves the key template data (TPM2B_PUBLIC)
-to be used in \fBtpm2_policytemplate\f.
+to be used in \fBtpm2_policytemplate\fR.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-creation\-ticket\f=\fIFILE\f:
+\fB\-t\fR, \fB\-\-creation\-ticket\fR=\fIFILE\fR:
 .RS 2
 .PP
 An optional file output that saves the creation ticket for
 certification.
 .RE
 .IP \bu 2
-\fB\-d\f, \fB\-\-creation\-hash\f=\fIFILE\f:
+\fB\-d\fR, \fB\-\-creation\-hash\fR=\fIFILE\fR:
 .RS 2
 .PP
 An optional file output that saves the creation hash for certification.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-outside\-info\f=\fIHEX_STR_OR_FILE\f:
+\fB\-q\fR, \fB\-\-outside\-info\fR=\fIHEX_STR_OR_FILE\fR:
 .RS 2
 .PP
 An optional hex string or path to add unique data to the creation data.
@@ -175,14 +176,14 @@
 object.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-pcr\-list\f=\fIPCR\f:
+\fB\-l\fR, \fB\-\-pcr\-list\fR=\fIPCR\fR:
 .RS 2
 .PP
-The list of PCR banks and selected PCRs\aq ids for each bank to be
+The list of PCR banks and selected PCRs\cq ids for each bank to be
 included in the creation data for certification.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -190,16 +191,52 @@
 NOTE: When this option is selected, The tool will not actually execute
 the command, it simply returns a cpHash.
 .RE
+.IP \bu 2
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+Multiple of these can be specified.
+For example, you can have one session for auditing and another for
+encryption/decryption of the parameters.
+.RE
+.IP \bu 2
+\fB\-f\fR, \fB\-\-format\fR:
+.RS 2
+.PP
+Format selection for the public key output file.
+`tss' (the default) will output a binary blob according to the TPM 2.0
+Specification.
+`pem' will output an OpenSSL compatible PEM encoded public key.
+`der' will output an OpenSSL compatible DER encoded public key.
+`tpmt' will output a binary blob of the TPMT_PUBLIC struct referenced by
+TPM 2.0 specs.
+.PP
+Public key format.
+.RE
+.IP \bu 2
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR:
+.RS 2
+.PP
+The output file path, recording the public portion of the object.
+.RE
+.RE
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -212,8 +249,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -222,45 +258,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -268,69 +304,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -339,13 +377,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -356,7 +394,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -367,6 +405,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -400,6 +440,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -427,7 +469,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -436,27 +478,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -464,21 +514,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -491,6 +543,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -503,73 +557,73 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH Object Attributes
 .PP
 Object Attributes are used to control various properties of created
 objects.
 When specified as an option, either the raw bitfield mask or
-"nice\-names" may be used.
+\lqnice\-names\rq may be used.
 The values can be found in Table 31 Part 2 of the TPM2.0 specification,
 which can be found here:
 .PP
 <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf>
 .PP
 Nice names are calculated by taking the name field of table 31 and
-removing the prefix \fBTPMA_OBJECT_\f and lowercasing the result.
-Thus, \fBTPMA_OBJECT_FIXEDTPM\f becomes fixedtpm.
-Nice names can be joined using the bitwise or "|" symbol.
+removing the prefix \fBTPMA_OBJECT_\fR and lowercasing the result.
+Thus, \fBTPMA_OBJECT_FIXEDTPM\fR becomes fixedtpm.
+Nice names can be joined using the bitwise or \lq|\rq symbol.
 .PP
-For instance, to set The fields \fBTPMA_OBJECT_FIXEDTPM\f,
-\fBTPMA_OBJECT_NODA\f, and \fBTPMA_OBJECT_SIGN_ENCRYPT\f, the
+For instance, to set The fields \fBTPMA_OBJECT_FIXEDTPM\fR,
+\fBTPMA_OBJECT_NODA\fR, and \fBTPMA_OBJECT_SIGN_ENCRYPT\fR, the
 argument would be:
 .PP
-\fBfixedtpm|noda|sign\f specifying the object attributes
-\fIATTRIBUTES\f.
+\fBfixedtpm|noda|sign\fR specifying the object attributes
+\fIATTRIBUTES\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -577,18 +631,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -605,96 +659,103 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .SS Setup
 .PP
 In order to create an object, we must first create a primary key as
-it\aqs parent.
+it\cqs parent.
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-c\ primary.ctx
-\f
+tpm2_createprimary \-c primary.ctx
+\fR
 .fi
 .SS Create an Object
 .PP
@@ -705,8 +766,8 @@
 .IP
 .nf
 \fC
-tpm2_create\ \-C\ primary.ctx\ \-u\ obj.pub\ \-r\ obj.priv
-\f
+tpm2_create \-C primary.ctx \-u obj.pub \-r obj.priv
+\fR
 .fi
 .SS Seal Data to the TPM
 .PP
@@ -715,9 +776,9 @@
 .IP
 .nf
 \fC
-echo\ "my\ sealed\ data"\ >\ seal.dat
-tpm2_create\ \-C\ primary.ctx\ \-i\ seal.dat\ \-u\ obj.pub\ \-r\ obj.priv
-\f
+echo \dqmy sealed data\dq > seal.dat
+tpm2_create \-C primary.ctx \-i seal.dat \-u obj.pub \-r obj.priv
+\fR
 .fi
 .SS Create an EC Key Object and Load it to the TPM
 .PP
@@ -725,12 +786,30 @@
 of the object are returned and the caller needs to use tpm2_load(1) to
 load those public and private portions to the TPM before being able to
 use the object.
-However, this can be accomplished within this command as well.
+However, this can be accomplished within this command as well, when
+supported by the TPM.
+You can verify your TPM supports this feature by checking that
+tpm2_getcap(1) commands returns TPM2_CC_CreateLoaded in the command set.
+If your TPM does not support TPM2_CC_CreateLoaded an unsuported command
+code error will be returned.
+If it\cqs not supported one must use tpm2_load(1).
+See that manpage for details on its usage.
+.IP
+.nf
+\fC
+tpm2_create \-C primary.ctx \-G ecc \-u obj.pub \-r obj.priv \-c ecc.ctx
+\fR
+.fi
+.SS Create an Object and get the public key as a PEM file
+.PP
+This will create an object using all the default values but also output
+the public key as a PEM file compatible with tools like OpenSSL and
+whatever supports PEM files.
 .IP
 .nf
 \fC
-tpm2_create\ \-C\ primary.ctx\ \-G\ ecc\ \-u\ obj.pub\ \-r\ obj.priv\ \-c\ ecc.ctx
-\f
+tpm2_create \-C primary.ctx \-u obj.pub \-r obj.priv \-f pem \-o obj.pem
+\fR
 .fi
 .SH Returns
 .PP
@@ -753,4 +832,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_createak.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_createak.1 Changed

@@ -1,92 +1,94 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_createak" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_createak\f(1) \- Generate attestation key with given
+\fBtpm2_createak\fR(1) \- Generate attestation key with given
 algorithm under the endorsement hierarchy.
 .SH SYNOPSIS
 .PP
-\fBtpm2_createak\f \fIOPTIONS\f
+\fBtpm2_createak\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_createak\f(1) \- Generate an attestation key (AK) with the
+\fBtpm2_createak\fR(1) \- Generate an attestation key (AK) with the
 given algorithm under the endorsement hierarchy.
-The context of the attestation key is specified via \fB\-c\f.
+The context of the attestation key is specified via \fB\-c\fR.
 .PP
-The tool outputs to stdout a YAML representation of the loaded key\aqs
+The tool outputs to stdout a YAML representation of the loaded key\cqs
 name, for example:
 .IP
 .nf
 \fC
 loaded\-key:
-\ \ name:\ 000bac149518baa05540a0678bd9b624f8a98d042e46c60f4d098ba394d36fc49268
-\f
+  name: 000bac149518baa05540a0678bd9b624f8a98d042e46c60f4d098ba394d36fc49268
+\fR
 .fi
 .SH OPTIONS
 .IP \bu 2
-\fB\-P\f, \fB\-\-eh\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-eh\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the endorsement hierarchy.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-ak\-auth\f=\fIAUTH\f
+\fB\-p\fR, \fB\-\-ak\-auth\fR=\fIAUTH\fR
 .RS 2
 .PP
 The authorization value for the attestation key object created.
 .RE
 .IP \bu 2
-\fB\-C\f, \fB\-\-ek\-context\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-ek\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The endorsement key object.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-ak\-context\f=\fIFILE\f:
+\fB\-c\fR, \fB\-\-ak\-context\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file path to save the object context of the attestation key.
 .RE
 .IP \bu 2
-\fB\-G\f, \fB\-\-key\-algorithm\f=\fIALGORITHM\f:
+\fB\-G\fR, \fB\-\-key\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 Specifies the attestation key algorithm.
 Supports:
 .IP \bu 2
-ecc \- An P256 key.
+\fBecc\fR \- A NIST_P256 key by default.
+Alternative curves can be selected using algorithm specifiers
+(e.g.\ \fBecc384\fR or \fBecc_nist_p384\fR) .
 .IP \bu 2
-rsa \- An RSA2048 key.
+\fBrsa\fR \- An RSA2048 key.
 .IP \bu 2
-keyedhash \- hmac key.
+\fBkeyedhash\fR \- hmac key.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 Specifies the digest algorithm used for signing.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-signing\-algorithm\f=\fIALGORITHM\f:
+\fB\-s\fR, \fB\-\-signing\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The signing algorithm.
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-public\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file to save the public portion of the attestation key.
 .RE
 .IP \bu 2
-\fB\-n\f, \fB\-\-ak\-name\f=\fIFILE\f:
+\fB\-n\fR, \fB\-\-ak\-name\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file to save the attestation key name, optional.
 .RE
 .IP \bu 2
-\fB\-r\f, \fB\-\-private\f=\fIFILE\f:
+\fB\-r\fR, \fB\-\-private\fR=\fIFILE\fR:
 .RS 2
 .PP
 The output file which contains the sensitive portion of the object,
@@ -98,38 +100,38 @@
 (confidentiality and integrity).
 For instance, transient objects require that TPM protected data (key or
 seal material) be stored outside of the TPM.
-This is seen in tools like tpm2_create(1), where the \fB\-r\f option
-outputs this protected data.
+This is seen in tools like tpm2_create(1), where the \fB\-r\fR
+option outputs this protected data.
 This blob contains the sensitive portions of the object.
 The sensitive portions of the object are protected by the parent object,
-using the parent\aqs symmetric encryption details to encrypt the
+using the parent\cqs symmetric encryption details to encrypt the
 sensitive data and HMAC it.
 .PP
 In\-depth details can be found in sections 23 of:
 .IP \bu 2
 https://trustedcomputinggroup.org/wp\-content/uploads/TPM\-Rev\-2.0\-Part\-1\-Architecture\-01.38.pdf
 .PP
-Notably Figure 20, is relevant, even though it\aqs specifically
+Notably Figure 20, is relevant, even though it\cqs specifically
 referring to duplication blobs, the process is identical.
 .PP
 If the output is from tpm2_duplicate(1), the output will be slightly
 different, as described fully in section 23.
 .IP \bu 2
-\fB\-f\f, \fB\-\-format\f:
+\fB\-f\fR, \fB\-\-format\fR:
 .RS 2
 .PP
 Format selection for the public key output file.
-\aqtss\aq (the default) will output a binary blob according to the
-TPM 2.0 Specification.
-\aqpem\aq will output an OpenSSL compatible PEM encoded public key.
-\aqder\aq will output an OpenSSL compatible DER encoded public key.
-\aqtpmt\aq will output a binary blob of the TPMT_PUBLIC struct
-referenced by TPM 2.0 specs.
+`tss' (the default) will output a binary blob according to the TPM 2.0
+Specification.
+`pem' will output an OpenSSL compatible PEM encoded public key.
+`der' will output an OpenSSL compatible DER encoded public key.
+`tpmt' will output a binary blob of the TPMT_PUBLIC struct referenced by
+TPM 2.0 specs.
 .PP
 Format selection for the signature output file.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-ak\-qualified\-name\f=\fIFILE\f:
+\fB\-q\fR, \fB\-\-ak\-qualified\-name\fR=\fIFILE\fR:
 .RS 2
 .PP
 The qualified name of the attestation key object.
@@ -141,12 +143,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -159,8 +161,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -169,45 +170,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -215,69 +216,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -286,13 +289,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -303,7 +306,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -314,6 +317,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -347,6 +352,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -374,7 +381,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -383,27 +390,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -411,21 +426,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -438,6 +455,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -450,59 +469,59 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH Signature Format Specifiers
 .PP
 Format selection for the signature output file.
-\fBtss\f (the default) will output a binary blob according to the
+\fBtss\fR (the default) will output a binary blob according to the
 TPM 2.0 specification and any potential compiler padding.
-The option \fBplain\f will output the plain signature data as
+The option \fBplain\fR will output the plain signature data as
 defined by the used cryptographic algorithm.
-signature \fIFORMAT\f.
+signature \fIFORMAT\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -510,18 +529,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -538,84 +557,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -623,10 +649,10 @@
 .IP
 .nf
 \fC
-tpm2_createek\ \-c\ ek.handle\ \-G\ rsa\ \-u\ ek.pub
-tpm2_createak\ \-C\ ek.handle\ \-c\ ak.ctx\ \-u\ ak.pub\ \-n\ ak.name
-tpm2_evictcontrol\ \-C\ o\ \-c\ ak.ctx\ 0x81010002
-\f
+tpm2_createek \-c ek.handle \-G rsa \-u ek.pub
+tpm2_createak \-C ek.handle \-c ak.ctx \-u ak.pub \-n ak.name
+tpm2_evictcontrol \-C o \-c ak.ctx 0x81010002
+\fR
 .fi
 .SH Returns
 .PP
@@ -649,4 +675,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_createek.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_createek.1 Changed

@@ -1,92 +1,96 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_createek" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_createek\f(1) \- Generate TCG profile compliant endorsement
+\fBtpm2_createek\fR(1) \- Generate TCG profile compliant endorsement
 key.
 .SH SYNOPSIS
 .PP
-\fBtpm2_createek\f \fIOPTIONS\f
+\fBtpm2_createek\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_createek\f(1) \- Generate TCG profile compliant endorsement
+\fBtpm2_createek\fR(1) \- Generate TCG profile compliant endorsement
 key (EK), which is the primary object of the endorsement hierarchy.
 .PP
 If a transient object is generated the tool outputs a context file
-specified with \fB\-c\f.
+specified with \fB\-c\fR.
 .PP
 Refer to:
 <http://www.trustedcomputinggroup.org/files/static_page_files/7CAA5687-1A4B-B294-D04080D058E86C5F>
 .SH OPTIONS
 .IP \bu 2
-\fB\-P\f, \fB\-\-eh\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-eh\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the endorsement hierarchy
 .RE
 .IP \bu 2
-\fB\-w\f, \fB\-\-owner\-auth\f=\fIAUTH\f
+\fB\-w\fR, \fB\-\-owner\-auth\fR=\fIAUTH\fR
 .RS 2
 .PP
 The authorization value for the owner hierarchy.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-ek\-context\f=\fIOBJECT\f or \fIFILE\f:
+\fB\-c\fR, \fB\-\-ek\-context\fR=\fIOBJECT\fR or
+\fIFILE\fR:
 .RS 2
 .PP
 Either a file path or a persistent handle value to save the endorsement
 key.
 .PP
-If a value of \fB\-\f is passed the tool will find a vacant
+If a value of \fB\-\fR is passed the tool will find a vacant
 persistent handle to use and print out the automatically selected
 handle.
 .PP
 If one saves the context file via this option and the public key via the
-\fB\-u\f option, the EK can be restored via a call to
-\fBtpm2_loadexternal\f(1).
+\fB\-u\fR option, the EK can be restored via a call to
+\fBtpm2_loadexternal\fR(1).
 .RE
 .IP \bu 2
-\fB\-G\f, \fB\-\-key\-algorithm\f=\fIALGORITHM\f:
+\fB\-G\fR, \fB\-\-key\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 The endorsement key algorithm.
 Supports:
 .IP \bu 2
-\fBecc\f \- An P256 key.
+\fBecc\fR \- A NIST_P256 key by default.
+Alternative curves can be selected using algorithm specifiers
+(e.g.\ \fBecc384\fR or \fBecc_nist_p384\fR) .
 .IP \bu 2
-\fBrsa\f \- An RSA2048 key.
+\fBrsa\fR \- An RSA2048 key.
 .IP \bu 2
-\fBkeyedhash\f \- hmac key.
+\fBkeyedhash\fR \- hmac key.
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-public\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 The optional input for a file to save the public portion of endorsement
 key.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-template\f:
+\fB\-t\fR, \fB\-\-template\fR:
 .RS 2
 .PP
 The optional manufacturer defined endorsement key template and nonce
-from fixed NV Indices to populate the \fBTPM2B_PUBLIC\f public area.
+from fixed NV Indices to populate the \fBTPM2B_PUBLIC\fR public
+area.
 See the TCG EK Credential Profile specification for more information:
 https://trustedcomputinggroup.org/wp\-content/uploads/
 TCG_IWG_Credential_Profile_EK_V2.1_R13.pdf
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-format\f:
+\fB\-f\fR, \fB\-\-format\fR:
 .RS 2
 .PP
 Format selection for the public key output file.
-\aqtss\aq (the default) will output a binary blob according to the
-TPM 2.0 Specification.
-\aqpem\aq will output an OpenSSL compatible PEM encoded public key.
-\aqder\aq will output an OpenSSL compatible DER encoded public key.
-\aqtpmt\aq will output a binary blob of the TPMT_PUBLIC struct
-referenced by TPM 2.0 specs.
+`tss' (the default) will output a binary blob according to the TPM 2.0
+Specification.
+`pem' will output an OpenSSL compatible PEM encoded public key.
+`der' will output an OpenSSL compatible DER encoded public key.
+`tpmt' will output a binary blob of the TPMT_PUBLIC struct referenced by
+TPM 2.0 specs.
 .PP
 Public key format.
 .RE
@@ -94,12 +98,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -112,8 +116,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -122,45 +125,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -168,69 +171,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -239,13 +244,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -256,7 +261,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -267,6 +272,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -300,6 +307,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -327,7 +336,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -336,27 +345,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -364,21 +381,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -391,6 +410,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -403,51 +424,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -455,18 +476,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -483,118 +504,132 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
-.SS Create an Endorsement Key and make it persistent
+.SS Create an RSA Endorsement Key and make it persistent
+.IP
+.nf
+\fC
+tpm2_createek \-P abc123 \-w abc123 \-c 0x81010001 \-G rsa \-u ek.pub
+\fR
+.fi
+.SS Create an ECC NIST_P384 Endorsement Key and make it persistent
 .IP
 .nf
 \fC
-tpm2_createek\ \-P\ abc123\ \-w\ abc123\ \-c\ 0x81010001\ \-G\ rsa\ \-u\ ek.pub
-\f
+tpm2_createek \-G ecc384 \-c 0x81010002
+\fR
 .fi
 .SS Create a transient Endorsement Key, flush it, and reload it.
 .IP
 .nf
 \fC
-tpm2_createek\ \-G\ rsa\ \-u\ ek.pub
+tpm2_createek \-G rsa \-u ek.pub
 
-#\ Check\ that\ it\ is\ loaded\ in\ transient\ memory
-tpm2_getcap\ handles\-transient
-\-\ 0x80000000
+# Check that it is loaded in transient memory
+tpm2_getcap handles\-transient
+\- 0x80000000
 
-#\ Flush\ the\ handle
-tpm2_flushcontext\ 0x80000000
+# Flush the handle
+tpm2_flushcontext 0x80000000
 
-#\ Note\ that\ it\ is\ flushed
-tpm2_getcap\ handles\-transient
-<null\ output>
+# Note that it is flushed
+tpm2_getcap handles\-transient
+<null output>
 
-#\ Reload\ it\ via\ loadexternal
-tpm2_loadexternal\ \-C\ o\ \-u\ ek.pub\ \-c\ ek.ctx
+# Reload it via loadexternal
+tpm2_loadexternal \-C o \-u ek.pub \-c ek.ctx
 
-#\ Check\ that\ it\ is\ re\-loaded\ in\ transient\ memory
-tpm2_getcap\ handles\-transient
-\-\ 0x80000000
-\f
+# Check that it is re\-loaded in transient memory
+tpm2_getcap handles\-transient
+\- 0x80000000
+\fR
 .fi
 .SH Returns
 .PP
@@ -617,4 +652,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_createpolicy.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_createpolicy.1 Changed

@@ -1,18 +1,18 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_createpolicy" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_createpolicy\f(1) \- Creates simple assertion authorization
+\fBtpm2_createpolicy\fR(1) \- Creates simple assertion authorization
 policies based on multiple PCR indices values across multiple enabled
 banks.
 .SH SYNOPSIS
 .PP
-\fBtpm2_createpolicy\f \fIOPTIONS\f
+\fBtpm2_createpolicy\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_createpolicy\f(1) \- Creates simple assertion authorization
+\fBtpm2_createpolicy\fR(1) \- Creates simple assertion authorization
 policies based on multiple PCR indices values across multiple enabled
 banks.
 It can then be used with object creation and or tools using the object.
@@ -20,31 +20,31 @@
 .PP
 These options control creating the policy authorization session:
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file to save the policy digest.
 .RE
 .IP \bu 2
-\fB\-\-policy\-pcr\f:
+\fB\-\-policy\-pcr\fR:
 .RS 2
 .PP
 Identifies the PCR policy type for policy creation.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-policy\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-policy\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm used in computation of the policy digest.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-pcr\-list\f=\fIPCR\f:
+\fB\-l\fR, \fB\-\-pcr\-list\fR=\fIPCR\fR:
 .RS 2
 .PP
-The list of PCR banks and selected PCRs\aq ids for each bank.
+The list of PCR banks and selected PCRs\cq ids for each bank.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-pcr\f=\fIFILE\f:
+\fB\-f\fR, \fB\-\-pcr\fR=\fIFILE\fR:
 .RS 2
 .PP
 Optional Path or Name of the file containing expected PCR values for the
@@ -52,16 +52,16 @@
 Default is to read the current PCRs per the set list.
 .RE
 .IP \bu 2
-\fB\-\-policy\-session\f:
+\fB\-\-policy\-session\fR:
 .RS 2
 .PP
-Start a policy session of type \fBTPM_SE_POLICY\f.
-Defaults to \fBTPM_SE_TRIAL\f if this option isn\aqt specified.
+Start a policy session of type \fBTPM_SE_POLICY\fR.
+Defaults to \fBTPM_SE_TRIAL\fR if this option isn\cqt specified.
 .RE
 .SS References
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -72,7 +72,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -83,6 +83,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -116,6 +118,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -143,7 +147,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -152,27 +156,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -180,21 +192,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -207,6 +221,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -219,86 +235,87 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
 Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
-bank/algorithm \fIPCR\f.
+bank/algorithm \fIPCR\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -306,18 +323,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -334,84 +351,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -419,8 +443,8 @@
 .IP
 .nf
 \fC
-tpm2_createpolicy\ \\\-\-policy\-pcr\ \-l\ 0x4:0\ \-L\ policy.file\ \-f\ pcr0.bin
-\f
+tpm2_createpolicy \rs\-\-policy\-pcr \-l 0x4:0 \-L policy.file \-f pcr0.bin
+\fR
 .fi
 .SH Returns
 .PP
@@ -443,4 +467,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_createprimary.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_createprimary.1 Changed

@@ -1,96 +1,98 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_createprimary" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_createprimary\f(1) \- Create a primary key.
+\fBtpm2_createprimary\fR(1) \- Create a primary key.
 .SH SYNOPSIS
 .PP
-\fBtpm2_createprimary\f \fIOPTIONS\f
+\fBtpm2_createprimary\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_createprimary\f(1) \- This command is used to create a
+\fBtpm2_createprimary\fR(1) \- This command is used to create a
 primary object under one of the hierarchies: Owner, Platform,
 Endorsement, NULL.
 The command will create and load a Primary Object.
 The sensitive and public portions are not returned.
-A context file for the created object\aqs handle is saved as a file
+A context file for the created object\cqs handle is saved as a file
 for future interactions with the created primary.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 The hierarchy under which the object is created.
 This will also dictate which authorization secret (if any) must be
 supplied.
-Defaults to \fBTPM_RH_OWNER\f, when no value specified.
+Defaults to \fBTPM_RH_OWNER\fR, when no value specified.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fBe\f for \fBTPM_RH_ENDORSEMENT\f
+\fBe\fR for \fBTPM_RH_ENDORSEMENT\fR
 .IP \bu 2
-\fBn\f for \fBTPM_RH_NULL\f
+\fBn\fR for \fBTPM_RH_NULL\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a raw number can be used.
+\fB\fCB<num>\fB\fR where a raw number can be used.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-hierarchy\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-hierarchy\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
-The authorization value for the hierarchy specified with \fB\-C\f.
+The authorization value for the hierarchy specified with \fB\-C\fR.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-key\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-key\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the primary object created.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm to use for generating the objects name.
 Defaults to sha256 if not specified.
 .RE
 .IP \bu 2
-\fB\-G\f, \fB\-\-key\-algorithm\f=\fIALGORITHM\f:
+\fB\-G\fR, \fB\-\-key\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The algorithm type for the generated primary key.
 Defaults to rsa2048:null:aes128cfb.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIFILE\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file path to save the object context of the generated primary
 object.
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR or
+\fIHEX_STRING\fR:
 .RS 2
 .PP
-An optional file input that contains the policy digest for policy based
-authorization of the object.
+An optional file input or hex string that contains the policy digest for
+policy based authorization of the object.
 .RE
 .IP \bu 2
-\fB\-a\f, \fB\-\-attributes\f=\fIATTRIBUTES\f:
+\fB\-a\fR, \fB\-\-attributes\fR=\fIATTRIBUTES\fR:
 .RS 2
 .PP
 The object attributes, optional.
 Defaults to:
-\fCTPMA_OBJECT_RESTRICTED|TPMA_OBJECT_DECRYPT|TPMA_OBJECT_FIXEDTPM|\ \ TPMA_OBJECT_FIXEDPARENT|TPMA_OBJECT_SENSITIVEDATAORIGIN|\ \ TPMA_OBJECT_USERWITHAUTH\f
+\fCTPMA_OBJECT_RESTRICTED|TPMA_OBJECT_DECRYPT|TPMA_OBJECT_FIXEDTPM|  TPMA_OBJECT_FIXEDPARENT|TPMA_OBJECT_SENSITIVEDATAORIGIN|  TPMA_OBJECT_USERWITHAUTH\fR
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-unique\-data\f=\fIFILE\f OR \fISTDIN\f:
+\fB\-u\fR, \fB\-\-unique\-data\fR=\fIFILE\fR OR
+\fISTDIN\fR:
 .RS 2
 .PP
 An optional file input that contains the unique field of
-\fBTPMT_PUBLIC\f in little\-endian format.
+\fBTPMT_PUBLIC\fR in little\-endian format.
 Primary key creator may place information that causes the primary key
 generation scheme internal to the TPM to generate statistically unique
 values.
@@ -103,9 +105,9 @@
 that this buffer is formatted per TPMU_PUBLIC_ID union.
 .PP
 The unique data can also be retrieved from stdin buffer by specifying
-\fB"\-"\f as the \fB\-\-unique\-data\f option value and the tool
-will parse the key type and associate the input data with the unique
-data buffer associated with the key type.
+\fB\lq\-\rq\fR as the \fB\enunique\-data\fR option value
+and the tool will parse the key type and associate the input data with
+the unique data buffer associated with the key type.
 NOTE:
 .IP "1." 3
 The maximum allowed bytes is dependent on key type and the TPM
@@ -118,33 +120,33 @@
 the X coordinate and Y coordinate buffers.
 .RE
 .IP \bu 2
-\fB\-\-creation\-data\f=\fIFILE\f:
+\fB\-\-creation\-data\fR=\fIFILE\fR:
 .RS 2
 .PP
 An optional file output that saves the creation data for certification.
 .RE
 .IP \bu 2
-\fB\-\-template\-data\f=\fIFILE\f:
+\fB\-\-template\-data\fR=\fIFILE\fR:
 .RS 2
 .PP
 An optional file output that saves the key template data (TPM2B_PUBLIC)
-to be used in \fBtpm2_policytemplate\f.
+to be used in \fBtpm2_policytemplate\fR.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-creation\-ticket\f=\fIFILE\f:
+\fB\-t\fR, \fB\-\-creation\-ticket\fR=\fIFILE\fR:
 .RS 2
 .PP
 An optional file output that saves the creation ticket for
 certification.
 .RE
 .IP \bu 2
-\fB\-d\f, \fB\-\-creation\-hash\f=\fIFILE\f:
+\fB\-d\fR, \fB\-\-creation\-hash\fR=\fIFILE\fR:
 .RS 2
 .PP
 An optional file output that saves the creation hash for certification.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-outside\-info\f=\fIFILE_OR_HEX\f:
+\fB\-q\fR, \fB\-\-outside\-info\fR=\fIFILE_OR_HEX\fR:
 .RS 2
 .PP
 An optional file or hex string to add unique data to the creation data.
@@ -152,14 +154,14 @@
 object.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-pcr\-list\f=\fIPCR\f:
+\fB\-l\fR, \fB\-\-pcr\-list\fR=\fIPCR\fR:
 .RS 2
 .PP
-The list of PCR banks and selected PCRs\aq ids for each bank to be
+The list of PCR banks and selected PCRs\cq ids for each bank to be
 included in the creation data for certification.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -167,16 +169,36 @@
 NOTE: When this option is selected, The tool will not actually execute
 the command, it simply returns a cpHash.
 .RE
+.IP \bu 2
+\fB\-f\fR, \fB\-\-format\fR:
+.RS 2
+.PP
+Format selection for the public key output file.
+`tss' (the default) will output a binary blob according to the TPM 2.0
+Specification.
+`pem' will output an OpenSSL compatible PEM encoded public key.
+`der' will output an OpenSSL compatible DER encoded public key.
+`tpmt' will output a binary blob of the TPMT_PUBLIC struct referenced by
+TPM 2.0 specs.
+.PP
+Public key format.
+.RE
+.IP \bu 2
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR:
+.RS 2
+.PP
+The output file path, recording the public portion of the object.
+.RE
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -189,8 +211,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -199,45 +220,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -245,69 +266,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -316,13 +339,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -333,7 +356,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -344,6 +367,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -377,6 +402,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -404,7 +431,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -413,27 +440,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
+.IP \bu 2
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -441,21 +476,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -468,6 +505,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -480,73 +519,73 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH Object Attributes
 .PP
 Object Attributes are used to control various properties of created
 objects.
 When specified as an option, either the raw bitfield mask or
-"nice\-names" may be used.
+\lqnice\-names\rq may be used.
 The values can be found in Table 31 Part 2 of the TPM2.0 specification,
 which can be found here:
 .PP
 <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf>
 .PP
 Nice names are calculated by taking the name field of table 31 and
-removing the prefix \fBTPMA_OBJECT_\f and lowercasing the result.
-Thus, \fBTPMA_OBJECT_FIXEDTPM\f becomes fixedtpm.
-Nice names can be joined using the bitwise or "|" symbol.
+removing the prefix \fBTPMA_OBJECT_\fR and lowercasing the result.
+Thus, \fBTPMA_OBJECT_FIXEDTPM\fR becomes fixedtpm.
+Nice names can be joined using the bitwise or \lq|\rq symbol.
 .PP
-For instance, to set The fields \fBTPMA_OBJECT_FIXEDTPM\f,
-\fBTPMA_OBJECT_NODA\f, and \fBTPMA_OBJECT_SIGN_ENCRYPT\f, the
+For instance, to set The fields \fBTPMA_OBJECT_FIXEDTPM\fR,
+\fBTPMA_OBJECT_NODA\fR, and \fBTPMA_OBJECT_SIGN_ENCRYPT\fR, the
 argument would be:
 .PP
-\fBfixedtpm|noda|sign\f specifying the object attributes
-\fIATTRIBUTES\f.
+\fBfixedtpm|noda|sign\fR specifying the object attributes
+\fIATTRIBUTES\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -554,18 +593,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -582,84 +621,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -667,11 +713,10 @@
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-g\ sha256\ \-G\ ecc\ \-c\ context.out
-\f
+tpm2_createprimary \-C o \-g sha256 \-G ecc \-c context.out
+\fR
 .fi
-.SS Create a primary object that follows the guidance of TCG
-Provisioning guide
+.SS Create a primary object that follows the guidance of TCG Provisioning guide
 .PP
 See :
 https://trustedcomputinggroup.org/wp\-content/uploads/TCG\-TPM\-v2.0\-Provisioning\-Guidance\-Published\-v1r1.pdf
@@ -681,10 +726,13 @@
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-G\ rsa2048:aes128cfb\ \-g\ sha256\ \-c\ prim.ctx\ \\
-\-a\ \aqrestricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|\\
-noda\aq\ \-u\ unique.dat
-\f
+tpm2_createprimary \-C o \-G rsa2048:aes128cfb \-g sha256 \-c prim.ctx \rs
+\-a \aqrestricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|\rs
+noda\aq \-u unique.dat
+
+## Create a primary object and output the public key in pem format
+tpm2_createprimary \-c primary.ctx \-\-format=pem \-\-output=public.pem
+\fR
 .fi
 .SH Returns
 .PP
@@ -707,4 +755,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_dictionarylockout.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_dictionarylockout.1 Changed

@@ -1,44 +1,44 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_dictionarylockout" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_dictionarylockout\f(1) \- Setup or clear
+\fBtpm2_dictionarylockout\fR(1) \- Setup or clear
 dictionary\-attack\-lockout parameters.
 .SH SYNOPSIS
 .PP
-\fBtpm2_dictionarylockout\f \fIOPTIONS\f
+\fBtpm2_dictionarylockout\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_dictionarylockout\f(1) \- Setup dictionary\-attack\-lockout
+\fBtpm2_dictionarylockout\fR(1) \- Setup dictionary\-attack\-lockout
 parameters or clear dictionary\-attack\-lockout state.
 .SH OPTIONS
 .IP \bu 2
-\fB\-s\f, \fB\-\-setup\-parameters\f:
+\fB\-s\fR, \fB\-\-setup\-parameters\fR:
 .RS 2
 .PP
 Specifies the tool should operate to setup dictionary\-attack\-lockout
 parameters.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-clear\-lockout\f:
+\fB\-c\fR, \fB\-\-clear\-lockout\fR:
 .RS 2
 .PP
 Specifies the tool should operate to clear dictionary\-attack\-lockout
 state.
 .RE
 .IP \bu 2
-\fB\-l\f,
-\fB\-\-lockout\-recovery\-time\f=\fINATURAL_NUMBER\f:
+\fB\-l\fR,
+\fB\-\-lockout\-recovery\-time\fR=\fINATURAL_NUMBER\fR:
 .RS 2
 .PP
 Specifies the wait time in seconds before another
-\fBTPM_RH_LOCKOUT\f authentication attempt can be made after a
+\fBTPM_RH_LOCKOUT\fR authentication attempt can be made after a
 failed authentication.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-recovery\-time\f=\fINATURAL_NUMBER\f:
+\fB\-t\fR, \fB\-\-recovery\-time\fR=\fINATURAL_NUMBER\fR:
 .RS 2
 .PP
 Specifies the wait time in seconds before another DA\-protected\-object
@@ -46,20 +46,20 @@
 authentications.
 .RE
 .IP \bu 2
-\fB\-n\f, \fB\-\-max\-tries\f=\fINATURAL_NUMBER\f:
+\fB\-n\fR, \fB\-\-max\-tries\fR=\fINATURAL_NUMBER\fR:
 .RS 2
 .PP
 Specifies the maximum number of allowed authentication attempts on
 DA\-protected\-object; after which DA is activated.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the lockout handle.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -76,45 +76,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -122,69 +122,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -193,40 +195,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -234,18 +237,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -262,94 +265,101 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_dictionarylockout\ \-c\ \-p\ passwd
+tpm2_dictionarylockout \-c \-p passwd
 
-tpm2_dictionarylockout\ \-s\ \-n\ 5\ \-t\ 6\ \-l\ 7\ \-p\ passwd
-\f
+tpm2_dictionarylockout \-s \-n 5 \-t 6 \-l 7 \-p passwd
+\fR
 .fi
 .SH Returns
 .PP
@@ -372,4 +382,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_duplicate.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_duplicate.1 Changed

@@ -1,4 +1,4 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_duplicate" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
@@ -8,10 +8,10 @@
 in a different hierarchy.
 .SH SYNOPSIS
 .PP
-\fBtpm2_duplicate\f \fIOPTIONS\f
+\fBtpm2_duplicate\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_duplicate\f(1) \- This tool duplicates a loaded object so
+\fBtpm2_duplicate\fR(1) \- This tool duplicates a loaded object so
 that it may be used in a different hierarchy.
 The new parent key for the duplicate may be on the same or different TPM
 or TPM_RH_NULL.
@@ -19,7 +19,7 @@
 .PP
 These options control the key importation process:
 .IP \bu 2
-\fB\-G\f, \fB\-\-wrapper\-algorithm\f=\fIALGORITHM\f:
+\fB\-G\fR, \fB\-\-wrapper\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 The symmetric algorithm to be used for the inner wrapper.
 Supports:
@@ -29,7 +29,7 @@
 null \- none
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-encryptionkey\-in\f=\fIFILE\f:
+\fB\-i\fR, \fB\-\-encryptionkey\-in\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specifies the filename of the symmetric key (128 bit data) to be used
@@ -37,7 +37,7 @@
 Valid only when specified symmetric algorithm is not null
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-encryptionkey\-out\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-encryptionkey\-out\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specifies the filename to store the symmetric key (128 bit data) that
@@ -47,13 +47,29 @@
 The TPM generates the key in this case.
 .RE
 .IP \bu 2
-\fB\-C\f, \fB\-\-parent\-context\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-parent\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The parent key object.
 .RE
 .IP \bu 2
-\fB\-r\f, \fB\-\-private\f=\fIFILE\f:
+\fB\-U\fR, \fB\-\-parent\-public\fR=\fIFILE\fR:
+.RS 2
+.PP
+Specifies the file path to the public key of the parent object on the
+destination TPM.
+This should be a \fCTPM2B_PUBLIC\fR formatted file.
+.RE
+.IP \bu 2
+\fB\-k\fR, \fB\-\-private\-key\fR=\fIFILE\fR:
+.RS 2
+.PP
+Specifies the file path to the external private key be encrypted for the
+remote TPM.
+This should be a PEM format private key.
+.RE
+.IP \bu 2
+\fB\-r\fR, \fB\-\-private\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specifies the file path to save the private portion of the duplicated
@@ -65,42 +81,55 @@
 (confidentiality and integrity).
 For instance, transient objects require that TPM protected data (key or
 seal material) be stored outside of the TPM.
-This is seen in tools like tpm2_create(1), where the \fB\-r\f option
-outputs this protected data.
+This is seen in tools like tpm2_create(1), where the \fB\-r\fR
+option outputs this protected data.
 This blob contains the sensitive portions of the object.
 The sensitive portions of the object are protected by the parent object,
-using the parent\aqs symmetric encryption details to encrypt the
+using the parent\cqs symmetric encryption details to encrypt the
 sensitive data and HMAC it.
 .PP
 In\-depth details can be found in sections 23 of:
 .IP \bu 2
 https://trustedcomputinggroup.org/wp\-content/uploads/TPM\-Rev\-2.0\-Part\-1\-Architecture\-01.38.pdf
 .PP
-Notably Figure 20, is relevant, even though it\aqs specifically
+Notably Figure 20, is relevant, even though it\cqs specifically
 referring to duplication blobs, the process is identical.
 .PP
 If the output is from tpm2_duplicate(1), the output will be slightly
 different, as described fully in section 23.
 .IP \bu 2
-\fB\-s\f, \fB\-\-encrypted\-seed\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
+.RS 2
+.PP
+Specifies the file path to save the public portion of the duplicated
+object, if an external key is being duplicated.
+.RE
+.IP \bu 2
+\fB\-s\fR, \fB\-\-encrypted\-seed\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file to save the encrypted seed of the duplicated object.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the key, optional.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
+.RS 2
+.PP
+The input policy file, optional.
+.RE
+.IP \bu 2
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The object to be duplicated.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -112,12 +141,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -130,8 +159,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -140,45 +168,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -186,69 +214,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -257,13 +287,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -274,7 +304,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -285,6 +315,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -318,6 +350,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -345,7 +379,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -354,27 +388,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
+.IP \bu 2
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+sm4 \- Default SM4: sm4128
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
+.IP \bu 2
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -382,21 +424,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -409,6 +453,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -421,51 +467,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -473,18 +519,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -501,162 +547,161 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
-.PP
-To duplicate a key, one needs the key to duplicate, created with a
-policy that
-.PD 0
-.P
-.PD
-allows duplication and a new parent:
+.SS Example\-1: Duplicate a key created with a policy that allows for duplication:
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.dat
-tpm2_policycommandcode\ \-S\ session.dat\ \-L\ policy.dat\ TPM2_CC_Duplicate
-tpm2_flushcontext\ session.dat
+tpm2_startauthsession \-S session.dat
+tpm2_policycommandcode \-S session.dat \-L policy.dat TPM2_CC_Duplicate
+tpm2_flushcontext session.dat
 
-tpm2_createprimary\ \-C\ o\ \-g\ sha256\ \-G\ rsa\ \-c\ primary.ctxt
-tpm2_create\ \-C\ primary.ctxt\ \-g\ sha256\ \-G\ rsa\ \-r\ key.prv\ \-u\ key.pub\ \\
-\-L\ policy.dat\ \-a\ "sensitivedataorigin"
+tpm2_createprimary \-C o \-g sha256 \-G rsa \-c primary.ctxt
+tpm2_create \-C primary.ctxt \-g sha256 \-G rsa \-r key.prv \-u key.pub  \-c key.ctxt \rs
+\-L policy.dat \-a \dqsensitivedataorigin|userwithauth|decrypt|sign\dq
 
-tpm2_loadexternal\ \-C\ o\ \-u\ new_parent.pub\ \-c\ new_parent.ctxt
+tpm2_createprimary \-C o \-g sha256 \-G ecc \-c new_parent.ctxt
 
-tpm2_startauthsession\ \\\-\-policy\-session\ \-S\ session.dat
-tpm2_policycommandcode\ \-S\ session.dat\ \-L\ policy.dat\ TPM2_CC_Duplicate
-tpm2_duplicate\ \-C\ new_parent.ctxt\ \-c\ key.ctxt\ \-G\ null\ \-p\ "session:session.dat"\ \\
-\-r\ duprv.bin\ \-s\ seed.dat
-tpm2_flushcontext\ session.dat
-\f
+tpm2_startauthsession \rs\-\-policy\-session \-S session.dat
+tpm2_policycommandcode \-S session.dat \-L policy.dat TPM2_CC_Duplicate
+tpm2_duplicate \-C new_parent.ctxt \-c key.ctxt \-G null \-p \dqsession:session.dat\dq \rs
+\-r duprv.bin \-s seed.dat
+tpm2_flushcontext session.dat
+\fR
 .fi
-.PP
-As an end\-to\-end example, the following will transfer an RSA key
-generated on \fCTPM\-A\f to \fCTPM\-B\f
+.SS Example\-2: As an end\-to\-end example, the following will transfer an RSA key generated on \fCTPM\-A\fR to \fCTPM\-B\fR
 .SS On TPM\-B
 .PP
 Create a parent object that will be used to wrap/transfer the key.
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-g\ sha256\ \-G\ rsa\ \-c\ primary.ctx
+tpm2_createprimary \-C o \-g sha256 \-G rsa \-c primary.ctx
 
-tpm2_create\ \ \-C\ primary.ctx\ \-g\ sha256\ \-G\ rsa\ \\
-\-r\ new_parent.prv\ \ \-u\ new_parent.pub\ \\
-\-a\ "restricted|sensitivedataorigin|decrypt|userwithauth"
-\f
+tpm2_create  \-C primary.ctx \-g sha256 \-G rsa \rs
+\-r new_parent.prv  \-u new_parent.pub \rs
+\-a \dqrestricted|sensitivedataorigin|decrypt|userwithauth\dq
+\fR
 .fi
 .PP
-Copy \fCnew_parent.pub\f to \fCTPM\-A\f.
+Copy \fCnew_parent.pub\fR to \fCTPM\-A\fR.
 .SS On TPM\-A
 .PP
 Create root object and auth policy allows duplication only
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-g\ sha256\ \-G\ rsa\ \-c\ primary.ctx
+tpm2_createprimary \-C o \-g sha256 \-G rsa \-c primary.ctx
 
-tpm2_startauthsession\ \-S\ session.dat
+tpm2_startauthsession \-S session.dat
 
-tpm2_policycommandcode\ \-S\ session.dat\ \-L\ dpolicy.dat\ TPM2_CC_Duplicate
+tpm2_policycommandcode \-S session.dat \-L dpolicy.dat TPM2_CC_Duplicate
 
-tpm2_flushcontext\ session.dat
+tpm2_flushcontext session.dat
 
-rm\ session.dat
-\f
+rm session.dat
+\fR
 .fi
 .PP
 Generate an RSA keypair on TPM\-A that will be duplicated (note the
-passphrase is \aqfoo\aq)
+passphrase is `foo')
 .IP
 .nf
 \fC
-tpm2_create\ \-C\ primary.ctx\ \-g\ sha256\ \-G\ rsa\ \-p\ foo\ \-r\ key.prv\ \\
-\-u\ key.pub\ \ \-L\ dpolicy.dat\ \-a\ "sensitivedataorigin|userwithauth|decrypt|sign"
+tpm2_create \-C primary.ctx \-g sha256 \-G rsa \-p foo \-r key.prv \rs
+\-u key.pub  \-L dpolicy.dat \-a \dqsensitivedataorigin|userwithauth|decrypt|sign\dq
 
-tpm2_load\ \-C\ primary.ctx\ \-r\ key.prv\ \-u\ key.pub\ \-c\ key.ctx
+tpm2_load \-C primary.ctx \-r key.prv \-u key.pub \-c key.ctx
 
-tpm2_readpublic\ \-c\ key.ctx\ \-o\ dup.pub
-\f
+tpm2_readpublic \-c key.ctx \-o dup.pub
+\fR
 .fi
 .PP
 Test sign and encryption locally (so we can compare later that the same
@@ -664,10 +709,10 @@
 .IP
 .nf
 \fC
-echo\ "meet\ me\ at.."\ >file.txt
-tpm2_rsaencrypt\ \-c\ key.ctx\ \ \-o\ data.encrypted\ file.txt
-tpm2_sign\ \-c\ key.ctx\ \-g\ sha256\ \-f\ plain\ \-p\ foo\ \-o\ sign.raw\ file.txt
-\f
+echo \dqmeet me at..\dq >file.txt
+tpm2_rsaencrypt \-c key.ctx  \-o data.encrypted file.txt
+tpm2_sign \-c key.ctx \-g sha256 \-f plain \-p foo \-o sign.raw file.txt
+\fR
 .fi
 .PP
 Compare the signature hash (we will use this later to confirm the key
@@ -675,37 +720,37 @@
 .IP
 .nf
 \fC
-sha256sum\ sign.raw
+sha256sum sign.raw
 
 a1b4e3fbaa29e6e46d95cff498150b6b8e7d9fd21182622e8f5a3ddde257879e
-\f
+\fR
 .fi
 .PP
 Start an auth session and policy command to allow duplication
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-\-policy\-session\ \-S\ session.dat
+tpm2_startauthsession \-\-policy\-session \-S session.dat
 
-tpm2_policycommandcode\ \-S\ session.dat\ \-L\ dpolicy.dat\ TPM2_CC_Duplicate
-\f
+tpm2_policycommandcode \-S session.dat \-L dpolicy.dat TPM2_CC_Duplicate
+\fR
 .fi
 .PP
-Load the new_parent.pub file transferred from \fCTPM\-B\f
+Load the new_parent.pub file transferred from \fCTPM\-B\fR
 .IP
 .nf
 \fC
-tpm2_loadexternal\ \-C\ o\ \-u\ new_parent.pub\ \-c\ new_parent.ctx
-\f
+tpm2_loadexternal \-C o \-u new_parent.pub \-c new_parent.ctx
+\fR
 .fi
 .PP
 Start the duplication
 .IP
 .nf
 \fC
-tpm2_duplicate\ \-C\ new_parent.ctx\ \-c\ key.ctx\ \-G\ null\ \ \\
-\-p\ "session:session.dat"\ \-r\ dup.dpriv\ \-s\ dup.seed
-\f
+tpm2_duplicate \-C new_parent.ctx \-c key.ctx \-G null  \rs
+\-p \dqsession:session.dat\dq \-r dup.dpriv \-s dup.seed
+\fR
 .fi
 .PP
 Copy the following files to TPM\-B: * dup.pub * dup.dpriv * dup.seed *
@@ -716,39 +761,39 @@
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-\-policy\-session\ \-S\ session.dat
+tpm2_startauthsession \-\-policy\-session \-S session.dat
 
-tpm2_policycommandcode\ \-S\ session.dat\ \-L\ dpolicy.dat\ TPM2_CC_Duplicate
-\f
+tpm2_policycommandcode \-S session.dat \-L dpolicy.dat TPM2_CC_Duplicate
+\fR
 .fi
 .PP
 Load the context we used to transfer
 .IP
 .nf
 \fC
-tpm2_flushcontext\ \-\-transient\-object
+tpm2_flushcontext \-\-transient\-object
 
-tpm2_load\ \-C\ primary.ctx\ \-u\ new_parent.pub\ \-r\ new_parent.prv\ \-c\ new_parent.ctx
-\f
+tpm2_load \-C primary.ctx \-u new_parent.pub \-r new_parent.prv \-c new_parent.ctx
+\fR
 .fi
 .PP
 Import the duplicated context against the parent we used
 .IP
 .nf
 \fC
-tpm2_import\ \-C\ new_parent.ctx\ \-u\ dup.pub\ \-i\ dup.dpriv\ \\
-\-r\ dup.prv\ \-s\ dup.seed\ \-L\ dpolicy.dat
-\f
+tpm2_import \-C new_parent.ctx \-u dup.pub \-i dup.dpriv \rs
+\-r dup.prv \-s dup.seed \-L dpolicy.dat
+\fR
 .fi
 .PP
 Load the duplicated key context
 .IP
 .nf
 \fC
-tpm2_flushcontext\ \-\-transient\-object
+tpm2_flushcontext \-\-transient\-object
 
-tpm2_load\ \-C\ new_parent.ctx\ \-u\ dup.pub\ \-r\ dup.prv\ \-c\ dup.ctx
-\f
+tpm2_load \-C new_parent.ctx \-u dup.pub \-r dup.prv \-c dup.ctx
+\fR
 .fi
 .PP
 Test the imported key matches
@@ -757,35 +802,74 @@
 .IP
 .nf
 \fC
-echo\ "meet\ me\ at.."\ >file.txt
+echo \dqmeet me at..\dq >file.txt
 
-tpm2_sign\ \-c\ dup.ctx\ \-g\ sha256\ \-o\ sig.rss\ \-p\ foo\ file.txt
+tpm2_sign \-c dup.ctx \-g sha256 \-o sig.rss \-p foo file.txt
 
-dd\ if=sig.rss\ of=sign.raw\ bs=1\ skip=6\ count=256
-\f
+dd if=sig.rss of=sign.raw bs=1 skip=6 count=256
+\fR
 .fi
 .PP
 Compare the signature file hash:
 .IP
 .nf
 \fC
-$\ sha256sum\ sign.raw
+$ sha256sum sign.raw
 
 a1b4e3fbaa29e6e46d95cff498150b6b8e7d9fd21182622e8f5a3ddde257879e
-\f
+\fR
 .fi
 .IP \bu 2
 Decryption
 .IP
 .nf
 \fC
-tpm2_flushcontext\ \-\-transient\-object
+tpm2_flushcontext \-\-transient\-object
 
-tpm2_rsadecrypt\ \-p\ foo\ \-c\ dup.ctx\ \-o\ data.ptext\ data.encrypted
+tpm2_rsadecrypt \-p foo \-c dup.ctx \-o data.ptext data.encrypted
 
-#\ cat\ data.ptext\ 
-meet\ me\ at..
-\f
+# cat data.ptext 
+meet me at..
+\fR
+.fi
+.SS Example\-3: Exporting an OpenSSL RSA key for a remote TPM
+.PP
+To securely send an OpenSSL generated RSA key to a remote TPM such that
+only that remote TPM will be able to load it, and without exposing the
+private key to the host operating system on the remote machine:
+.IP \bu 2
+On the destination TPM\-B, create a primary context and read its public
+key, then send \fCprimary.pub\fR to the source machine:
+.IP
+.nf
+\fC
+tpm2_createprimary \-c primary.ctx
+tpm2_readpublic \-c primary.ctx \-o primary.pub
+\fR
+.fi
+.IP \bu 2
+On the source machine create the RSA private key and wrap it for the
+destination TPM\cqs public key.
+Similar to \fCtpm2_makecredential\fR, this step should not require a
+TPM.
+.IP
+.nf
+\fC
+openssl genrsa \-out rsa.pem
+tpm2_duplicate \-U primary.pub \-G rsa \-k rsa.pem \-u rsa.pub \-r rsa.dpriv \-s rsa.seed
+\fR
+.fi
+.IP \bu 2
+Send the \fCrsa.pub\fR, \fCrsa.dpriv\fR and \fCrsa.seed\fR
+to the destination TPM\-B and import the files, which will decrypt them
+using the \fCprimary.ctx\fR to produce \fCrsa.priv\fR, which can
+then be loaded and used as a TPM key:
+.IP
+.nf
+\fC
+tpm2_import \-C primary.ctx \-G rsa \-i rsa.dpriv \-s rsa.seed \-u rsa.pub \-r rsa.priv
+tpm2_load \-C primary.ctx \-c rsa.ctx \-u rsa.pub \-r rsa.priv
+\fR
 .fi
 .SH Returns
 .PP
@@ -808,4 +892,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_ecdhkeygen.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_ecdhkeygen.1 Changed

@@ -1,45 +1,54 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_ecdhkeygen" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_ecdhkeygen\f(1) \- Creates an ephemeral key and uses it to
+\fBtpm2_ecdhkeygen\fR(1) \- Creates an ephemeral key and uses it to
 generate the shared secret value using the parameters from a ECC public
 key.
 .SH SYNOPSIS
 .PP
-\fBtpm2_ecdhkeygen\f \fIOPTIONS\f
+\fBtpm2_ecdhkeygen\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_ecdhkeygen\f(1) \- Creates an ephemeral key and uses it to
+\fBtpm2_ecdhkeygen\fR(1) \- Creates an ephemeral key and uses it to
 generate the shared secret value using the parameters from a ECC public
 key.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-context\f=\fIFILE\f:
+\fB\-c\fR, \fB\-\-context\fR=\fIFILE\fR:
 .RS 2
 .PP
 Context object pointing to ECC public key.
 Either a file or a handle number.
-See section "Context Object Format".
+See section \lqContext Object Format\rq.
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-public\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 Output ECC point Q.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR
 .RS 2
 .PP
 Specify file path to save the calculated ecdh secret or Z point.
 .RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SS References
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -50,7 +59,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -61,6 +70,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -94,6 +105,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -121,7 +134,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -130,27 +143,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
+.IP \bu 2
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -158,21 +179,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -185,6 +208,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -197,51 +222,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -249,18 +274,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -277,96 +302,103 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx\ \-Q
+tpm2_createprimary \-C o \-c prim.ctx \-Q
 
-tpm2_create\ \-C\ prim.ctx\ \-c\ key.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-G\ ecc256:ecdaa
+tpm2_create \-C prim.ctx \-c key.ctx \-u key.pub \-r key.priv \-G ecc256:ecdaa
 
-tpm2_ecdhkeygen\ \-u\ ecdh.pub\ \-o\ ecdh.priv\ \-c\ key.ctx
-\f
+tpm2_ecdhkeygen \-u ecdh.pub \-o ecdh.priv \-c key.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -389,4 +421,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_ecdhzgen.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_ecdhzgen.1 Changed

@@ -1,52 +1,61 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_ecdhzgen" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_ecdhzgen\f(1) \- Recovers the shared secret value (Z) from a
-public point and a specified private key.
+\fBtpm2_ecdhzgen\fR(1) \- Recovers the shared secret value (Z) from
+a public point and a specified private key.
 .SH SYNOPSIS
 .PP
-\fBtpm2_ecdhzgen\f \fIOPTIONS\f
+\fBtpm2_ecdhzgen\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_ecdhzgen\f(1) \- Recovers the shared secret value (Z) from a
-public point and a specified private key.
+\fBtpm2_ecdhzgen\fR(1) \- Recovers the shared secret value (Z) from
+a public point and a specified private key.
 It will perform the multiplication of the provided inPoint (QB) with the
 private key (ds) and return the coordinates of the resultant point (Z =
-(xZ , yZ) ≔ hdsQB; where h is the cofactor of the curve).
+(xZ , yZ) \u2254 hdsQB; where h is the cofactor of the curve).
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIFILE\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIFILE\fR:
 .RS 2
 .PP
 Context object pointing to ECC key.
 Either a file or a handle number.
-See section "Context Object Format".
+See section \lqContext Object Format\rq.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-key\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-key\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the ECC key object.
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-public\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 Output ECC point Q.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR
 .RS 2
 .PP
 Specify file path to save the calculated ecdh secret or Z point.
 .RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SS References
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -57,7 +66,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -68,6 +77,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -101,6 +112,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -128,7 +141,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -137,27 +150,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
+.IP \bu 2
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -165,21 +186,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -192,6 +215,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -204,51 +229,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -256,18 +281,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -284,98 +309,105 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx\ \-Q
+tpm2_createprimary \-C o \-c prim.ctx \-Q
 
-tpm2_create\ \-C\ prim.ctx\ \-c\ key.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-G\ ecc256:ecdh
+tpm2_create \-C prim.ctx \-c key.ctx \-u key.pub \-r key.priv \-G ecc256:ecdh
 
-tpm2_ecdhkeygen\ \-u\ ecdh.pub\ \-o\ ecdh.priv\ \-c\ key.ctx
+tpm2_ecdhkeygen \-u ecdh.pub \-o ecdh.priv \-c key.ctx
 
-tpm2_ecdhzgen\ \-u\ ecdh.pub\ \-o\ ecdh.dat\ \-c\ key.ctx
-\f
+tpm2_ecdhzgen \-u ecdh.pub \-o ecdh.dat \-c key.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -398,4 +430,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_ecephemeral.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_ecephemeral.1 Changed

@@ -1,43 +1,53 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_ecephemeral" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_ecephemeral\f(1) \- Creates an ephemeral key for use in a
+\fBtpm2_ecephemeral\fR(1) \- Creates an ephemeral key for use in a
 two\-phase key exchange protocol.
 .SH SYNOPSIS
 .PP
-\fBtpm2_ecephemeral\f \fIOPTIONS\f
+\fBtpm2_ecephemeral\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_ecephemeral\f(1) \- Creates an ephemeral key for use in a
+\fBtpm2_ecephemeral\fR(1) \- Creates an ephemeral key for use in a
 two\-phase key exchange protocol.
 .SH OPTIONS
 .IP \bu 2
-\fBARGUMENT\f=\fIALGORITHM\f:
+\fBARGUMENT\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 Specify the ECC curve.
 Example ecc521.
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-public\f=\fIFILE\f
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR
 .RS 2
 .PP
-Specify the file path to save the ephemeral public point Q ≔ rG.
+Specify the file path to save the ephemeral public point Q \u2254
+rG.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-counter\f=\fIFILE\f
+\fB\-t\fR, \fB\-\-counter\fR=\fIFILE\fR
 .RS 2
 .PP
 Specify file path to save the least\-significant 16 bits of commit
 count.
 .RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SS References
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -48,7 +58,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -59,6 +69,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -92,6 +104,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -119,7 +133,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -128,27 +142,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
+.IP \bu 2
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -156,21 +178,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -183,6 +207,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -195,51 +221,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -247,18 +273,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -275,92 +301,99 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_ecephemeral\ \-u\ ecc.q\ \-t\ ecc.ctr\ ecc256
-\f
+tpm2_ecephemeral \-u ecc.q \-t ecc.ctr ecc256
+\fR
 .fi
 .SH Returns
 .PP
@@ -383,4 +416,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_encodeobject.1 Added

@@ -0,0 +1,428 @@
+.\" Automatically generated by Pandoc 2.5
+.\"
+.TH "tpm2_encodeobject" "1" "" "tpm2\-tools" "General Commands Manual"
+.hy
+.SH NAME
+.PP
+\fBtpm2_encodeobject\fR(1) \- Encode an object into a combined PEM
+format.
+.SH SYNOPSIS
+.PP
+\fBtpm2_encodeobject\fR \fIOPTIONS\fR
+.SH DESCRIPTION
+.PP
+\fBtpm2_encodeobject\fR(1) \- Encode both the private and public
+portions of an object into a combined PEM format used by
+tpm2\-tss\-engine.
+.PP
+The tool reads private and public portions of an object and encodes it
+into a combined PEM format used by tpm2\-tss\-engine and other
+applications.
+.PP
+\fBNOTE\fR: Both private and public portions of the tpm key must be
+specified.
+.SH OPTIONS
+.IP \bu 2
+\fB\-C\fR, \fB\-\-parent\-context\fR=\fIOBJECT\fR:
+.RS 2
+.PP
+The parent object.
+.RE
+.IP \bu 2
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
+.RS 2
+.PP
+The authorization value of the parent object specified by \fB\-C\fR.
+.RE
+.IP \bu 2
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
+.RS 2
+.PP
+A file containing the public portion of the object.
+.RE
+.IP \bu 2
+\fB\-r\fR, \fB\-\-private\fR=\fIFILE\fR:
+.RS 2
+.PP
+A file containing the sensitive portion of the object.
+.RE
+.IP \bu 2
+\fB\-p\fR, \fB\-\-key\-auth\fR:
+.RS 2
+.PP
+Indicates if an authorization value is needed for the object specified
+by \fB\-r\fR and \fB\-u\fR.
+.RE
+.IP \bu 2
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR:
+.RS 2
+.PP
+The output file path, recording the public portion of the object.
+.RE
+.SS References
+.SH Context Object Format
+.PP
+The type of a context object, whether it is a handle or file name, is
+determined according to the following logic \fIin\-order\fR:
+.IP \bu 2
+If the argument is a file path, then the file is loaded as a restored
+TPM transient object.
+.IP \bu 2
+If the argument is a \fIprefix\fR match on one of:
+.RS 2
+.IP \bu 2
+owner: the owner hierarchy
+.IP \bu 2
+platform: the platform hierarchy
+.IP \bu 2
+endorsement: the endorsement hierarchy
+.IP \bu 2
+lockout: the lockout control persistent object
+.RE
+.IP \bu 2
+If the argument argument can be loaded as a number it will be treat as a
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
+.SH Authorization Formatting
+.PP
+Authorization for use of an object in TPM2.0 can come in 3 different
+forms: 1.
+Password 2.
+HMAC 3.
+Sessions
+.PP
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
+.SS Passwords
+.PP
+Passwords are interpreted in the following forms below using prefix
+identifiers.
+.PP
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
+.SS String
+.PP
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
+.SS Examples
+.IP
+.nf
+\fC
+foobar
+str:foobar
+\fR
+.fi
+.SS Hex\-string
+.PP
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
+.SS Example
+.IP
+.nf
+\fC
+hex:1122334455667788
+\fR
+.fi
+.SS File
+.PP
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
+Storing passwords in files prevents information leakage, passwords
+passed as options can be read from the process list or common shell
+history features.
+.SS Examples
+.IP
+.nf
+\fC
+# to use stdin and be prompted
+file:\-
+
+# to use a file from a path
+file:path/to/password/file
+
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
+
+# to use a bash here\-string via stdin:
+
+tpm2_tool \-p file:\- <<< foobar
+\fR
+.fi
+.SS Sessions
+.PP
+When using a policy session to authorize the use of an object, prefix
+the option argument with the \fIsession\fR keyword.
+Then indicate a path to a session file that was created with
+tpm2_startauthsession(1).
+Optionally, if the session requires an auth value to be sent with the
+session handle (eg policy password), then append a + and a string as
+described in the \fBPasswords\fR section.
+.SS Examples
+.PP
+To use a session context file called \fIsession.ctx\fR.
+.IP
+.nf
+\fC
+session:session.ctx
+\fR
+.fi
+.PP
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the authvalue mypassword.
+.IP
+.nf
+\fC
+session:session.ctx+mypassword
+\fR
+.fi
+.PP
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
+.IP
+.nf
+\fC
+session:session.ctx+hex:11223344
+\fR
+.fi
+.SS PCR Authorizations
+.PP
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
+minilanguage.
+The PCR minilanguage is as follows:
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
+.PP
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
+.PP
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
+.PP
+PCR bank specifiers (pcr.md)
+.SS Examples
+.PP
+To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
+of:
+.IP
+.nf
+\fC
+pcr:sha256:0,1,2,3
+\fR
+.fi
+.PP
+specifying \fIAUTH\fR.
+.SH COMMON OPTIONS
+.PP
+This collection of options are common to many programs and provide
+information that many users may expect.
+.IP \bu 2
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
+manpage.
+By default, it attempts to invoke the manpager for the tool, however, on
+failure will output a short tool summary.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
+.RS 2
+.PP
+To successfully use the manpages feature requires the manpages to be
+installed or on \fIMANPATH\fR, See man(1) for more details.
+.RE
+.IP \bu 2
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
+.IP \bu 2
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
+tool prints to the console during its execution.
+When using this option the file and line number are printed.
+.IP \bu 2
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
+.IP \bu 2
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
+errata fixups.
+Useful if an errata fixup needs to be applied to commands sent to the
+TPM.
+Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
+information many users may expect.
+.SH TCTI Configuration
+.PP
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
+TCTIs can be changed for communication with TPMs across different
+mediums.
+.PP
+To control the TCTI, the tools respect:
+.IP "1." 3
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
+.IP "2." 3
+The environment variable: \fITPM2TOOLS_TCTI\fR.
+.PP
+\fBNote:\fR The command line option always overrides the environment
+variable.
+.PP
+The current known TCTIs are:
+.IP \bu 2
+tabrmd \- The resource manager, called
+tabrmd (https://github.com/tpm2-software/tpm2-abrmd).
+Note that tabrmd and abrmd as a tcti name are synonymous.
+.IP \bu 2
+mssim \- Typically used for communicating to the TPM software simulator.
+.IP \bu 2
+device \- Used when talking directly to a TPM device file.
+.IP \bu 2
+none \- Do not initalize a connection with the TPM.
+Some tools allow for off\-tpm options and thus support not using a TCTI.
+Tools that do not support it will error when attempted to be used
+without a TCTI connection.
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
+.PP
+The arguments to either the command line option or the environment
+variable are in the form:
+.PP
+\fC<tcti\-name>:<tcti\-option\-config>\fR
+.PP
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
+that portion respectively.
+.SS TCTI Defaults
+.PP
+When a TCTI is not specified, the default TCTI is searched for using
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
+You can query what TCTI will be chosen as the default by using the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
+aforementioned TCTIs is the default.
+.SS Custom TCTIs
+.PP
+Any TCTI that implements the dynamic TCTI interface can be loaded.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
+Thus, this could be a path to the shared library, or a library name as
+understood by \fIdlopen(3)\fR semantics.
+.SH TCTI OPTIONS
+.PP
+This collection of options are used to configure the various known TCTI
+modules available:
+.IP \bu 2
+\fBdevice\fR: For the device TCTI, the TPM character device file for
+use by the device TCTI can be specified.
+The default is \fI/dev/tpm0\fR.
+.RS 2
+.PP
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
+.RE
+.IP \bu 2
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
+port number used by the simulator can be specified.
+The default are 127.0.0.1 and 2321.
+.RS 2
+.PP
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
+.RE
+.IP \bu 2
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
+.RS 2
+.IP \bu 2
+TCTI abrmd supports two keys:
+.RS 2
+.IP "1." 3
+`bus_name' : The name of the tabrmd service on the bus (a string).
+.IP "2." 3
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
+.RE
+.PP
+Specify the tabrmd tcti name and a config string of
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
+.PP
+Specify the default (abrmd) tcti and a config string of
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
+.PP
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
+the various known TCTI modules.
+.RE
+.SH EXAMPLES
+.SS Setup
+.PP
+To load an object you first must create an object under a primary
+object.
+So the first step is to create the primary object.
+.IP
+.nf
+\fC
+tpm2_createprimary \-c primary.ctx
+\fR
+.fi
+.PP
+Step 2 is to create an object under the primary object.
+.IP
+.nf
+\fC
+tpm2_create \-C primary.ctx \-u key.pub \-r key.priv \-f pem \-o pub.pem
+\fR
+.fi
+.PP
+This creates the private and public portions of the TPM object.
+With these object portions, it is now possible to load that object into
+the TPM for subsequent use.
+.SS Encoding an Object into a combined PEM format
+.PP
+The final step, is encoding the public and private portions of the
+object into a PEM format.
+.IP
+.nf
+\fC
+tpm2_encodeobject \-C primary.ctx \-u key.pub \-r key.priv \-c priv.pem
+\fR
+.fi
+.PP
+The generated \fCpriv.pem\fR can be used together with
+\fCpub.pem\fR created in the step 2 of Setup section.
+.SH Returns
+.PP
+Tools can return any of the following codes:
+.IP \bu 2
+0 \- Success.
+.IP \bu 2
+1 \- General non\-specific error.
+.IP \bu 2
+2 \- Options handling error.
+.IP \bu 2
+3 \- Authentication error.
+.IP \bu 2
+4 \- TCTI related error.
+.IP \bu 2
+5 \- Non supported scheme.
+Applicable to tpm2_testparams.
+.SH BUGS
+.PP
+Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
+.SH HELP
+.PP
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_encryptdecrypt.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_encryptdecrypt.1 Changed

@@ -1,42 +1,42 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_encryptdecrypt" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_encryptdecrypt\f(1) \- Performs symmetric encryption or
+\fBtpm2_encryptdecrypt\fR(1) \- Performs symmetric encryption or
 decryption.
 .SH SYNOPSIS
 .PP
-\fBtpm2_encryptdecrypt\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_encryptdecrypt\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_encryptdecrypt\f(1) \- Performs symmetric encryption or
+\fBtpm2_encryptdecrypt\fR(1) \- Performs symmetric encryption or
 decryption with a specified symmetric key on the contents of
-\fIFILE\f.
-If \fIFILE\f is not specified, defaults to \fIstdin\f.
+\fIFILE\fR.
+If \fIFILE\fR is not specified, defaults to \fIstdin\fR.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The encryption key object.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the encryption key object.
 .RE
 .IP \bu 2
-\fB\-d\f, \fB\-\-decrypt\f:
+\fB\-d\fR, \fB\-\-decrypt\fR:
 .RS 2
 .PP
 Perform a decrypt operation.
 Defaults to encryption when this option is not specified.
 .RE
 .IP \bu 2
-\fB\-e\f, \fB\-\-pad\f:
+\fB\-e\fR, \fB\-\-pad\fR:
 .RS 2
 .PP
 Enable pkcs7 padding for applicable AES encryption modes cfb/cbc/ecb.
@@ -44,32 +44,32 @@
 than encryption block length.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f or \fISTDOUT\f:
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR or \fISTDOUT\fR:
 .RS 2
 .PP
 The output file path for either the encrypted or decrypted data.
-If not specified, defaults to \fBstdout\f.
+If not specified, defaults to \fBstdout\fR.
 .RE
 .IP \bu 2
-\fB\-G\f, \fB\-\-mode\f=\fIALGORITHM\f:
+\fB\-G\fR, \fB\-\-mode\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The key algorithm associated with this object.
 Defaults to object properties or CFB if not defined.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-iv\f=\fIFILE\f:
+\fB\-t\fR, \fB\-\-iv\fR=\fIFILE\fR:
 .RS 2
 .PP
 Optional initialization vector to use.
-Defaults to 0\aqs.
+Defaults to 0\cqs.
 Syntax allows for an input file and output file source to be specified.
-The input file path is first, optionally followed by a colon ":" and the
-output iv path.
+The input file path is first, optionally followed by a colon \lq:\rq
+and the output iv path.
 This output iv can be saved for subsequent calls when chaining.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -78,18 +78,18 @@
 the command, it simply returns a cpHash.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the input file
-path \fIFILE\f of the data to encrypt or decrypt.
+\fBARGUMENT\fR the command line argument specifies the input file
+path \fIFILE\fR of the data to encrypt or decrypt.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -102,8 +102,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -112,45 +111,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -158,69 +157,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -229,13 +230,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -246,7 +247,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -257,6 +258,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -290,6 +293,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -317,7 +322,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -326,27 +331,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -354,21 +367,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -381,6 +396,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -393,51 +410,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -445,18 +462,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -473,84 +490,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -558,21 +582,21 @@
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-c\ primary.ctx
-tpm2_create\ \-C\ primary.ctx\ \-Gaes128\ \-u\ key.pub\ \-r\ key.priv
-tpm2_load\ \-C\ primary.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-c\ key.ctx
-\f
+tpm2_createprimary \-c primary.ctx
+tpm2_create \-C primary.ctx \-Gaes128 \-u key.pub \-r key.priv
+tpm2_load \-C primary.ctx \-u key.pub \-r key.priv \-c key.ctx
+\fR
 .fi
 .SH Encrypt and Decrypt some data
 .IP
 .nf
 \fC
-echo\ "my\ secret"\ >\ secret.dat
-tpm2_encryptdecrypt\ \-c\ key.ctx\ \-o\ secret.enc\ secret.dat
-tpm2_encryptdecrypt\ \-d\ \-c\ key.ctx\ \-o\ secret.dec\ secret.enc
-cat\ secret.dec
-my\ secret
-\f
+echo \dqmy secret\dq > secret.dat
+tpm2_encryptdecrypt \-c key.ctx \-o secret.enc secret.dat
+tpm2_encryptdecrypt \-d \-c key.ctx \-o secret.dec secret.enc
+cat secret.dec
+my secret
+\fR
 .fi
 .SH Returns
 .PP
@@ -595,4 +619,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_eventlog.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_eventlog.1 Changed

@@ -1,58 +1,65 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_eventlog" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_eventlog\f(1) \- Display tpm2 event log.
+\fBtpm2_eventlog\fR(1) \- Display tpm2 event log.
 .SH SYNOPSIS
 .PP
-\fBtpm2_eventlog\f \fIARGUMENT\f
+\fBtpm2_eventlog\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_eventlog\f(1) \- Parse a binary TPM2 event log.
+\fBtpm2_eventlog\fR(1) \- Parse a binary TPM2 event log.
 The event log may be passed to the tool as the final positional
 parameter.
 If this parameter is omitted the tool will return an error.
-The format of this log documented in the "TCG PC Client Platform
-Firmware Profile Specification".
+The format of this log documented in the \lqTCG PC Client Platform
+Firmware Profile Specification\rq.
 .SH OPTIONS
+.IP \bu 2
+\fB\-\-eventlog\-version\fR=\fINATURAL_NUMBER\fR:
+.RS 2
 .PP
-This tool takes no tool specific options.
+Specifies the yaml version of parsed event log.
+Currently version 1 and 2 are supported.
+The default is 1.
+.RE
 .IP \bu 2
-\fBARGUMENT\f The command line argument is the path to a binary TPM2
-eventlog.
+\fBARGUMENT\fR The command line argument is the path to a binary
+TPM2 eventlog.
 .SS References
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -62,9 +69,9 @@
 .IP
 .nf
 \fC
-#\ display\ eventlog\ from\ provided\ file
-tpm2_eventlog\ eventlog.bin
-\f
+# display eventlog from provided file
+tpm2_eventlog eventlog.bin
+\fR
 .fi
 .SH Returns
 .PP
@@ -87,4 +94,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_evictcontrol.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_evictcontrol.1 Changed

@@ -1,60 +1,60 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_evictcontrol" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_evictcontrol\f(1) \- Make a transient object persistent or
+\fBtpm2_evictcontrol\fR(1) \- Make a transient object persistent or
 evict a persistent object.
 .SH SYNOPSIS
 .PP
-\fBtpm2_evictcontrol\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_evictcontrol\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_evictcontrol\f(1) \- Allows a transient object to be made
+\fBtpm2_evictcontrol\fR(1) \- Allows a transient object to be made
 persistent or a persistent object to be evicted.
-The \fIHANDLE\f argument controls the index the handle will be
+The \fIHANDLE\fR argument controls the index the handle will be
 assigned to.
-If the object specified via \fB\-c\f is transient, and a permanent
-\fIHANDLE\f is specified, the object will be persisted at
-\fIHANDLE\f.
-If \fIHANDLE\f is a \-, then the object will be persisted at the
+If the object specified via \fB\-c\fR is transient, and a permanent
+\fIHANDLE\fR is specified, the object will be persisted at
+\fIHANDLE\fR.
+If \fIHANDLE\fR is a \-, then the object will be persisted at the
 first available permanent handle location.
-If the object specified via \fB\-c\f is a permanent handle, then the
-object will be evicted from it\aqs permenent handle location.
+If the object specified via \fB\-c\fR is a permanent handle, then
+the object will be evicted from it\cqs permenent handle location.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 The authorization hierarchy used to authorize the commands.
-Defaults to the "owner" hierarchy.
+Defaults to the \lqowner\rq hierarchy.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a raw number can be used.
+\fB\fCB<num>\fB\fR where a raw number can be used.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-object\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-object\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 A context object specifier of a transient or persistent object.
-If \fIOBJECT\f is a transient object it will be persisted, either to
-the handle specified by the argument or to first available vacant
+If \fIOBJECT\fR is a transient object it will be persisted, either
+to the handle specified by the argument or to first available vacant
 persistent handle.
-If the \fIOBJECT\f is for a persistent object, then the object will
+If the \fIOBJECT\fR is for a persistent object, then the object will
 be evicted from non\-volatile memory.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
-The authorization value for the hierarchy specified with \fB\-C\f.
+The authorization value for the hierarchy specified with \fB\-C\fR.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR:
 .RS 2
 .PP
 Optionally output a serialized object representing the persistent
@@ -64,7 +64,7 @@
 is as expected.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -73,30 +73,30 @@
 the command, it simply returns a cpHash.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the persistent
+\fBARGUMENT\fR the command line argument specifies the persistent
 handle to save the transient object to.
 .SH Output
 .PP
 The tool outputs a YAML compliant dictionary with the fields:
 persistent\-handle: action: evicted|persisted
 .PP
-Where \fIpersistent\-handle\f is the handle the action occurred to.
-Where \fIaction\f can either be one of \fIevicted\f or
-\fIpersisted\f.
-If an object is \fIevicted\f then the object is no longer resident
-at the \fIpersistent\-handle\f address within the TPM.
-If an object is \fIpersisted\f then the object is resident at the
-\fIpersistent\-handle\f address within the TPM.
+Where \fIpersistent\-handle\fR is the handle the action occurred to.
+Where \fIaction\fR can either be one of \fIevicted\fR or
+\fIpersisted\fR.
+If an object is \fIevicted\fR then the object is no longer resident
+at the \fIpersistent\-handle\fR address within the TPM.
+If an object is \fIpersisted\fR then the object is resident at the
+\fIpersistent\-handle\fR address within the TPM.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -109,8 +109,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -119,45 +118,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -165,69 +164,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -236,40 +237,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -277,18 +279,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -305,84 +307,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -390,25 +399,24 @@
 .IP
 .nf
 \fC
-tpm2_changeauth\ \-c\ o\ ownerauth
-tpm2_createprimary\ \-c\ primary.ctx\ \-P\ ownerauth
-tpm2_evictcontrol\ \-C\ o\ \-c\ primary.ctx\ 0x81010002\ \-P\ ownerauth
-\f
+tpm2_changeauth \-c o ownerauth
+tpm2_createprimary \-c primary.ctx \-P ownerauth
+tpm2_evictcontrol \-C o \-c primary.ctx 0x81010002 \-P ownerauth
+\fR
 .fi
 .SS To evict a persistent handle
 .IP
 .nf
 \fC
-tpm2_evictcontrol\ \-C\ o\ \-c\ 0x81010002\ \-P\ ownerauth
-\f
+tpm2_evictcontrol \-C o \-c 0x81010002 \-P ownerauth
+\fR
 .fi
-.SS To make a transient handle persistent and output a serialized
-persistent handle.
+.SS To make a transient handle persistent and output a serialized persistent handle.
 .IP
 .nf
 \fC
-tpm2_evictcontrol\ \-C\ o\ \-c\ primary.ctx\ \-o\ primary.handle\ \-P\ ownerauth
-\f
+tpm2_evictcontrol \-C o \-c primary.ctx \-o primary.handle \-P ownerauth
+\fR
 .fi
 .SH Returns
 .PP
@@ -431,4 +439,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_flushcontext.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_flushcontext.1 Changed

@@ -1,18 +1,18 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_flushcontext" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_flushcontext\f(1) \- Remove a specified handle, or all
+\fBtpm2_flushcontext\fR(1) \- Remove a specified handle, or all
 contexts associated with a transient object, loaded session or saved
 session from the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_flushcontext\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_flushcontext\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_flushcontext\f(1) \- Remove a specified handle, or all
+\fBtpm2_flushcontext\fR(1) \- Remove a specified handle, or all
 contexts associated with a transient object, loaded session or saved
 session from the TPM.
 The object to be flushed is specified as the first argument to the tool
@@ -20,78 +20,88 @@
 flushed from the TPM.
 Must be a valid handle number.
 \- Flush a session via a session file.
-A session file is generated from \fBtpm2_startauthsession\f(1)\aqs
-\fB\-S\f option.
+A session file is generated from
+\fBtpm2_startauthsession\fR(1)\cqs \fB\-S\fR option.
 .SH OPTIONS
 .IP \bu 2
-\fB\-t\f, \fB\-\-transient\-object\f:
+\fB\-t\fR, \fB\-\-transient\-object\fR:
 .RS 2
 .PP
 Remove all transient objects.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-loaded\-session\f:
+\fB\-l\fR, \fB\-\-loaded\-session\fR:
 .RS 2
 .PP
 Remove all loaded sessions.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-saved\-session\f:
+\fB\-s\fR, \fB\-\-saved\-session\fR:
 .RS 2
 .PP
 Remove all saved sessions.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the
-\fIOBJECT\f to be removed from the TPM resident memory.
+\fBARGUMENT\fR the command line argument specifies the
+\fIOBJECT\fR to be removed from the TPM resident memory.
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
 Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -108,84 +118,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 .RE
 .SH EXAMPLES
 .SS Flushing a Transient Object
@@ -203,29 +220,29 @@
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-Tmssim\ \-c\ primary.ctx
+tpm2_createprimary \-Tmssim \-c primary.ctx
 
-tpm2_getcap\ \-T\ mssim\ handles\-transient
-\-\ 0x80000000
+tpm2_getcap \-T mssim handles\-transient
+\- 0x80000000
 
-tpm2_flushcontext\ \-T\ mssim\ 0x80000000
-\f
+tpm2_flushcontext \-T mssim 0x80000000
+\fR
 .fi
 .SS Flush All the Transient Objects
 .IP
 .nf
 \fC
-tpm2_flushcontext\ \\\-\-transient\-object
-\f
+tpm2_flushcontext \rs\-\-transient\-object
+\fR
 .fi
 .SS Flush a Session
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.dat
+tpm2_startauthsession \-S session.dat
 
-tpm2_flushcontext\ session.dat
-\f
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SH Returns
 .PP
@@ -248,4 +265,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_getcap.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_getcap.1 Changed

@@ -1,116 +1,138 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_getcap" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_getcap\f(1) \- Display TPM capabilities in a human readable
+\fBtpm2_getcap\fR(1) \- Display TPM capabilities in a human readable
 form.
 .SH SYNOPSIS
 .PP
-\fBtpm2_getcap\f \fIOPTIONS\f \fICAPABILITY\f
+\fBtpm2_getcap\fR \fIOPTIONS\fR \fICAPABILITY\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_getcap\f(1) \- Query the TPM for it\aqs capabilities /
+\fBtpm2_getcap\fR(1) \- Query the TPM for it\cqs capabilities /
 properties and print them to the console.
 It takes a string form of the capability to query as an argument to the
 tool.
 Currently supported capability groups are:
 .IP \bu 2
-\fBalgorithms\f: Display data about supported algorithms.
+\fBalgorithms\fR: Display data about supported algorithms.
 .IP \bu 2
-\fBcommands\f: Display data about supported commands.
+\fBcommands\fR: Display data about supported commands.
 .IP \bu 2
-\fBpcrs\f: Display currently allocated PCRs.
+\fBpcrs\fR: Display currently allocated PCRs.
 .IP \bu 2
-\fBproperties\-fixed\f: Display fixed TPM properties.
+\fBproperties\-fixed\fR: Display fixed TPM properties.
 .IP \bu 2
-\fBproperties\-variable\f: Display variable TPM properties.
+\fBproperties\-variable\fR: Display variable TPM properties.
 .IP \bu 2
-\fBecc\-curves\f: Display data about elliptic curves.
+\fBecc\-curves\fR: Display data about elliptic curves.
 .IP \bu 2
-\fBhandles\-transient\f: Display handles about transient objects.
+\fBhandles\-transient\fR: Display handles about transient objects.
 .IP \bu 2
-\fBhandles\-persistent\f: Display handles about persistent objects.
+\fBhandles\-persistent\fR: Display handles about persistent objects.
 .IP \bu 2
-\fBhandles\-permanent\f: Display handles about permanent objects.
+\fBhandles\-permanent\fR: Display handles about permanent objects.
 .IP \bu 2
-\fBhandles\-pcr\f: Display handles about PCRs.
+\fBhandles\-pcr\fR: Display handles about PCRs.
 .IP \bu 2
-\fBhandles\-nv\-index\f: Display handles about NV Indices.
+\fBhandles\-nv\-index\fR: Display handles about NV Indices.
 .IP \bu 2
-\fBhandles\-loaded\-session\f: Display handles about both loaded
+\fBhandles\-loaded\-session\fR: Display handles about both loaded
 HMAC and policy sessions.
 .IP \bu 2
-\fBhandles\-saved\-session\f: Display handles about saved sessions.
+\fBhandles\-saved\-session\fR: Display handles about saved sessions.
+.IP \bu 2
+\fBvendor:num\fR: Displays the vendor properties as a hex buffer
+output.
+The string \lqvendor\rq can be suffixed with a colon followed by a
+number as understood by strtoul(3) with a 0 base.
+That value is used as the property value within the
+.PD 0
+.P
+.PD
+TPM2_GetCapability command, and defaults to 1.
+An example to call it with a property value of 2 is: tpm2_getcap
+vendor:2
+.RS 2
+.PP
+NOTE: if vendor requests hang, try the \lq\-i\rq option to ignore
+the moreData field and only read once.
+.RE
 .SH OPTIONS
 .IP \bu 2
-\fB\-l\f, \fB\-\-list\f:
+\fB\-l\fR, \fB\-\-list\fR:
 .RS 2
 .PP
 List known supported capability names.
-These names can be supplied as the argument to the \fB\-c\f option.
+These names can be supplied as the argument to the \fB\-c\fR option.
 Output is in a YAML compliant list to stdout.
 .PP
 For example:
 .IP
 .nf
 \fC
-\ \ \-\ algorithms
-\ \ \-\ commands
-\ \ \-\ properties\-fixed
-\ \ ...
-\f
+  \- algorithms
+  \- commands
+  \- properties\-fixed
+  ...
+\fR
 .fi
 .RE
+.IP \bu 2
+\fB\-\-ignore\-moredata\fR
+.PP
+Ignores the moreData field when dealing with buggy TPM responses.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
 Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -127,99 +149,106 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 .RE
 .SH EXAMPLES
 .SS To list the fixed properties of the TPM
 .IP
 .nf
 \fC
-tpm2_getcap\ properties\-fixed
-\f
+tpm2_getcap properties\-fixed
+\fR
 .fi
 .SS To list the supported capability groups
 .IP
 .nf
 \fC
-tpm2_getcap\ \-l
-\f
+tpm2_getcap \-l
+\fR
 .fi
 .SH Returns
 .PP
@@ -242,4 +271,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_getcommandauditdigest.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_getcommandauditdigest.1 Changed

@@ -1,46 +1,46 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_getcommandauditdigest" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_getcommandauditdigest\f(1) \- Retrieve the command audit
+\fBtpm2_getcommandauditdigest\fR(1) \- Retrieve the command audit
 attestation data from the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_getcommandauditdigest\f \fIOPTIONS\f
+\fBtpm2_getcommandauditdigest\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_getcommandauditdigest\f(1) \- Retrieve the command audit
+\fBtpm2_getcommandauditdigest\fR(1) \- Retrieve the command audit
 attestation data from the TPM.
 The attestation data includes the audit digest of the commands in the
-setlist setup using the command \fBtpm2_setcommandauditstatus\f.
+setlist setup using the command \fBtpm2_setcommandauditstatus\fR.
 Also the attestation data includes the digest of the list of commands
 setup for audit.
 The audit digest algorith is setup in the
-\fBtpm2_setcommandauditstatus\f.
+\fBtpm2_setcommandauditstatus\fR.
 .SH OPTIONS
 .IP \bu 2
-\fB\-P\f, \fB\-\-hierarchy\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-hierarchy\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the endorsement hierarchy.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Context object for the signing key that signs the attestation data.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for key specified by option
-\fB\-c\f.
+\fB\-c\fR.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-qualification\f=\fIHEX_STRING_OR_PATH\f:
+\fB\-q\fR, \fB\-\-qualification\fR=\fIHEX_STRING_OR_PATH\fR:
 .RS 2
 .PP
 Data given as a Hex string or binary file to qualify the quote,
@@ -48,14 +48,14 @@
 This is typically used to add a nonce against replay attacks.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-signature\f=\fIFILE\f:
+\fB\-s\fR, \fB\-\-signature\fR=\fIFILE\fR:
 .RS 2
 .PP
 Signature output file, records the signature in the format specified via
-the \fB\-f\f option.
+the \fB\-f\fR option.
 .RE
 .IP \bu 2
-\fB\-m\f, \fB\-\-message\f=\fIFILE\f:
+\fB\-m\fR, \fB\-\-message\fR=\fIFILE\fR:
 .RS 2
 .PP
 Message output file, records the quote message that makes up the data
@@ -63,28 +63,42 @@
 This is the command audit digest attestation data.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-format\f=\fIFORMAT\f:
+\fB\-f\fR, \fB\-\-format\fR=\fIFORMAT\fR:
 .RS 2
 .PP
 Format selection for the signature output file.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR:
 .RS 2
 .PP
 Hash algorithm for signature.
 Defaults to sha256.
 .RE
+.IP \bu 2
+\fB\-\-scheme\fR=\fIALGORITHM\fR:
+.RS 2
+.PP
+The signing scheme used to sign the message.
+Optional.
+Signing schemes should follow the \lqformatting standards\rq, see
+section \lqAlgorithm Specifiers\rq.
+Also, see section \lqSupported Signing Schemes\rq for a list of
+supported signature schemes.
+If specified, the signature scheme must match the key type.
+If left unspecified, a default signature scheme for the key type will be
+used.
+.RE
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -97,8 +111,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -107,45 +120,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -153,69 +166,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -224,48 +239,49 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Signature Format Specifiers
 .PP
 Format selection for the signature output file.
-\fBtss\f (the default) will output a binary blob according to the
+\fBtss\fR (the default) will output a binary blob according to the
 TPM 2.0 specification and any potential compiler padding.
-The option \fBplain\f will output the plain signature data as
+The option \fBplain\fR will output the plain signature data as
 defined by the used cryptographic algorithm.
-signature \fIFORMAT\f.
+signature \fIFORMAT\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -273,18 +289,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -301,92 +317,99 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_getcommandauditdigest\ \-P\ ekpass\ \-c\ key.ctx\ \-p\ keypass\ \-m\ att.data\ \-s\ att.sig
-\f
+tpm2_getcommandauditdigest \-P ekpass \-c key.ctx \-p keypass \-m att.data \-s att.sig
+\fR
 .fi
 .SH Returns
 .PP
@@ -409,4 +432,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_geteccparameters.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_geteccparameters.1 Changed

@@ -1,36 +1,45 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_geteccparameters" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_geteccparameters\f(1) \- Retrieves the parameters of an ECC
+\fBtpm2_geteccparameters\fR(1) \- Retrieves the parameters of an ECC
 curve identified by its TCG\-assigned curveID.
 .SH SYNOPSIS
 .PP
-\fBtpm2_geteccparameters\f \fIOPTIONS\f
+\fBtpm2_geteccparameters\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_geteccparameters\f(1) \- Retrieves the parameters of an ECC
+\fBtpm2_geteccparameters\fR(1) \- Retrieves the parameters of an ECC
 curve identified by its TCG\-assigned curveID.
 .SH OPTIONS
 .IP \bu 2
-\fBARGUMENT\f=\fIALGORITHM\f:
+\fBARGUMENT\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 Specify the ECC curve.
 Example ecc521.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR
 .RS 2
 .PP
 Specify the file path to save the ECC parameters.
 .RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SS References
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -41,7 +50,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -52,6 +61,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -85,6 +96,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -112,7 +125,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -121,27 +134,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
+.IP \bu 2
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -149,21 +170,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -176,6 +199,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -188,51 +213,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -240,18 +265,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -268,92 +293,99 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_geteccparameters\ ecc256\ \-o\ ecc.params
-\f
+tpm2_geteccparameters ecc256 \-o ecc.params
+\fR
 .fi
 .SH Returns
 .PP
@@ -376,4 +408,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_getekcertificate.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_getekcertificate.1 Changed

@@ -1,26 +1,26 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_getekcertificate" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_getekcertificate\f(1) \- Retrieve the Endorsement key
+\fBtpm2_getekcertificate\fR(1) \- Retrieve the Endorsement key
 Certificate.
 .SH SYNOPSIS
 .PP
-\fBtpm2_getekcertificate\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_getekcertificate\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_getekcertificate\f(1) \- Retrieve the endorsement key
+\fBtpm2_getekcertificate\fR(1) \- Retrieve the endorsement key
 certificate.
 The certificate is present either on the TCG specified TPM NV indices OR
-on the TPM manufacturer\aqs endorsement certificate hosting server.
+on the TPM manufacturer\cqs endorsement certificate hosting server.
 Following are the conditions dictating the certificate location lookup.
 .IP "1." 3
 NV\-Index:
 .RS 4
 .PP
-Default search location when \fBARGUMENT\f is not specified.
+Default search location when \fBARGUMENT\fR is not specified.
 .RE
 .IP "2." 3
 Intel\-EK\-certificate\-server:
@@ -43,19 +43,19 @@
 .PP
 After re\-provisioning/ recertification process is complete, EK
 certificates can be read from the NV indexes by running another instance
-of \fBtpm2_getekcertificate\f.
+of \fBtpm2_getekcertificate\fR.
 .RE
 .IP "4." 3
 Generic or other EK\-certificate\-server:
 .RS 4
 .PP
-Search location when \fBARGUMENT\f specifies the EK certificate web
+Search location when \fBARGUMENT\fR specifies the EK certificate web
 hosting address.
 .RE
 .SH OPTIONS
 .IP \bu 2
-\fB\-o\f, \fB\-\-ek\-certificate\f=\fIFILE\f or
-\fISTDOUT\f:
+\fB\-o\fR, \fB\-\-ek\-certificate\fR=\fIFILE\fR or
+\fISTDOUT\fR:
 .RS 2
 .PP
 The file to save the Endorsement key certificate.
@@ -64,12 +64,12 @@
 order.
 The tool will warn if additional EK certificates are found on the TPM NV
 indices and only a single output file is specified.
-If the option isn\aqt specified all the EK certificates retrieved
+If the option isn\cqt specified all the EK certificates retrieved
 either from the manufacturer web hosting or from the TPM NV indices, are
 output to stdout.
 .RE
 .IP \bu 2
-\fB\-X\f, \fB\-\-allow\-unverified\f:
+\fB\-X\fR, \fB\-\-allow\-unverified\fR:
 .RS 2
 .PP
 Specifies to attempt connecting with the TPM manufacturer provisioning
@@ -77,18 +77,18 @@
 This option is irrelevant when EK certificates are found on the TPM NV
 indices.
 .PP
-\fBWARNING\f: This option should be used only on platforms with
+\fBWARNING\fR: This option should be used only on platforms with
 older CA certificates.
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-ek\-public\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-ek\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specifies the file path for the endorsement key public portion in tss
 format.
 .RE
 .IP \bu 2
-\fB\-x\f, \fB\-\-offline\f:
+\fB\-x\fR, \fB\-\-offline\fR:
 .RS 2
 .PP
 This flags the tool to operate in an offline mode.
@@ -102,14 +102,14 @@
 indices.
 .RE
 .IP \bu 2
-\fB\-\-raw\f:
+\fB\enraw\fR:
 .RS 2
 .PP
 This flags the tool to output the EK certificate as is received from the
 source: NV/ Web\-Hosting.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the URL address
+\fBARGUMENT\fR the command line argument specifies the URL address
 for the EK certificate portal.
 This forces the tool to not look for the EK certificates on the NV
 indices.
@@ -119,31 +119,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -151,18 +152,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -179,84 +180,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH NOTES
@@ -266,48 +274,45 @@
 <https://curl.haxx.se/libcurl/c/CURLOPT_VERBOSE.html> for more
 information.
 .SH EXAMPLES
-.SS Retrieve EK certificate from TPM manufacturer backend by supplying
-EK public.
+.SS Retrieve EK certificate from TPM manufacturer backend by supplying EK public.
 .IP
 .nf
 \fC
-tpm2_createek\ \-G\ rsa\ \-u\ ek.pub\ \-c\ key.ctx
+tpm2_createek \-G rsa \-u ek.pub \-c key.ctx
 
-tpm2_getekcertificate\ \-X\ \-o\ ECcert.bin\ \-u\ ek.pub\ \\
+tpm2_getekcertificate \-X \-o ECcert.bin \-u ek.pub \rs
 https://tpm.manufacturer.com/ekcertserver/
-\f
+\fR
 .fi
-.SS Retrieve EK certificate from Intel backend if certificate not found
-on NV.
+.SS Retrieve EK certificate from Intel backend if certificate not found on NV.
 .IP
 .nf
 \fC
-tpm2_createek\ \-G\ rsa\ \-u\ ek.pub\ \-c\ key.ctx
+tpm2_createek \-G rsa \-u ek.pub \-c key.ctx
 
-tpm2_getekcertificate\ \-X\ \-o\ ECcert.bin\ \-u\ ek.pub
-\f
+tpm2_getekcertificate \-X \-o ECcert.bin \-u ek.pub
+\fR
 .fi
 .SS Retrieve EK certificate from Intel backend for an offline platform.
 .IP
 .nf
 \fC
-tpm2_getekcertificate\ \-X\ \-x\ \-o\ ECcert.bin\ \-u\ ek.pub
-\f
+tpm2_getekcertificate \-X \-x \-o ECcert.bin \-u ek.pub
+\fR
 .fi
 .SS Retrieve EK certificate from TPM NV indices only, fail otherwise.
 .IP
 .nf
 \fC
-tpm2_getekcertificate\ \-o\ ECcert.bin
-\f
+tpm2_getekcertificate \-o ECcert.bin
+\fR
 .fi
-.SS Retrieve multiple EK certificates from TPM NV indices only, fail
-otherwise.
+.SS Retrieve multiple EK certificates from TPM NV indices only, fail otherwise.
 .IP
 .nf
 \fC
-tpm2_getekcertificate\ \-o\ RSA_EK_cert.bin\ \-o\ ECC_EK_cert.bin
-\f
+tpm2_getekcertificate \-o RSA_EK_cert.bin \-o ECC_EK_cert.bin
+\fR
 .fi
 .SH Returns
 .PP
@@ -330,4 +335,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_getpolicydigest.1 Added

@@ -0,0 +1,227 @@
+.\" Automatically generated by Pandoc 2.5
+.\"
+.TH "tpm2_getpolicydigest" "1" "" "tpm2\-tools" "General Commands Manual"
+.hy
+.SH NAME
+.PP
+\fBtpm2_getpolicydigest\fR(1) \- Retrieves the policy digest from
+session.
+.SH SYNOPSIS
+.PP
+\fBtpm2_getpolicydigest\fR \fIOPTIONS\fR \fIARGUMENT\fR
+.SH DESCRIPTION
+.PP
+\fBtpm2_getpolicydigest\fR(1) \- Returns the policydigest of a
+session.
+.PP
+Output defaults to \fIstdout\fR and binary format unless otherwise
+specified with \fB\-o\fR and \fB\enhex\fR options
+respectively.
+.SH OPTIONS
+.IP \bu 2
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR
+.RS 2
+.PP
+Specifies the filename to output the raw bytes to.
+Defaults to stdout as a hex string.
+.RE
+.IP \bu 2
+\fB\-\-hex\fR
+.RS 2
+.PP
+Convert the output data to hex format without a leading \lq0x\rq.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+.RE
+.SS References
+.SH COMMON OPTIONS
+.PP
+This collection of options are common to many programs and provide
+information that many users may expect.
+.IP \bu 2
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
+manpage.
+By default, it attempts to invoke the manpager for the tool, however, on
+failure will output a short tool summary.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
+.RS 2
+.PP
+To successfully use the manpages feature requires the manpages to be
+installed or on \fIMANPATH\fR, See man(1) for more details.
+.RE
+.IP \bu 2
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
+.IP \bu 2
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
+tool prints to the console during its execution.
+When using this option the file and line number are printed.
+.IP \bu 2
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
+.IP \bu 2
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
+errata fixups.
+Useful if an errata fixup needs to be applied to commands sent to the
+TPM.
+Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
+information many users may expect.
+.SH TCTI Configuration
+.PP
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
+TCTIs can be changed for communication with TPMs across different
+mediums.
+.PP
+To control the TCTI, the tools respect:
+.IP "1." 3
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
+.IP "2." 3
+The environment variable: \fITPM2TOOLS_TCTI\fR.
+.PP
+\fBNote:\fR The command line option always overrides the environment
+variable.
+.PP
+The current known TCTIs are:
+.IP \bu 2
+tabrmd \- The resource manager, called
+tabrmd (https://github.com/tpm2-software/tpm2-abrmd).
+Note that tabrmd and abrmd as a tcti name are synonymous.
+.IP \bu 2
+mssim \- Typically used for communicating to the TPM software simulator.
+.IP \bu 2
+device \- Used when talking directly to a TPM device file.
+.IP \bu 2
+none \- Do not initalize a connection with the TPM.
+Some tools allow for off\-tpm options and thus support not using a TCTI.
+Tools that do not support it will error when attempted to be used
+without a TCTI connection.
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
+.PP
+The arguments to either the command line option or the environment
+variable are in the form:
+.PP
+\fC<tcti\-name>:<tcti\-option\-config>\fR
+.PP
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
+that portion respectively.
+.SS TCTI Defaults
+.PP
+When a TCTI is not specified, the default TCTI is searched for using
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
+You can query what TCTI will be chosen as the default by using the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
+aforementioned TCTIs is the default.
+.SS Custom TCTIs
+.PP
+Any TCTI that implements the dynamic TCTI interface can be loaded.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
+Thus, this could be a path to the shared library, or a library name as
+understood by \fIdlopen(3)\fR semantics.
+.SH TCTI OPTIONS
+.PP
+This collection of options are used to configure the various known TCTI
+modules available:
+.IP \bu 2
+\fBdevice\fR: For the device TCTI, the TPM character device file for
+use by the device TCTI can be specified.
+The default is \fI/dev/tpm0\fR.
+.RS 2
+.PP
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
+.RE
+.IP \bu 2
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
+port number used by the simulator can be specified.
+The default are 127.0.0.1 and 2321.
+.RS 2
+.PP
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
+.RE
+.IP \bu 2
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
+.RS 2
+.IP \bu 2
+TCTI abrmd supports two keys:
+.RS 2
+.IP "1." 3
+`bus_name' : The name of the tabrmd service on the bus (a string).
+.IP "2." 3
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
+.RE
+.PP
+Specify the tabrmd tcti name and a config string of
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
+.PP
+Specify the default (abrmd) tcti and a config string of
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
+.PP
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
+the various known TCTI modules.
+.RE
+.SH EXAMPLES
+.SS Create a session and retrieve policydigest
+.IP
+.nf
+\fC
+tpm2 startauthsession \-S session.ctx
+tpm2 policypassword \-S session.ctx \-L test.policy
+tpm2 getpolicydigest \-S session.ctx \-o policy.out
+tpm2 flushcontext session.ctx
+\fR
+.fi
+.SH Returns
+.PP
+Tools can return any of the following codes:
+.IP \bu 2
+0 \- Success.
+.IP \bu 2
+1 \- General non\-specific error.
+.IP \bu 2
+2 \- Options handling error.
+.IP \bu 2
+3 \- Authentication error.
+.IP \bu 2
+4 \- TCTI related error.
+.IP \bu 2
+5 \- Non supported scheme.
+Applicable to tpm2_testparams.
+.SH BUGS
+.PP
+Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
+.SH HELP
+.PP
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_getrandom.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_getrandom.1 Changed

@@ -1,46 +1,47 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_getrandom" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_getrandom\f(1) \- Retrieves random bytes from the TPM.
+\fBtpm2_getrandom\fR(1) \- Retrieves random bytes from the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_getrandom\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_getrandom\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_getrandom\f(1) \- Returns the next \fISIZE\f octets from
-the random number generator.
-The \fISIZE\f parameter is expected as the only argument to the
+\fBtpm2_getrandom\fR(1) \- Returns the next \fISIZE\fR octets
+from the random number generator.
+The \fISIZE\fR parameter is expected as the only argument to the
 tool.
 .PP
-Note that the TPM specification recommends that TPM\aqs fix the number
+Note that the TPM specification recommends that TPM\cqs fix the number
 of available entry to the maximum size of a hash algorithm output in
 bytes.
 .PP
 Most TPMs do this, and thus the tool verifies that input size is bounded
-by property \fBTPM2_PT_MAX_DIGEST\f and issues an error if it is too
-large.
+by property \fBTPM2_PT_MAX_DIGEST\fR and issues an error if it is
+too large.
 .PP
-Output defaults to \fIstdout\f and binary format unless otherwise
-specified with \fB\-o\f and \fB\-\-hex\f options respectively.
+Output defaults to \fIstdout\fR and binary format unless otherwise
+specified with \fB\-o\fR and \fB\enhex\fR options
+respectively.
 .SH OPTIONS
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR
 .RS 2
 .PP
 Specifies the filename to output the raw bytes to.
 Defaults to stdout as a hex string.
 .RE
 .IP \bu 2
-\fB\-\-hex\f
+\fB\-\-hex\fR
 .RS 2
 .PP
-Convert the output data to hex format without a leading "0x".
+Convert the output data to hex format without a leading \lq0x\rq.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f
+\fB\-f\fR, \fB\-\-force\fR
 .RS 2
 Override checking that the:
 .IP \bu 2
@@ -49,14 +50,16 @@
 Number of retrieved random bytes matches requested amount.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-An HMAC session to be used as an audit session.
-The session can be created using \fBtpm2_startauthsession\f.
+The session created using \fBtpm2_startauthsession\fR.
+Multiple of these can be specified.
+For example, you can have one session for auditing and another for
+encryption of the parameters.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f:
+\fB\-\-cphash\fR=\fIFILE\fR:
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -65,14 +68,14 @@
 tool will not actually execute the command, it simply returns a cpHash.
 .RE
 .IP \bu 2
-\fB\-\-rphash\f=\fIFILE\f:
+\fB\-\-rphash\fR=\fIFILE\fR:
 .RS 2
 .PP
 File path to record the hash of the response parameters.
 This is commonly termed as rpHash.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the size of the
+\fBARGUMENT\fR the command line argument specifies the size of the
 output.
 .SS References
 .SH COMMON OPTIONS
@@ -80,31 +83,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -112,18 +116,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -140,84 +144,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -225,16 +236,15 @@
 .IP
 .nf
 \fC
-tpm2_getrandom\ \-o\ random.out\ 20
-\f
+tpm2_getrandom \-o random.out 20
+\fR
 .fi
-.SS Generate a random 8 bytes and output the hex formatted data to
-stdout
+.SS Generate a random 8 bytes and output the hex formatted data to stdout
 .IP
 .nf
 \fC
-tpm2_getrandom\ 8
-\f
+tpm2_getrandom 8
+\fR
 .fi
 .SH Returns
 .PP
@@ -257,4 +267,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_getsessionauditdigest.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_getsessionauditdigest.1 Changed

@@ -1,44 +1,44 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_getsessionauditdigest" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_getsessionauditdigest\f(1) \- Retrieve the command audit
+\fBtpm2_getsessionauditdigest\fR(1) \- Retrieve the command audit
 attestation data from the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_getsessionauditdigest\f \fIOPTIONS\f
+\fBtpm2_getsessionauditdigest\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_getsessionauditdigest\f(1) \- Retrieve the session audit
+\fBtpm2_getsessionauditdigest\fR(1) \- Retrieve the session audit
 digest attestation data from the TPM.
 The attestation data includes the session audit digest and a signature
 over the session audit digest.
-The session itself is started with the \fBtpm2_startauthsession\f
+The session itself is started with the \fBtpm2_startauthsession\fR
 command.
 .SH OPTIONS
 .IP \bu 2
-\fB\-P\f, \fB\-\-hierarchy\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-hierarchy\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the endorsement hierarchy.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Context object for the signing key that signs the attestation data.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for key specified by option
-\fB\-c\f.
+\fB\-c\fR.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-qualification\f=\fIHEX_STRING_OR_PATH\f:
+\fB\-q\fR, \fB\-\-qualification\fR=\fIHEX_STRING_OR_PATH\fR:
 .RS 2
 .PP
 Data given as a Hex string or binary file to qualify the quote,
@@ -46,14 +46,14 @@
 This is typically used to add a nonce against replay attacks.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-signature\f=\fIFILE\f:
+\fB\-s\fR, \fB\-\-signature\fR=\fIFILE\fR:
 .RS 2
 .PP
 Signature output file, records the signature in the format specified via
-the \fB\-f\f option.
+the \fB\-f\fR option.
 .RE
 .IP \bu 2
-\fB\-m\f, \fB\-\-message\f=\fIFILE\f:
+\fB\-m\fR, \fB\-\-message\fR=\fIFILE\fR:
 .RS 2
 .PP
 Message output file, records the quote message that makes up the data
@@ -61,20 +61,34 @@
 This is the command audit digest attestation data.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-format\f=\fIFORMAT\f:
+\fB\-f\fR, \fB\-\-format\fR=\fIFORMAT\fR:
 .RS 2
 .PP
 Format selection for the signature output file.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR:
 .RS 2
 .PP
 Hash algorithm for signature.
 Defaults to sha256.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-\-scheme\fR=\fIALGORITHM\fR:
+.RS 2
+.PP
+The signing scheme used to sign the message.
+Optional.
+Signing schemes should follow the \lqformatting standards\rq, see
+section \lqAlgorithm Specifiers\rq.
+Also, see section \lqSupported Signing Schemes\rq for a list of
+supported signature schemes.
+If specified, the signature scheme must match the key type.
+If left unspecified, a default signature scheme for the key type will be
+used.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
 The path of the session that enables and records the audit digests.
@@ -83,12 +97,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -101,8 +115,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -111,45 +124,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -157,69 +170,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -228,48 +243,49 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Signature Format Specifiers
 .PP
 Format selection for the signature output file.
-\fBtss\f (the default) will output a binary blob according to the
+\fBtss\fR (the default) will output a binary blob according to the
 TPM 2.0 specification and any potential compiler padding.
-The option \fBplain\f will output the plain signature data as
+The option \fBplain\fR will output the plain signature data as
 defined by the used cryptographic algorithm.
-signature \fIFORMAT\f.
+signature \fIFORMAT\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -277,18 +293,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -305,102 +321,109 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-Q\ \-C\ e\ \-c\ prim.ctx
+tpm2_createprimary \-Q \-C e \-c prim.ctx
 
-tpm2_create\ \-Q\ \-C\ prim.ctx\ \-c\ signing_key.ctx\ \-u\ signing_key.pub\ \\
-\-r\ signing_key.priv
+tpm2_create \-Q \-C prim.ctx \-c signing_key.ctx \-u signing_key.pub \rs
+\-r signing_key.priv
 
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-audit\-session
+tpm2_startauthsession \-S session.ctx \-\-audit\-session
 
-tpm2_getrandom\ 8\ \-S\ session.ctx
+tpm2_getrandom 8 \-S session.ctx
 
-tpm2_getsessionauditdigest\ \-c\ signing_key.ctx\ \-m\ att.data\ \-s\ att.sig\ \\
-\-S\ session.ctx
-\f
+tpm2_getsessionauditdigest \-c signing_key.ctx \-m att.data \-s att.sig \rs
+\-S session.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -423,4 +446,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_gettestresult.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_gettestresult.1 Changed

@@ -1,25 +1,25 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_gettestresult" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_gettestresult\f(1) \- Get the result of tests performed by
+\fBtpm2_gettestresult\fR(1) \- Get the result of tests performed by
 the TPM
 .SH SYNOPSIS
 .PP
-\fBtpm2_gettestresult\f \fIOPTIONS\f
+\fBtpm2_gettestresult\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_gettestresult\f(1) will return the result of the tests
+\fBtpm2_gettestresult\fR(1) will return the result of the tests
 conducted by the TPM.
 .PP
 Error code will state if the test executed successfully or have failed.
 .PP
 If pending algorithms are scheduled to be tested,
-\fBtpm2_gettestresult\f will return "TESTING".
-Otherwise "FAILED" will be returned or "SUCCESS" depending on the result
-to the test.
+\fBtpm2_gettestresult\fR will return \lqTESTING\rq.
+Otherwise \lqFAILED\rq will be returned or \lqSUCCESS\rq
+depending on the result to the test.
 .PP
 Manufacturer\-dependent information will also be printed in raw hex
 format.
@@ -31,49 +31,50 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
 Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -90,84 +91,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 .RE
 .SH EXAMPLES
 .SS Get the result of the TPM testing
@@ -175,7 +183,7 @@
 .nf
 \fC
 tpm2_gettestresult
-\f
+\fR
 .fi
 .SH NOTES
 .PP
@@ -202,4 +210,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_gettime.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_gettime.1 Changed

@@ -1,17 +1,17 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_gettime" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_gettime\f(1) \- Get the current time and clock from the TPM
+\fBtpm2_gettime\fR(1) \- Get the current time and clock from the TPM
 in a signed form.
 .SH SYNOPSIS
 .PP
-\fBtpm2_gettime\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_gettime\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_gettime\f(1) \- Provides a signed copy of the current time
+\fBtpm2_gettime\fR(1) \- Provides a signed copy of the current time
 and clock from the TPM.
 It returns both a signature, and the data in the standard TPM
 attestation form, a TPMS_ATTEST structure.
@@ -24,71 +24,71 @@
 .IP
 .nf
 \fC
-time:\ 13673142\ \ \ \ \ #\ 64\ bit\ value\ of\ time\ since\ last\ _TPM_Init\ or\ TPM2_Startup
-\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ #\ in\ ms.
+time: 13673142     # 64 bit value of time since last _TPM_Init or TPM2_Startup
+                   # in ms.
 clock_info:
-\ \ clock:\ 13673142\ \ #\ 64\ bit\ value\ of\ time\ TPM\ has\ been\ powered\ on\ in\ ms.
-\ \ reset_count:\ 0\ \ \ #\ 32\ bit\ value\ of\ the\ number\ of\ TPM\ Resets\ since\ the\ last
-\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ #\ TPM2_Clear.
-\ \ restart_count:\ 0\ #\ 32\ bit\ value\ of\ the\ number\ of\ times\ that\ TPM2_Shutdown\ or
-\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ #\ _TPM_Hash_Start\ have\ occurred\ since\ the\ last\ TPM\ Reset\ or
-\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ #\ TPM2_Clear.
-\ \ safe:\ yes\ \ \ \ \ \ \ \ #\ boolean\ yes|no\ value\ that\ no\ value\ of\ Clock\ greater\ than
-\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ #\ the\ current\ value\ of\ Clock\ has\ been\ previously\ reported\ by
-\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ #\ the\ TPM.
-\f
+  clock: 13673142  # 64 bit value of time TPM has been powered on in ms.
+  reset_count: 0   # 32 bit value of the number of TPM Resets since the last
+                   # TPM2_Clear.
+  restart_count: 0 # 32 bit value of the number of times that TPM2_Shutdown or
+                   # _TPM_Hash_Start have occurred since the last TPM Reset or
+                   # TPM2_Clear.
+  safe: yes        # boolean yes|no value that no value of Clock greater than
+                   # the current value of Clock has been previously reported by
+                   # the TPM.
+\fR
 .fi
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Context object pointing to the the key used for signing.
 Either a file or a handle number.
-See section "Context Object Format".
+See section \lqContext Object Format\rq.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR_AUTH_:
 .RS 2
 .PP
-Optional authorization value to use the key specified by \fB\-c\f.
-Authorization values should follow the "authorization formatting
-standards", see section "Authorization Formatting".
+Optional authorization value to use the key specified by \fB\-c\fR.
+Authorization values should follow the \lqauthorization formatting
+standards\rq, see section \lqAuthorization Formatting\rq.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-endorse\-auth\f\fIAUTH\f:
+\fB\-P\fR, \fB\-\-endorse\-auth\fR_AUTH_:
 .RS 2
 .PP
 Optional authorization value for the endorsement hierarchy.
-Authorization values should follow the "authorization formatting
-standards", see section "Authorization Formatting".
+Authorization values should follow the \lqauthorization formatting
+standards\rq, see section \lqAuthorization Formatting\rq.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm used to digest the message.
-Algorithms should follow the "formatting standards", see section
-"Algorithm Specifiers".
-Also, see section "Supported Hash Algorithms" for a list of supported
-hash algorithms.
+Algorithms should follow the \lqformatting standards\rq, see section
+\lqAlgorithm Specifiers\rq.
+Also, see section \lqSupported Hash Algorithms\rq for a list of
+supported hash algorithms.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-scheme\f=\fIALGORITHM\f:
+\fB\-s\fR, \fB\-\-scheme\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The signing scheme used to sign the message.
 Optional.
-Signing schemes should follow the "formatting standards", see section
-"Algorithm Specifiers".
-Also, see section "Supported Signing Schemes" for a list of supported
-signature schemes.
+Signing schemes should follow the \lqformatting standards\rq, see
+section \lqAlgorithm Specifiers\rq.
+Also, see section \lqSupported Signing Schemes\rq for a list of
+supported signature schemes.
 If specified, the signature scheme must match the key type.
 If left unspecified, a default signature scheme for the key type will be
 used.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-qualification\f=\fIFILE_OR_HEX_STR\f:
+\fB\-q\fR, \fB\-\-qualification\fR=\fIFILE_OR_HEX_STR\fR:
 .RS 2
 .PP
 Optional, the policy qualifier data that the signer can choose to
@@ -96,26 +96,26 @@
 Can be either a hex string or path.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-signature\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-signature\fR=\fIFILE\fR:
 .RS 2
 .PP
 The signature file, records the signature structure.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-format\f=\fIFORMAT\f:
+\fB\-f\fR, \fB\-\-format\fR=\fIFORMAT\fR:
 .RS 2
 .PP
 Format selection for the signature output file.
-See section "Signature Format Specifiers".
+See section \lqSignature Format Specifiers\rq.
 .RE
 .IP \bu 2
-\fB\-\-attestation\f=\fIFILE\f:
+\fB\enattestation\fR=\fIFILE\fR:
 .RS 2
 .PP
 The attestation data of the type TPMS_ATTEST signed with signing key.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -124,18 +124,18 @@
 the command, it simply returns a cpHash.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the file data for
+\fBARGUMENT\fR the command line argument specifies the file data for
 sign.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -148,8 +148,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -158,45 +157,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -204,69 +203,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -275,13 +276,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -292,7 +293,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -303,6 +304,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -336,6 +339,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -363,7 +368,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -372,27 +377,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -400,21 +413,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -427,6 +442,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -439,51 +456,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -491,18 +508,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -519,106 +536,113 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 # Signature Format Specifiers
 .RE
 .PP
 Format selection for the signature output file.
-\fBtss\f (the default) will output a binary blob according to the
+\fBtss\fR (the default) will output a binary blob according to the
 TPM 2.0 specification and any potential compiler padding.
-The option \fBplain\f will output the plain signature data as
+The option \fBplain\fR will output the plain signature data as
 defined by the used cryptographic algorithm.
 .SH EXAMPLES
 .SS Create a key and get attested TPM time
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ e\ \-c\ primary.ctx
+tpm2_createprimary \-C e \-c primary.ctx
 
-tpm2_create\ \-G\ rsa\ \-u\ rsa.pub\ \-r\ rsa.priv\ \-C\ primary.ctx
+tpm2_create \-G rsa \-u rsa.pub \-r rsa.priv \-C primary.ctx
 
-tpm2_load\ \-C\ primary.ctx\ \-u\ rsa.pub\ \-r\ rsa.priv\ \-c\ rsa.ctx
+tpm2_load \-C primary.ctx \-u rsa.pub \-r rsa.priv \-c rsa.ctx
 
-tpm2_gettime\ \-c\ rsa.ctx\ \-o\ attest.sig\ \-\-attestation\ attest.data
-\f
+tpm2_gettime \-c rsa.ctx \-o attest.sig \-\-attestation attest.data
+\fR
 .fi
 .SH Returns
 .PP
@@ -641,4 +665,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_hash.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_hash.1 Changed

@@ -1,81 +1,81 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_hash" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_hash\f(1) \- Performs a hash operation with the TPM.
+\fBtpm2_hash\fR(1) \- Performs a hash operation with the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_hash\f \fIOPTIONS\f \fIARGUMENT\f OR
-\fISTDIN\f
+\fBtpm2_hash\fR \fIOPTIONS\fR \fIARGUMENT\fR OR
+\fISTDIN\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_hash\f(1) \- Performs a hash operation on file and returns
+\fBtpm2_hash\fR(1) \- Performs a hash operation on file and returns
 the results.
 If argument is not specified, then data is read from stdin.
 If the results of the hash will be used in a signing operation that uses
 a restricted signing key, then the ticket returned by this command can
 indicate that the hash is safe to sign.
 .PP
-Output defaults to \fIstdout\f and binary format unless otherwise
-specified via \fB\-o\f and \fB\-\-hex\f options respectively.
+Output defaults to \fIstdout\fR and binary format unless otherwise
+specified via \fB\-o\fR and \fB\enhex\fR options respectively.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Hierarchy to use for the ticket.
-Defaults to \fBo\f, \fBTPM_RH_OWNER\f, when no value has been
+Defaults to \fBo\fR, \fBTPM_RH_OWNER\fR, when no value has been
 specified.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fBe\f for \fBTPM_RH_ENDORSEMENT\f
+\fBe\fR for \fBTPM_RH_ENDORSEMENT\fR
 .IP \bu 2
-\fBn\f for \fBTPM_RH_NULL\f
+\fBn\fR for \fBTPM_RH_NULL\fR
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hashing algorithm for the digest operation.
 .RE
 .IP \bu 2
-\fB\-\-hex\f
+\fB\-\-hex\fR
 .RS 2
 .PP
-Convert the output hmac to hex format without a leading "0x".
+Convert the output hmac to hex format without a leading \lq0x\rq.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f or \fISTDOUT\f:
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR or \fISTDOUT\fR:
 .RS 2
 .PP
 Optional file to save the hash result.
 Defaults to stdout in hex form.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-ticket\f=\fITICKET_FILE\f
+\fB\-t\fR, \fB\-\-ticket\fR=\fITICKET_FILE\fR
 .RS 2
 .PP
 Optional file record of the ticket result.
 Defaults to stdout in hex form.
 .RE
 .IP \bu 2
-\fBARGUMENT\f or \fBSTDIN\f the command line argument specifies
-the \fIFILE\f to hash.
+\fBARGUMENT\fR or \fBSTDIN\fR the command line argument
+specifies the \fIFILE\fR to hash.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -88,8 +88,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -98,45 +97,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -144,69 +143,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -215,40 +216,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-\fIALGORITHM\f.
+\fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -256,18 +258,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -284,94 +286,100 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
-.SS Hash a file with sha1 hash algorithm and save the hash and ticket to
-a file
+.SS Hash a file with sha1 hash algorithm and save the hash and ticket to a file
 .IP
 .nf
 \fC
-tpm2_hash\ \-C\ e\ \-g\ sha1\ \-o\ hash.bin\ \-t\ ticket.bin\ data.txt
-\f
+tpm2_hash \-C e \-g sha1 \-o hash.bin \-t ticket.bin data.txt
+\fR
 .fi
 .SH Returns
 .PP
@@ -394,4 +402,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_hierarchycontrol.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_hierarchycontrol.1 Changed

@@ -1,49 +1,49 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_hierarchycontrol" "1" "July 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_hierarchycontrol\f(1) \- Enable and disable use of a
+\fBtpm2_hierarchycontrol\fR(1) \- Enable and disable use of a
 hierarchy and its associated NV storage.
 .SH SYNOPSIS
 .PP
-\fBtpm2_hierarchycontrol\f \fIOPTIONS\f \fIVARIABLE\f
-\fIOPERATION\f
+\fBtpm2_hierarchycontrol\fR \fIOPTIONS\fR \fIVARIABLE\fR
+\fIOPERATION\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_hierarchycontrol\f(1) \- Allows user change phEnable,
+\fBtpm2_hierarchycontrol\fR(1) \- Allows user change phEnable,
 phEnableNV, shEnable and ehEnable when the proper authorization is
 provided.
 Authorization should be one out of owner hierarchy auth, endorsement
 hierarchy auth and platform hierarchy auth.
-\fBAs an argument the tool takes the \fIVARIABLE\f as
-\fITPMA_STARTUP_CLEAR\f bit and _OPERATION_ as string clear|set to
-clear or set the \fIVARIABLE\f bit.\f
+\fBAs an argument the tool takes the \fBIVARIABLE\fB as
+\fBITPMA_STARTUP_CLEAR\fB bit and _OPERATION_ as string clear|set to
+clear or set the \fBIVARIABLE\fB bit.\fR
 .PP
 Note: If password option is missing, assume NULL.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specifies the handle used to authorize.
-Defaults to the "platform" hierarchy.
+Defaults to the \lqplatform\rq hierarchy.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a raw number can be used.
+\fB\fCB<num>\fB\fR where a raw number can be used.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-hierarchy\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-hierarchy\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -55,12 +55,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -73,8 +73,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -83,45 +82,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -129,69 +128,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -200,40 +201,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -241,18 +243,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -269,84 +271,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -354,36 +363,36 @@
 .IP
 .nf
 \fC
-tpm2_hierarchycontrol\ \-C\ p\ phEnableNV\ set\ \-P\ pass
-\f
+tpm2_hierarchycontrol \-C p phEnableNV set \-P pass
+\fR
 .fi
 .SS clear phEnableNV with platform hierarchy
 .IP
 .nf
 \fC
-tpm2_hierarchycontrol\ \-C\ p\ phEnableNV\ clear
-\f
+tpm2_hierarchycontrol \-C p phEnableNV clear
+\fR
 .fi
 .SS Set shEnable with platform hierarchy
 .IP
 .nf
 \fC
-tpm2_hierarchycontrol\ \-C\ p\ shEnable\ set
-\f
+tpm2_hierarchycontrol \-C p shEnable set
+\fR
 .fi
 .SS Set shEnable with owner hierarchy
 .IP
 .nf
 \fC
-tpm2_hierarchycontrol\ \-C\ o\ shEnable\ set
-\f
+tpm2_hierarchycontrol \-C o shEnable set
+\fR
 .fi
 .SS Check current TPMA_STARTUP_CLEAR Bits
 .IP
 .nf
 \fC
-tpm2_getcap\ properties\-variable
-\f
+tpm2_getcap properties\-variable
+\fR
 .fi
 .SH Returns
 .PP
@@ -406,4 +415,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_hmac.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_hmac.1 Changed

@@ -1,70 +1,70 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_hmac" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_hmac\f(1) \- Performs an HMAC operation with the TPM.
+\fBtpm2_hmac\fR(1) \- Performs an HMAC operation with the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_hmac\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_hmac\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_hmac\f(1) \- Performs an HMAC operation and returns the
+\fBtpm2_hmac\fR(1) \- Performs an HMAC operation and returns the
 results.
 If argument file is not specified, then data is read from stdin.
 .PP
 The hashing algorithm defaults to the keys scheme or sha256 if the key
 has a NULL scheme.
 .PP
-Output defaults to \fISTDOUT\f and binary format unless otherwise
-specified via \fB\-o\f and \fB\-\-hex\f options respectively.
+Output defaults to \fISTDOUT\fR and binary format unless otherwise
+specified via \fB\-o\fR and \fB\enhex\fR options respectively.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The context object of the symmetric signing key providing the HMAC key.
 Either a file or a handle number.
-See section "Context Object Format".
+See section \lqContext Object Format\rq.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
-Optional authorization value to use the key specified by \fB\-c\f.
+Optional authorization value to use the key specified by \fB\-c\fR.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm to use.
-Algorithms should follow the "formatting standards", see section
-"Algorithm Specifiers".
-Also, see section "Supported Hash Algorithms" for a list of supported
-hash algorithms.
+Algorithms should follow the \lqformatting standards\rq, see section
+\lqAlgorithm Specifiers\rq.
+Also, see section \lqSupported Hash Algorithms\rq for a list of
+supported hash algorithms.
 .RE
 .IP \bu 2
-\fB\-\-hex\f
+\fB\-\-hex\fR
 .RS 2
 .PP
-Convert the output hmac to hex format without a leading "0x".
+Convert the output hmac to hex format without a leading \lq0x\rq.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR:
 .RS 2
 .PP
 Optional file record of the HMAC result.
-Defaults to \fISTDOUT\f.
+Defaults to \fISTDOUT\fR.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-ticket\f=\fIFILE\f:
+\fB\-t\fR, \fB\-\-ticket\fR=\fIFILE\fR:
 .RS 2
 .PP
 Optional file record of the ticket result.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -73,19 +73,19 @@
 the command, it simply returns a cpHash.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the file path for
+\fBARGUMENT\fR the command line argument specifies the file path for
 the data to HMAC.
-Defaults to \fISTDIN\f if not specified.
+Defaults to \fISTDIN\fR if not specified.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -98,8 +98,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -108,45 +107,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -154,69 +153,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -225,10 +226,10 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -237,45 +238,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -283,69 +284,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -354,40 +357,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-\fIALGORITHM\f.
+\fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -395,18 +399,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -423,84 +427,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -508,23 +519,23 @@
 .IP
 .nf
 \fC
-#\ create\ a\ primary\ object
-tpm2_createprimary\ \-c\ primary.ctx
+# create a primary object
+tpm2_createprimary \-c primary.ctx
 
-#\ create\ an\ hmac\ key
-tpm2_create\ \-C\ primary.ctx\ \-G\ hmac\ \-c\ hmac.key
-\f
+# create an hmac key
+tpm2_create \-C primary.ctx \-G hmac \-c hmac.key
+\fR
 .fi
 .SS Perform an HMAC with Default Hash Algorithm
 .PP
-Perform an hmac using the key\aqs default scheme (hash algorithm) and
+Perform an hmac using the key\cqs default scheme (hash algorithm) and
 output to stdout in hexidecimal format.
 .IP
 .nf
 \fC
-tpm2_hmac\ \-c\ hmac.key\ \-\-hex\ data.in
+tpm2_hmac \-c hmac.key \-\-hex data.in
 e6eda48a53a9ddbb92f788f6d98e0372d63a408afb11aca43f522a2475a32805
-\f
+\fR
 .fi
 .SH Returns
 .PP
@@ -547,4 +558,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_import.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_import.1 Changed

@@ -1,17 +1,17 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_import" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_import\f(1) \- Imports an external key into the tpm as a TPM
-managed key object.
+\fBtpm2_import\fR(1) \- Imports an external key into the tpm as a
+TPM managed key object.
 .SH SYNOPSIS
 .PP
-\fBtpm2_import\f \fIOPTIONS\f
+\fBtpm2_import\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_import\f(1) \- Imports an external generated key as TPM
+\fBtpm2_import\fR(1) \- Imports an external generated key as TPM
 managed key object.
 It requires that the parent key object be a RSA key.
 Can also import a TPM managed key object created by the tpm2_duplicate
@@ -20,56 +20,58 @@
 .PP
 These options control the key importation process:
 .IP \bu 2
-\fB\-G\f, \fB\-\-key\-algorithm\f=\fIALGORITHM\f:
+\fB\-G\fR, \fB\-\-key\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 The algorithm used by the key to be imported.
 Supports:
 .IP \bu 2
-\fBaes\f \- AES 128, 192 or 256 key.
+\fBaes\fR \- AES 128, 192 or 256 key.
 .IP \bu 2
-\fBrsa\f \- RSA 1024 or 2048 key.
+\fBrsa\fR \- RSA 1024 or 2048 key.
 .IP \bu 2
-\fBecc\f \- ECC NIST P192, P224, P256, P384 or P521 public and
+\fBecc\fR \- ECC NIST P192, P224, P256, P384 or P521 public and
 private key.
+.IP \bu 2
+\fBhmac\fR \- HMAC key.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm for generating the objects name.
-This is optional and defaults to \fBsha256\f when not specified.
-Algorithms should follow the "formatting standards", see section
-"Algorithm Specifiers".
-Also, see section "Supported Hash Algorithms" for a list of supported
-hash algorithms.
+This is optional and defaults to \fBsha256\fR when not specified.
+Algorithms should follow the \lqformatting standards\rq, see section
+\lqAlgorithm Specifiers\rq.
+Also, see section \lqSupported Hash Algorithms\rq for a list of
+supported hash algorithms.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-input\f=\fIFILE\f:
+\fB\-i\fR, \fB\-\-input\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specifies the filename of the key to be imported.
 For AES keys, this file is the raw key bytes.
 For assymetric keys in PEM or DER format.
-A typical file is generated with \fCopenssl\ genrsa\f.
+A typical file is generated with \fCopenssl genrsa\fR.
 .RE
 .IP \bu 2
-\fB\-C\f, \fB\-\-parent\-context\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-parent\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The parent key object.
 .RE
 .IP \bu 2
-\fB\-U\f, \fB\-\-parent\-public\f=\fIFILE\f:
+\fB\-U\fR, \fB\-\-parent\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 Optional.
 Specifies the parent key public data file input.
-This can be read with \fBtpm2_readpublic\f(1) tool.
+This can be read with \fBtpm2_readpublic\fR(1) tool.
 If not specified, the tool invokes a tpm2_readpublic on the parent
 object.
 .RE
 .IP \bu 2
-\fB\-k\f, \fB\-\-encryption\-key\f=\fIFILE\f:
+\fB\-k\fR, \fB\-\-encryption\-key\fR=\fIFILE\fR:
 .RS 2
 .PP
 Optional.
@@ -79,7 +81,7 @@
 CFB mode otherwise none.
 .RE
 .IP \bu 2
-\fB\-r\f, \fB\-\-private\f=\fIFILE\f:
+\fB\-r\fR, \fB\-\-private\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specifies the file path required to save the encrypted private portion
@@ -94,24 +96,24 @@
 (confidentiality and integrity).
 For instance, transient objects require that TPM protected data (key or
 seal material) be stored outside of the TPM.
-This is seen in tools like tpm2_create(1), where the \fB\-r\f option
-outputs this protected data.
+This is seen in tools like tpm2_create(1), where the \fB\-r\fR
+option outputs this protected data.
 This blob contains the sensitive portions of the object.
 The sensitive portions of the object are protected by the parent object,
-using the parent\aqs symmetric encryption details to encrypt the
+using the parent\cqs symmetric encryption details to encrypt the
 sensitive data and HMAC it.
 .PP
 In\-depth details can be found in sections 23 of:
 .IP \bu 2
 https://trustedcomputinggroup.org/wp\-content/uploads/TPM\-Rev\-2.0\-Part\-1\-Architecture\-01.38.pdf
 .PP
-Notably Figure 20, is relevant, even though it\aqs specifically
+Notably Figure 20, is relevant, even though it\cqs specifically
 referring to duplication blobs, the process is identical.
 .PP
 If the output is from tpm2_duplicate(1), the output will be slightly
 different, as described fully in section 23.
 .IP \bu 2
-\fB\-u\f, \fB\-\-public\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specifies the file path required to save the public portion of the
@@ -121,48 +123,54 @@
 containing the public portion of the object to be imported.
 .RE
 .IP \bu 2
-\fB\-a\f, \fB\-\-attributes\f=\fIATTRIBUTES\f:
+\fB\-a\fR, \fB\-\-attributes\fR=\fIATTRIBUTES\fR:
 .RS 2
 .PP
 The object attributes, optional.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-parent\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-parent\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for using the parent key specified with
-\fB\-C\f.
+\fB\-C\fR.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-key\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-key\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the imported key, optional.
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIPOLICY_FILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIPOLICY\fR or
+\fIHEX_STRING\fR:
 .RS 2
 .PP
-The policy file.
+The policy file or policy hex string used for authorization to the
+object.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-seed\f=\fIFILE\f:
+\fB\-s\fR, \fB\-\-seed\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specifies the file containing the encrypted seed of the duplicated
 object.
+.PP
+In order to perform an \lqunencrypted import\rq a seed file with the
+content 0x0000 needs to be provided (e.g.\ printf \lq0000\rq | xxd
+\-r \-p >seed.file).
 .RE
 .IP \bu 2
-\fB\-\-passin\f=\fIOSSL_PEM_FILE_PASSWORD\f
+\fB\-\-passin\fR=\fIOSSL_PEM_FILE_PASSWORD\fR
 .RS 2
 .PP
 An optional password for an Open SSL (OSSL) provided input file.
 It mirrors the \-passin option of OSSL and is known to support the pass,
 file, env, fd and plain password formats of openssl.
-(see \fIman(1) openssl\f) for more.
+(see \fIman(1) openssl\fR) for more.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -174,12 +182,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -192,8 +200,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -202,45 +209,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -248,69 +255,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -319,13 +328,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -336,7 +345,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -347,6 +356,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -380,6 +391,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -407,7 +420,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -416,27 +429,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
+.IP \bu 2
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -444,21 +465,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -471,6 +494,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -483,73 +508,73 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH Object Attributes
 .PP
 Object Attributes are used to control various properties of created
 objects.
 When specified as an option, either the raw bitfield mask or
-"nice\-names" may be used.
+\lqnice\-names\rq may be used.
 The values can be found in Table 31 Part 2 of the TPM2.0 specification,
 which can be found here:
 .PP
 <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf>
 .PP
 Nice names are calculated by taking the name field of table 31 and
-removing the prefix \fBTPMA_OBJECT_\f and lowercasing the result.
-Thus, \fBTPMA_OBJECT_FIXEDTPM\f becomes fixedtpm.
-Nice names can be joined using the bitwise or "|" symbol.
+removing the prefix \fBTPMA_OBJECT_\fR and lowercasing the result.
+Thus, \fBTPMA_OBJECT_FIXEDTPM\fR becomes fixedtpm.
+Nice names can be joined using the bitwise or \lq|\rq symbol.
 .PP
-For instance, to set The fields \fBTPMA_OBJECT_FIXEDTPM\f,
-\fBTPMA_OBJECT_NODA\f, and \fBTPMA_OBJECT_SIGN_ENCRYPT\f, the
+For instance, to set The fields \fBTPMA_OBJECT_FIXEDTPM\fR,
+\fBTPMA_OBJECT_NODA\fR, and \fBTPMA_OBJECT_SIGN_ENCRYPT\fR, the
 argument would be:
 .PP
-\fBfixedtpm|noda|sign\f specifying the object attributes
-\fIATTRIBUTES\f.
+\fBfixedtpm|noda|sign\fR specifying the object attributes
+\fIATTRIBUTES\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -557,18 +582,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -585,84 +610,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -670,8 +702,8 @@
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-Grsa2048:aes128cfb\ \-C\ o\ \-c\ parent.ctx
-\f
+tpm2_createprimary \-Grsa2048:aes128cfb \-C o \-c parent.ctx
+\fR
 .fi
 .PP
 Create your key and and import it.
@@ -680,35 +712,35 @@
 .IP
 .nf
 \fC
-dd\ if=/dev/urandom\ of=sym.key\ bs=1\ count=16
+dd if=/dev/urandom of=sym.key bs=1 count=16
 
-tpm2_import\ \-C\ parent.ctx\ \-i\ sym.key\ \-u\ key.pub\ \-r\ key.priv
-\f
+tpm2_import \-C parent.ctx \-G aes \-i sym.key \-u key.pub \-r key.priv
+\fR
 .fi
 .SS Import an RSA key
 .IP
 .nf
 \fC
-openssl\ genrsa\ \-out\ private.pem\ 2048
+openssl genrsa \-out private.pem 2048
 
-tpm2_import\ \-C\ parent.ctx\ \-G\ rsa\ \-i\ private.pem\ \-u\ key.pub\ \-r\ key.priv
-\f
+tpm2_import \-C parent.ctx \-G rsa \-i private.pem \-u key.pub \-r key.priv
+\fR
 .fi
 .SS Import an ECC key
 .IP
 .nf
 \fC
-openssl\ ecparam\ \-name\ prime256v1\ \-genkey\ \-noout\ \-out\ private.ecc.pem
+openssl ecparam \-name prime256v1 \-genkey \-noout \-out private.ecc.pem
 
-tpm2_import\ \-C\ parent.ctx\ \-G\ ecc\ \-i\ private.ecc.pem\ \-u\ key.pub\ \-r\ key.priv
-\f
+tpm2_import \-C parent.ctx \-G ecc \-i private.ecc.pem \-u key.pub \-r key.priv
+\fR
 .fi
 .SS Import a duplicated key
 .IP
 .nf
 \fC
-tpm2_import\ \-C\ parent.ctx\ \-i\ key.dup\ \-u\ key.pub\ \-r\ key.priv\ \-L\ policy.dat
-\f
+tpm2_import \-C parent.ctx \-i key.dup \-u key.pub \-r key.priv \-L policy.dat
+\fR
 .fi
 .SH LIMITATIONS
 .IP \bu 2
@@ -735,4 +767,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_incrementalselftest.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_incrementalselftest.1 Changed

@@ -1,20 +1,20 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_incrementalselftest" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_incrementalselftest\f(1) \- Request testing of specified
+\fBtpm2_incrementalselftest\fR(1) \- Request testing of specified
 algorithm list
 .SH SYNOPSIS
 .PP
-\fBtpm2_incrementalselftest\f \fIOPTIONS\f
-\fIALG_SPEC_LIST\f
+\fBtpm2_incrementalselftest\fR \fIOPTIONS\fR
+\fIALG_SPEC_LIST\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_incrementalselftest\f(1) Request the TPM to perform testing
+\fBtpm2_incrementalselftest\fR(1) Request the TPM to perform testing
 on specified algorithm and print a list of algorithm scheduled to be
-tested \fIOR\f remain to be tested but not scheduled.
+tested \fIOR\fR remain to be tested but not scheduled.
 .PP
 The main interest of this command is to reduce delays that might occur
 on cryptographic operations as TPM must test the algorithm prior using
@@ -22,19 +22,19 @@
 .SH ALG_SPEC_LIST
 .PP
 A space\-separated list of algorithm suite to be tested.
-Algorithms should follow the "formatting standards", see section
-"Algorithm Specifiers".
-Also, see section "Supported Hash Algorithms" for a list of supported
-hash algorithms.
+Algorithms should follow the \lqformatting standards\rq, see section
+\lqAlgorithm Specifiers\rq.
+Also, see section \lqSupported Hash Algorithms\rq for a list of
+supported hash algorithms.
 .PP
-If \fIALG_SPEC_LIST\f is left empty,
-\fBtpm2_incrementalselftest\f(1) will return the list of algorithms
+If \fIALG_SPEC_LIST\fR is left empty,
+\fBtpm2_incrementalselftest\fR(1) will return the list of algorithms
 left to be tested.
-Please note that in this case these algorithms are \fBNOT\f
+Please note that in this case these algorithms are \fBNOT\fR
 scheduled to be tested.
 .PP
-If \fIALG_SPEC_LIST\f is not empty,
-\fBtpm2_incrementalselftest\f(1) will return the list of algorithms
+If \fIALG_SPEC_LIST\fR is not empty,
+\fBtpm2_incrementalselftest\fR(1) will return the list of algorithms
 that remains to be tested.
 This list contains algorithms scheduled for testing AND algorithms that
 remains to be tested and not yet scheduled.
@@ -46,14 +46,14 @@
 tested (not scheduled) is also printed in YAML format.
 .PP
 If none of the specified algorithm is printed, that means both that they
-are already tested AND that these algorithms won\aqt be tested again.
+are already tested AND that these algorithms won\cqt be tested again.
 .SH OPTIONS
 .PP
 This tool accepts no tool specific options.
 .SS References
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -64,7 +64,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -75,6 +75,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -108,6 +110,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -135,7 +139,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -144,27 +148,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -172,21 +184,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -199,6 +213,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -211,51 +227,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -263,18 +279,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -291,84 +307,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -376,28 +399,28 @@
 .IP
 .nf
 \fC
-tpm2_incrementalselftest\ rsa
-\f
+tpm2_incrementalselftest rsa
+\fR
 .fi
 .SS Request testing of multiple algorithms
 .IP
 .nf
 \fC
-tpm2_incrementalselftest\ rsa\ ecc\ xor\ aes\ cbc
-\f
+tpm2_incrementalselftest rsa ecc xor aes cbc
+\fR
 .fi
 .SH NOTES
 .PP
 Algorithm suite specified can imply either testing the combination or
 the complete suite, depending on TPM manufacturer implementation.
 .PP
-e.g : One TPM might only test AES with CTR mode if "aes ctr" is
+e.g : One TPM might only test AES with CTR mode if \lqaes ctr\rq is
 specified.
 An other might also test complete AES mode list AND test ctr mode.
 .PP
-If an algorithm has already been tested, this command won\aqt permit
+If an algorithm has already been tested, this command won\cqt permit
 re\-executing the test.
-Only issuing \fBtpm2_selftest\f(1) in full\-test mode enabled will
+Only issuing \fBtpm2_selftest\fR(1) in full\-test mode enabled will
 force re\-testing.
 .SH Returns
 .PP
@@ -420,4 +443,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_load.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_load.1 Changed

@@ -1,71 +1,76 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_load" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_load\f(1) \- Load an object into the TPM.
+\fBtpm2_load\fR(1) \- Load an object into the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_load\f \fIOPTIONS\f
+\fBtpm2_load\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_load\f(1) \- Load both the private and public portions of an
-object into the TPM.
+\fBtpm2_load\fR(1) \- Load both the private and public portions of
+an object into the TPM or load the object in the TSS2\-Private\-Key PEM
+format.
+This can be done by specifying the private as well as the public section
+or via a pem file using the \fI\-r\fR option.
 .PP
 The tool outputs the name of the loaded object in a YAML dictionary
-format with the key \fIname\f where the value for that key is the
+format with the key \fIname\fR where the value for that key is the
 name of the object in hex format, for example:
 .IP
 .nf
 \fC
-name:\ 000bac25cb8743111c8e1f52f2ee7279d05d3902a18dd1af694db5d1afa7adf1c8b3
-\f
+name: 000bac25cb8743111c8e1f52f2ee7279d05d3902a18dd1af694db5d1afa7adf1c8b3
+\fR
 .fi
 .PP
 It also saves a context file for future interactions with the object.
 .PP
-\fBNOTE\f: Both private and public portions of the tpm key must be
+\fBNOTE\fR: Both private and public portions of the tpm key must be
 specified.
+The exception to this is if a TSS2\-Private\-Key formatted PEM object is
+to be loaded which does not need the public specified.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-parent\-context\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-parent\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The parent object.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
-The authorization value of the parent object specified by \fB\-C\f.
+The authorization value of the parent object specified by \fB\-C\fR.
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-public\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 A file containing the public portion of the object.
 .RE
 .IP \bu 2
-\fB\-r\f, \fB\-\-private\f=\fIFILE\f:
+\fB\-r\fR, \fB\-\-private\fR=\fIFILE\fR:
 .RS 2
 .PP
 A file containing the sensitive portion of the object.
 .RE
 .IP \bu 2
-\fB\-n\f, \fB\-\-name\f=\fIFILE\f:
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
 .RS 2
 .PP
 An optional file to save the name structure of the object.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIFILE\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file name of the saved object context, required.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -77,12 +82,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -95,8 +100,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -105,45 +109,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -151,69 +155,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -222,40 +228,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -263,18 +270,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -291,84 +298,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -380,16 +394,16 @@
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-c\ primary.ctx
-\f
+tpm2_createprimary \-c primary.ctx
+\fR
 .fi
 .PP
 Step 2 is to create an object under the primary object.
 .IP
 .nf
 \fC
-tpm2_create\ \-C\ primary.ctx\ \-u\ key.pub\ \-r\ key.priv
-\f
+tpm2_create \-C primary.ctx \-u key.pub \-r key.priv
+\fR
 .fi
 .PP
 This creates the private and public portions of the TPM object.
@@ -402,9 +416,9 @@
 .IP
 .nf
 \fC
-tpm2_load\ \ \-C\ primary.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-c\ key.ctx
-name:\ 000bac25cb8743111c8e1f52f2ee7279d05d3902a18dd1af694db5d1afa7adf1c8b3
-\f
+tpm2_load  \-C primary.ctx \-u key.pub \-r key.priv \-c key.ctx
+name: 000bac25cb8743111c8e1f52f2ee7279d05d3902a18dd1af694db5d1afa7adf1c8b3
+\fR
 .fi
 .SH Returns
 .PP
@@ -427,4 +441,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_loadexternal.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_loadexternal.1 Changed

@@ -1,171 +1,177 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_loadexternal" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_loadexternal\f(1) \- Load an external object into the TPM.
+\fBtpm2_loadexternal\fR(1) \- Load an external object into the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_loadexternal\f \fIOPTIONS\f
+\fBtpm2_loadexternal\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_loadexternal\f(1) \- This command loads an external object
+\fBtpm2_loadexternal\fR(1) \- This command loads an external object
 into the TPM, forgoing TPM protections.
-Ie, the key material is not protected by the parent object\aqs seed.
+Ie, the key material is not protected by the parent object\cqs seed.
+It can also be used to load TSS2 Private Keys in pem format.
 The command allows loading of just the public portion of an object or
 both the public and private portions of an object.
+For TSS2 Private Keys, only the public portion of the key is loaded.
 .PP
 The tool outputs the name of the loaded object in a YAML dictionary
-format with the key \fIname\f where the value for that key is the
+format with the key \fIname\fR where the value for that key is the
 name of the object in hex format, for example:
 .IP
 .nf
 \fC
-name:\ 000bac25cb8743111c8e1f52f2ee7279d05d3902a18dd1af694db5d1afa7adf1c8b3
-\f
+name: 000bac25cb8743111c8e1f52f2ee7279d05d3902a18dd1af694db5d1afa7adf1c8b3
+\fR
 .fi
 .PP
 It also saves a context file for future interactions with the object.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Hierarchy to use for the ticket, optional.
-Defaults to \fBn\f, \fBnull\f.
+Defaults to \fBn\fR, \fBnull\fR.
 Supported options are:
 .IP \bu 2
-\fBo\f for the \fBowner\f hierarchy.
+\fBo\fR for the \fBowner\fR hierarchy.
 .IP \bu 2
-\fBp\f for the \fBplatform\f hierarchy.
+\fBp\fR for the \fBplatform\fR hierarchy.
 .IP \bu 2
-\fBe\f for the \fBendorsement\f hierarchy.
+\fBe\fR for the \fBendorsement\fR hierarchy.
 .IP \bu 2
-\fBn\f for the \fBnull\f hierarchy.
+\fBn\fR for the \fBnull\fR hierarchy.
 .RE
 .IP \bu 2
-\fB\-G\f, \fB\-\-key\-algorithm\f=\fIALGORITHM\f:
+\fB\-G\fR, \fB\-\-key\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 The algorithm used by the key to be imported.
 Supports:
 .IP \bu 2
-\fBaes\f \- AES 128,192 or 256 key.
+\fBaes\fR \- AES 128,192 or 256 key.
 .IP \bu 2
-\fBrsa\f \- RSA 1024 or 2048 key.
+\fBrsa\fR \- RSA 1024 or 2048 key.
 .IP \bu 2
-\fBecc\f \- ECC NIST P192, P224, P256, P384 or P521 public and
+\fBecc\fR \- ECC NIST P192, P224, P256, P384 or P521 public and
 private key.
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-public\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
 .RS 2
 The public portion of the object, this can be one of the following file
 formats:
 .IP \bu 2
 TSS \- The TSS/TPM format.
-For example from option \fC\-u\f of command \fBtpm2_create\f(1).
+For example from option \fC\-u\fR of command
+\fBtpm2_create\fR(1).
 .IP \bu 2
 RSA \- OSSL PEM formats.
-For example \fCpublic.pem\f from the command
-\fCopenssl\ rsa\ \-in\ private.pem\ \-out\ public.pem\ \-pubout\f
+For example \fCpublic.pem\fR from the command
+\fCopenssl rsa \-in private.pem \-out public.pem \-pubout\fR
 .IP \bu 2
 ECC \- OSSL PEM formats.
-For example \fCpublic.pem\f from the command
-\fCopenssl\ ec\ \-in\ private.ecc.pem\ \-out\ public.ecc.pem\ \-pubout\f
+For example \fCpublic.pem\fR from the command
+\fCopenssl ec \-in private.ecc.pem \-out public.ecc.pem \-pubout\fR
 .RE
 .IP \bu 2
-\fB\-r\f, \fB\-\-private\f=\fIFILE\f:
+\fB\-r\fR, \fB\-\-private\fR=\fIFILE\fR:
 .RS 2
 The sensitive portion of the object, optional.
 If one wishes to use the private portion of a key, this must be
 specified.
-Like option \fB\-u\f, this command takes files in the following
+Like option \fB\-u\fR, this command takes files in the following
 format:
 .IP \bu 2
 RSA \- OSSL PEM formats.
-For example \fCprivate.pem\f from the command
-\fCopenssl\ genrsa\ \-out\ private.pem\ 2048\f Since an RSA public
-key can be derived from the private PEM file, their is no need to
-specify \-u for the public portion.
+For example \fCprivate.pem\fR from the command
+\fCopenssl genrsa \-out private.pem 2048\fR Since an RSA public key
+can be derived from the private PEM file, their is no need to specify
+\-u for the public portion.
+.IP \bu 2
+TSS2 PrivateKey PEM formats.
 .PP
-\fINote\f: The private portion does not respect TSS formats as
-it\aqs impossible to get a \fBTPM2B_SENSITIVE\f output from a
+\fINote\fR: The private portion does not respect TSS formats as
+it\cqs impossible to get a \fBTPM2B_SENSITIVE\fR output from a
 previous command.
-They are always protected by the TPM as \fBTPM2B_PRIVATE\f blobs.
+They are always protected by the TPM as \fBTPM2B_PRIVATE\fR blobs.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the key, optional.
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIPOLICY_FILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR or
+\fIHEX_STRING\fR:
 .RS 2
 .PP
-The input policy file, optional.
-A file containing the hash of a policy derived from
-\fCtpm2_createpolicy\f.
+The input policy file or hex string, optional.
+A file or hex string containing the hash of a policy derived from
+\fCtpm2_createpolicy\fR or another policy digest generating source.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm for generating the objects name.
 This is optional and defaults to sha256 when not specified.
-However, load external supports having a \fInull\f name algorithm.
+However, load external supports having a \fInull\fR name algorithm.
 In this case, no cryptographic binding checks between the public and
 private portions are performed.
 .RE
 .IP \bu 2
-\fB\-a\f, \fB\-\-attributes\f=\fIATTRIBUTES\f:
+\fB\-a\fR, \fB\-\-attributes\fR=\fIATTRIBUTES\fR:
 .RS 2
 .PP
 The object attributes, optional.
 The default for created objects is:
-\fCTPMA_OBJECT_SIGN_ENCRYPT|TPMA_OBJECT_DECRYPT\f.
-Optionally, if \-p is specified or no \fC\-p\f or \fC\-L\f is
-specified then \fCTPMA_OBJECT_USERWITHAUTH\f is added to the default
-attribute set.
+\fCTPMA_OBJECT_SIGN_ENCRYPT|TPMA_OBJECT_DECRYPT\fR.
+Optionally, if \-p is specified or no \fC\-p\fR or \fC\-L\fR is
+specified then \fCTPMA_OBJECT_USERWITHAUTH\fR is added to the
+default attribute set.
 .PP
-\fINote\f: If specifying attributes, the TPM will reject certain
-attributes like \fBTPMA_OBJECT_FIXEDTPM\f, as those guarantees
+\fINote\fR: If specifying attributes, the TPM will reject certain
+attributes like \fBTPMA_OBJECT_FIXEDTPM\fR, as those guarantees
 cannot be made.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIFILE\f
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIFILE\fR
 .RS 2
 .PP
 The file name to save the object context, required.
 .RE
 .IP \bu 2
-\fB\-n\f, \fB\-\-name\f=\fIFILE\f:
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
 .RS 2
 .PP
 An optional file to save the object name, which is in a binary hash
 format.
-The size of the hash is based on name algorithm or the \fB\-g\f
+The size of the hash is based on name algorithm or the \fB\-g\fR
 option.
 .RE
 .IP \bu 2
-\fB\-\-passin\f=\fIOSSL_PEM_FILE_PASSWORD\f
+\fB\-\-passin\fR=\fIOSSL_PEM_FILE_PASSWORD\fR
 .RS 2
 .PP
 An optional password for an Open SSL (OSSL) provided input file.
 It mirrors the \-passin option of OSSL and is known to support the pass,
 file, env, fd and plain password formats of openssl.
-(see \fIman(1) openssl\f) for more.
+(see \fIman(1) openssl\fR) for more.
 .RE
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -178,8 +184,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -188,45 +193,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -234,69 +239,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -305,13 +312,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -322,7 +329,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -333,6 +340,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -366,6 +375,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -393,7 +404,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -402,27 +413,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
+.IP \bu 2
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -430,21 +449,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -457,6 +478,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -469,73 +492,73 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH Object Attributes
 .PP
 Object Attributes are used to control various properties of created
 objects.
 When specified as an option, either the raw bitfield mask or
-"nice\-names" may be used.
+\lqnice\-names\rq may be used.
 The values can be found in Table 31 Part 2 of the TPM2.0 specification,
 which can be found here:
 .PP
 <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf>
 .PP
 Nice names are calculated by taking the name field of table 31 and
-removing the prefix \fBTPMA_OBJECT_\f and lowercasing the result.
-Thus, \fBTPMA_OBJECT_FIXEDTPM\f becomes fixedtpm.
-Nice names can be joined using the bitwise or "|" symbol.
+removing the prefix \fBTPMA_OBJECT_\fR and lowercasing the result.
+Thus, \fBTPMA_OBJECT_FIXEDTPM\fR becomes fixedtpm.
+Nice names can be joined using the bitwise or \lq|\rq symbol.
 .PP
-For instance, to set The fields \fBTPMA_OBJECT_FIXEDTPM\f,
-\fBTPMA_OBJECT_NODA\f, and \fBTPMA_OBJECT_SIGN_ENCRYPT\f, the
+For instance, to set The fields \fBTPMA_OBJECT_FIXEDTPM\fR,
+\fBTPMA_OBJECT_NODA\fR, and \fBTPMA_OBJECT_SIGN_ENCRYPT\fR, the
 argument would be:
 .PP
-\fBfixedtpm|noda|sign\f specifying the object attributes
-\fIATTRIBUTES\f.
+\fBfixedtpm|noda|sign\fR specifying the object attributes
+\fIATTRIBUTES\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -543,18 +566,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -571,137 +594,152 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH NOTES
 .IP \bu 2
-If the hierarchy is \fInull\f or the name hashing algorithm is
-\fInull\f, tickets produced using the object will be NULL.
+If the hierarchy is \fInull\fR or the name hashing algorithm is
+\fInull\fR, tickets produced using the object will be NULL.
 .IP \bu 2
 If the private portion of an object is specified, the hierarchy must be
-\fInull\f or the TPM will reject loading it.
+\fInull\fR or the TPM will reject loading it.
 .SH EXAMPLES
-.SS Load a TPM generated public key into the \fIowner\f hierarchy
+.SS Load a TPM generated public key into the \fIowner\fR hierarchy
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-c\ primary.ctx
+tpm2_createprimary \-c primary.ctx
 
-tpm2_create\ \-C\ primary.ctx\ \-u\ pub.dat\ \-r\ priv.dat
+tpm2_create \-C primary.ctx \-u pub.dat \-r priv.dat
 
-tpm2_loadexternal\ \-C\ o\ \-u\ pub.dat\ \-c\ pub.ctx
-name:\ 000b9be4d7c6193a57e1bfc86a42a6b03856a91d2f9e77c6cbdb796a783d52d4b3b9
-\f
+tpm2_loadexternal \-C o \-u pub.dat \-c pub.ctx
+name: 000b9be4d7c6193a57e1bfc86a42a6b03856a91d2f9e77c6cbdb796a783d52d4b3b9
+\fR
 .fi
-.SS Load an RSA public key into the \fIowner\f hierarchy
+.SS Load an RSA public key into the \fIowner\fR hierarchy
 .IP
 .nf
 \fC
-openssl\ genrsa\ \-out\ private.pem\ 2048
+openssl genrsa \-out private.pem 2048
 
-openssl\ rsa\ \-in\ private.pem\ \-out\ public.pem\ \-outform\ PEM\ \-pubout
+openssl rsa \-in private.pem \-out public.pem \-outform PEM \-pubout
 
-tpm2_loadexternal\ \-C\ o\ \-Grsa\ \-u\ public.pem\ \-c\ key.ctx
-name:\ 000b7b91d304d16995d42792b57d0fb25df7abe5fdd8afe9950730e00dc5b934ddbc
-\f
+tpm2_loadexternal \-C o \-Grsa \-u public.pem \-c key.ctx
+name: 000b7b91d304d16995d42792b57d0fb25df7abe5fdd8afe9950730e00dc5b934ddbc
+\fR
 .fi
-.SS Load an RSA key\-pair into the \fInull\f hierarchy
+.SS Load an RSA key\-pair into the \fInull\fR hierarchy
 .IP
 .nf
 \fC
-openssl\ genrsa\ \-out\ private.pem\ 2048
+openssl genrsa \-out private.pem 2048
 
-tpm2_loadexternal\ \-C\ n\ \-Grsa\ \-r\ private.pem\ \-c\ key.ctx
-name:\ 000b635ea220b6c62ec1d02343859dd203c8ac5dad82ebc5b124e407d2502f88691f
-\f
+tpm2_loadexternal \-C n \-Grsa \-r private.pem \-c key.ctx
+name: 000b635ea220b6c62ec1d02343859dd203c8ac5dad82ebc5b124e407d2502f88691f
+\fR
 .fi
-.SS Load an AES key into the \fInull\f hierarchy
+.SS Load an AES key into the \fInull\fR hierarchy
 .IP
 .nf
 \fC
-dd\ if=/dev/urandom\ of=sym.key\ bs=1\ count=16
+dd if=/dev/urandom of=sym.key bs=1 count=16
 
-tpm2_loadexternal\ \-C\ n\ \-Gaes\ \-r\ sym.key\ \-c\ key.ctx
-name:\ 000bfc4d8dd7e4f921bcc9dca4b04f49564243cd9def129a3740002bfd4b9e966d34
-\f
+tpm2_loadexternal \-C n \-Gaes \-r sym.key \-c key.ctx
+name: 000bfc4d8dd7e4f921bcc9dca4b04f49564243cd9def129a3740002bfd4b9e966d34
+\fR
+.fi
+.SS Load TSS2 Private Key into the \fInull\fR hierarchy
+.IP
+.nf
+\fC
+tpm2_loadexternal \-r tss_privkey.pem \-c tss_privkey.ctx
+name: 000bc5a216702aca9ba226af1214c50dc4dc33ce6269677aa581ea6d9eec7f27000d
+\fR
 .fi
 .SH Returns
 .PP
@@ -724,4 +762,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_makecredential.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_makecredential.1 Changed

@@ -1,27 +1,27 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_makecredential" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_makecredential\f(1) \- Generate the
+\fBtpm2_makecredential\fR(1) \- Generate the
 encrypted\-user\-chosen\-data and the
 wrapped\-secret\-data\-encryption\-key for the privacy\-sensitive
 credentialing process of a TPM object.
 .SH SYNOPSIS
 .PP
-\fBtpm2_makecredential\f \fIOPTIONS\f
+\fBtpm2_makecredential\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_makecredential\f(1) \- The TPM supports a privacy preserving
-protocol for distributing credentials for keys on a TPM.
+\fBtpm2_makecredential\fR(1) \- The TPM supports a privacy
+preserving protocol for distributing credentials for keys on a TPM.
 The process guarantees that the credentialed\-TPM\-object(AIK) is loaded
 on the same TPM as a well\-known public\-key\-object(EK) without
 knowledge of the specific public properties of the
 credentialed\-TPM\-object(AIK).
 The privacy is guaranteed due to the fact that only the name of the
 credentialed\-TPM\-object(AIK) is shared and not the
-credentialed\-TPM\-object\aqs public key itself.
+credentialed\-TPM\-object\cqs public key itself.
 .PP
 Make\-credential is the first step in this process where in after
 receiving the public\-key\-object(EK) public key of the TPM and the name
@@ -31,28 +31,29 @@
 that guarantees that the credentialed\-TPM\-object(AIK) is loaded on the
 TPM with the well\-known public\-key\-object(EK).
 .PP
-\fBtpm2_makecredential\f can be used to generate the
+\fBtpm2_makecredential\fR can be used to generate the
 encrypted\-user\-chosen\-data and the wrapped
-secret\-data\-encryption\-key without a TPM by using the \fBnone\f
+secret\-data\-encryption\-key without a TPM by using the \fBnone\fR
 TCTI option.
 .SH OPTIONS
 .IP \bu 2
-\fB\-e\f, \fB\-\-encryption\-key\f=\fIFILE\f:
+\fB\-e\fR, \fB\-\-encryption\-key\fR=\fIFILE\fR:
 .RS 2
 .PP
-\fBDEPRECATED\f, use \fB\-u\f or \fB\-\-public\f instead.
+\fBDEPRECATED\fR, use \fB\-u\fR or \fB\enpublic\fR
+instead.
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-public\f=\fIFILE\f:
+\fB\-u\fR, \fB\-\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 A TPM public key which was used to wrap the seed.
-NOTE: This option is same as \fB\-e\f and is added to make it
+NOTE: This option is same as \fB\-e\fR and is added to make it
 similar with other tools specifying the public key.
 The old option is retained for backwards compatibility.
 .RE
 .IP \bu 2
-\fB\-G\f, \fB\-\-key\-algorithm\f=\fIALGORITHM\f:
+\fB\-G\fR, \fB\-\-key\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The key algorithm associated with TPM public key.
@@ -61,7 +62,7 @@
 format and the default TCG EK template is used for the key properties.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-secret\f=\fIFILE\f or \fISTDIN\f:
+\fB\-s\fR, \fB\-\-secret\fR=\fIFILE\fR or \fISTDIN\fR:
 .RS 2
 .PP
 The secret which will be protected by the key derived from the random
@@ -69,13 +70,13 @@
 It can be specified as a file or passed from stdin.
 .RE
 .IP \bu 2
-\fB\-n\f, \fB\-\-name\f=\fIFILE\f:
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
 .RS 2
 .PP
 The name of the key for which certificate is to be created.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-credential\-blob\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-credential\-blob\fR=\fIFILE\fR:
 .RS 2
 .PP
 The output file path, recording the encrypted\-user\-chosen\-data and
@@ -86,49 +87,50 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
 Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -145,102 +147,109 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2\ createek\ \-Q\ \-c\ 0x81010009\ \-G\ rsa\ \-u\ ek.pub
+tpm2 createek \-Q \-c 0x81010009 \-G rsa \-u ek.pub
 
-tpm2\ createak\ \-C\ 0x81010009\ \-c\ ak.ctx\ \-G\ rsa\ \-g\ sha256\ \-s\ rsassa\ \-u\ ak.pub\ \\
-\-n\ ak.name\ \-p\ akpass>\ ak.out
+tpm2 createak \-C 0x81010009 \-c ak.ctx \-G rsa \-g sha256 \-s rsassa \-u ak.pub \rs
+\-n ak.name \-p akpass> ak.out
 
-file_size=`ls\ \-l\ ak.name\ |\ awk\ {\aqprint\ $5\aq}`
-loaded_key_name=`cat\ ak.name\ |\ xxd\ \-p\ \-c\ $file_size`
+file_size=\gals \-l ak.name | awk {\aqprint $5\aq}\ga
+loaded_key_name=\gacat ak.name | xxd \-p \-c $file_size\ga
 
-tpm2\ readpublic\ \-c\ 0x81010009\ \-o\ ek.pem\ \-f\ pem\ \-Q
+tpm2 readpublic \-c 0x81010009 \-o ek.pem \-f pem \-Q
 
-echo\ "12345678"\ |\ tpm2\ makecredential\ \-Q\ \-u\ ek.pem\ \-s\ \-\ \-n\ $loaded_key_name\ \\
-\-o\ mkcred.out\ \-G\ rsa
-\f
+echo \dq12345678\dq | tpm2 makecredential \-Q \-u ek.pem \-s \- \-n $loaded_key_name \rs
+\-o mkcred.out \-G rsa
+\fR
 .fi
 .SH Returns
 .PP
@@ -263,4 +272,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_nvcertify.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_nvcertify.1 Changed

@@ -1,37 +1,37 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_nvcertify" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_nvcertify\f(1) \- Provides attestation of the contents of an
-NV index.
+\fBtpm2_nvcertify\fR(1) \- Provides attestation of the contents of
+an NV index.
 .SH SYNOPSIS
 .PP
-\fBtpm2_nvcertify\f \fIOPTIONS\f \fIARGUMENTS\f
+\fBtpm2_nvcertify\fR \fIOPTIONS\fR \fIARGUMENTS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_nvcertify\f(1) \- Provides attestation of the contents of an
-NV index.
+\fBtpm2_nvcertify\fR(1) \- Provides attestation of the contents of
+an NV index.
 NOTE: As part of the attestation output, the NV index contents are
 revealed.
 .SH OPTIONS
 .PP
 These options control the certification:
 .IP \bu 2
-\fB\-C\f, \fB\-\-signingkey\-context\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-signingkey\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The key object that signs the attestation structure.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-signingkey\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-signingkey\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value provided for the object specified with \-C.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-nvauthobj\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-nvauthobj\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The object that is the authorization handle for the NV object.
@@ -40,37 +40,37 @@
 If not specified it defaults to the NV index handle.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-nvauthobj\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-nvauthobj\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value provided for the object specified with \-c.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm to use in signature generation.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-scheme\f=\fIALGORITHM\f:
+\fB\-s\fR, \fB\-\-scheme\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The signing scheme used to sign the attestation data.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-format\f=\fIFORMAT\f:
+\fB\-f\fR, \fB\-\-format\fR=\fIFORMAT\fR:
 .RS 2
 .PP
 Format selection for the signature output file.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-signature\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-signature\fR=\fIFILE\fR:
 .RS 2
 .PP
 Output file name for the signature data.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-qualification\f=\fIFILE_OR_HEX_STR\f:
+\fB\-q\fR, \fB\-\-qualification\fR=\fIFILE_OR_HEX_STR\fR:
 .RS 2
 .PP
 Optional, the policy qualifier data that the signer can choose to
@@ -78,7 +78,7 @@
 Can be either a hex string or path.
 .RE
 .IP \bu 2
-\fB\-\-size\f=\fINATURAL_NUMBER\f:
+\fB\-\-size\fR=\fINATURAL_NUMBER\fR:
 .RS 2
 .PP
 Specifies the size of data to be read in bytes, starting from 0 if
@@ -87,40 +87,69 @@
 of the index will be used.
 .RE
 .IP \bu 2
-\fB\-\-offset\f=\fINATURAL_NUMBER\f:
+\fB\-\-offset\fR=\fINATURAL_NUMBER\fR:
 .RS 2
 .PP
 The offset within the NV index to start reading from.
 .RE
 .IP \bu 2
-\fB\-\-attestation\f=\fIFILE\f:
+\fB\enattestation\fR=\fIFILE\fR:
 .RS 2
 .PP
 The attestation data of the type TPM2_CREATION_INFO signed with signing
 key.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash unless rphash is also required.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the NV index or
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
+.RE
+.IP \bu 2
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
+.RS 2
+.PP
+The name of the NV index that must be provided when only calculating the
+cpHash without actually dispatching the command to the TPM.
+.RE
+.IP \bu 2
+\fB\-signer\-name\fR=\fIFILE\fR:
+.RS 2
+.PP
+The name of the signing key that must be provided when only calculating
+the cpHash without actually dispatching the command to the TPM.
+.RE
+.IP \bu 2
+\fBARGUMENT\fR the command line argument specifies the NV index or
 offset number.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -133,8 +162,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -143,45 +171,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -189,69 +217,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -260,13 +290,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -277,7 +307,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -288,6 +318,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -321,6 +353,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -348,7 +382,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -357,27 +391,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -385,21 +427,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -412,6 +456,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -424,59 +470,59 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH Signature Format Specifiers
 .PP
 Format selection for the signature output file.
-\fBtss\f (the default) will output a binary blob according to the
+\fBtss\fR (the default) will output a binary blob according to the
 TPM 2.0 specification and any potential compiler padding.
-The option \fBplain\f will output the plain signature data as
+The option \fBplain\fR will output the plain signature data as
 defined by the used cryptographic algorithm.
-signature \fIFORMAT\f.
+signature \fIFORMAT\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -484,18 +530,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -512,104 +558,111 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_nvdefine\ \-s\ 32\ \-a\ "authread|authwrite"\ 1
+tpm2_nvdefine \-s 32 \-a \dqauthread|authwrite\dq 1
 
-dd\ if=/dev/urandom\ bs=1\ count=32\ status=none|\ \\
-tpm2_nvwrite\ 1\ \-i\-
+dd if=/dev/urandom bs=1 count=32 status=none| \rs
+tpm2_nvwrite 1 \-i\-
 
-tpm2_createprimary\ \-C\ o\ \-c\ primary.ctx\ \-Q
+tpm2_createprimary \-C o \-c primary.ctx \-Q
 
-tpm2_create\ \-G\ rsa\ \-u\ rsa.pub\ \-r\ rsa.priv\ \-C\ primary.ctx\ \-c\ signing_key.ctx\ \-Q
+tpm2_create \-G rsa \-u rsa.pub \-r rsa.priv \-C primary.ctx \-c signing_key.ctx \-Q
 
-tpm2_readpublic\ \-c\ signing_key.ctx\ \-f\ pem\ \-o\ sslpub.pem\ \-Q
+tpm2_readpublic \-c signing_key.ctx \-f pem \-o sslpub.pem \-Q
 
-tpm2_nvcertify\ \-C\ signing_key.ctx\ \-g\ sha256\ \-f\ plain\ \-s\ rsassa\ \\
-\-o\ signature.bin\ \-\-attestation\ attestation.bin\ \-\-size\ 32\ 1
-\f
+tpm2_nvcertify \-C signing_key.ctx \-g sha256 \-f plain \-s rsassa \rs
+\-o signature.bin \-\-attestation attestation.bin \-\-size 32 1
+\fR
 .fi
 .SH Returns
 .PP
@@ -632,4 +685,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_nvdefine.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_nvdefine.1 Changed

@@ -1,52 +1,61 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_nvdefine" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_nvdefine\f(1) \- Define a TPM Non\-Volatile (NV) index.
+\fBtpm2_nvdefine\fR(1) \- Define a TPM Non\-Volatile (NV) index.
 .SH SYNOPSIS
 .PP
-\fBtpm2_nvdefine\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_nvdefine\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_nvdefine\f(1) \- Define an NV index with given auth value.
+\fBtpm2_nvdefine\fR(1) \- Define an NV index with given auth value.
 The index is specified as an argument.
 It can be specified as raw handle or an offset value to the nv handle
-range "TPM2_HR_NV_INDEX".
-If an index isn\aqt specified, the tool uses the first free index.
+range \lqTPM2_HR_NV_INDEX\rq.
+If an index isn\cqt specified, the tool uses the first free index.
 The tool outputs the nv index defined on success.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specifies the handle used to authorize.
-Defaults to \fBo\f, \fBTPM_RH_OWNER\f, when no value has been
+Defaults to \fBo\fR, \fBTPM_RH_OWNER\fR, when no value has been
 specified.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a hierarchy handle or nv\-index may be
+\fB\fCB<num>\fB\fR where a hierarchy handle or nv\-index may be
 used.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-size\f=\fINATURAL_NUMBER\f:
+\fB\-s\fR, \fB\-\-size\fR=\fINATURAL_NUMBER\fR:
 .RS 2
 .PP
 Specifies the size of data area in bytes.
-Defaults to \fBMAX_NV_INDEX_SIZE\f which is typically 2048.
+Defaults to \fBMAX_NV_INDEX_SIZE\fR which is typically 2048.
 .RE
 .IP \bu 2
-\fB\-a\f, \fB\-\-attributes\f=\fIATTRIBUTES\f
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
+.RS 2
+.PP
+The hash algorithm used to compute the name of the Index and used for
+the authorization policy.
+If the index is an extend index, the hash algorithm is used for the
+extend.
+.RE
+.IP \bu 2
+\fB\-a\fR, \fB\-\-attributes\fR=\fIATTRIBUTES\fR
 .RS 2
 .PP
 Specifies the attribute values for the nv region used when creating the
 entity.
-Either the raw bitfield mask or "nice\-names" may be used.
-See section "NV Attributes" for more details.
+Either the raw bitfield mask or \lqnice\-names\rq may be used.
+See section \lqNV Attributes\rq for more details.
 If not specified, the attributes default to various selections based on
 the hierarchy the index is defined in.
 For the owner hiearchy the defaults are:
@@ -60,62 +69,79 @@
 .IP \bu 2
 TPMA_NV_PPREAD
 If a policy file is specified, the hiearchy chosen default attributes
-are bitwise or\aqd with:
+are bitwise or\cqd with:
 .IP \bu 2
 TPMA_NV_POLICYWRITE
 .IP \bu 2
 TPMA_NV_POLICYREAD
-If a policy file is \fBNOT\f specified, the hiearchy chosen default
-attributes are bitwise or\aqd with:
+If a policy file is \fBNOT\fR specified, the hiearchy chosen default
+attributes are bitwise or\cqd with:
 .IP \bu 2
 TPMA_NV_AUTHWRITE
 .IP \bu 2
 TPMA_NV_AUTHREAD
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-hierarchy\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-hierarchy\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
-Authorization values should follow the "authorization formatting
-standards", see section "Authorization Formatting".
+Authorization values should follow the \lqauthorization formatting
+standards\rq, see section \lqAuthorization Formatting\rq.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-index\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-index\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the password of NV Index when created.
-HMAC and Password authorization values should follow the "authorization
-formatting standards", see section "Authorization Formatting".
+HMAC and Password authorization values should follow the
+\lqauthorization formatting standards\rq, see section
+\lqAuthorization Formatting\rq.
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specifies the policy digest file for policy based authorizations.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash, unless rphash is also required.
+.RE
+.IP \bu 2
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+Multiple of these can be specified.
+For example, you can have one session for auditing and another for
+encryption/decryption of the parameters.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the NV index or
+\fBARGUMENT\fR the command line argument specifies the NV index or
 offset number.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -128,8 +154,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -138,45 +163,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -184,69 +209,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -255,62 +282,63 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Object Attributes
 .PP
 Object Attributes are used to control various properties of created
 objects.
 When specified as an option, either the raw bitfield mask or
-"nice\-names" may be used.
+\lqnice\-names\rq may be used.
 The values can be found in Table 31 Part 2 of the TPM2.0 specification,
 which can be found here:
 .PP
 <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf>
 .PP
 Nice names are calculated by taking the name field of table 31 and
-removing the prefix \fBTPMA_OBJECT_\f and lowercasing the result.
-Thus, \fBTPMA_OBJECT_FIXEDTPM\f becomes fixedtpm.
-Nice names can be joined using the bitwise or "|" symbol.
+removing the prefix \fBTPMA_OBJECT_\fR and lowercasing the result.
+Thus, \fBTPMA_OBJECT_FIXEDTPM\fR becomes fixedtpm.
+Nice names can be joined using the bitwise or \lq|\rq symbol.
 .PP
-For instance, to set The fields \fBTPMA_OBJECT_FIXEDTPM\f,
-\fBTPMA_OBJECT_NODA\f, and \fBTPMA_OBJECT_SIGN_ENCRYPT\f, the
+For instance, to set The fields \fBTPMA_OBJECT_FIXEDTPM\fR,
+\fBTPMA_OBJECT_NODA\fR, and \fBTPMA_OBJECT_SIGN_ENCRYPT\fR, the
 argument would be:
 .PP
-\fBfixedtpm|noda|sign\f specifying the nv attributes
-\fIATTRIBUTES\f.
+\fBfixedtpm|noda|sign\fR specifying the nv attributes
+\fIATTRIBUTES\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -318,18 +346,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -346,94 +374,101 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_nvdefine\ \ \ 0x1500016\ \-C\ o\ \-s\ 32\ \-a\ 0x2000A
+tpm2_nvdefine   0x1500016 \-C o \-s 32 \-a 0x2000A
 
-tpm2_nvdefine\ \ \ 0x1500016\ \-C\ o\ \-s\ 32\ \-a\ ownerread|ownerwrite|policywrite\ \-p\ 1a1b
-\f
+tpm2_nvdefine   0x1500016 \-C o \-s 32 \-a ownerread|ownerwrite|policywrite \-p 1a1b
+\fR
 .fi
 .SH Returns
 .PP
@@ -456,4 +491,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_nvextend.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_nvextend.1 Changed

@@ -1,75 +1,98 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_nvextend" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_nvextend\f(1) \- Extend an Non\-Volatile (NV) index like it
+\fBtpm2_nvextend\fR(1) \- Extend an Non\-Volatile (NV) index like it
 was a PCR.
 .SH SYNOPSIS
 .PP
-\fBtpm2_nvextend\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_nvextend\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_nvextend\f(1) \- Extend an Non\-Volatile (NV) index like it
+\fBtpm2_nvextend\fR(1) \- Extend an Non\-Volatile (NV) index like it
 was a PCR.
-The NV index must be of type "extend" which is specified via the "nt"
-field when creating the NV space with tpm2_nvdefine(1).
+The NV index must be of type \lqextend\rq which is specified via the
+\lqnt\rq field when creating the NV space with tpm2_nvdefine(1).
 The index can be specified as raw handle or an offset value to the NV
-handle range "TPM2_HR_NV_INDEX" as an argument.
+handle range \lqTPM2_HR_NV_INDEX\rq as an argument.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specifies the hierarchy used to authorize.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a hierarchy handle or nv\-index may be
+\fB\fCB<num>\fB\fR where a hierarchy handle or nv\-index may be
 used.
 .PP
-When \fB\-C\f isn\aqt explicitly passed the index handle will be
+When \fB\-C\fR isn\cqt explicitly passed the index handle will be
 used to authorize against the index.
-The index auth value is set via the \fB\-p\f option to
-\fBtpm2_nvdefine\f(1).
+The index auth value is set via the \fB\-p\fR option to
+\fBtpm2_nvdefine\fR(1).
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-input\f=\fIFILE\f:
+\fB\-i\fR, \fB\-\-input\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specifies the input file with data to extend to the NV index.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash, unless rphash is also required.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the NV index or
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+Multiple of these can be specified.
+For example, you can have one session for auditing and another for
+encryption/decryption of the parameters.
+.RE
+.IP \bu 2
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
+.RS 2
+.PP
+The name of the NV index that must be provided when only calculating the
+cpHash without actually dispatching the command to the TPM.
+.RE
+.IP \bu 2
+\fBARGUMENT\fR the command line argument specifies the NV index or
 offset number.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -82,8 +105,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -92,45 +114,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -138,69 +160,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -209,40 +233,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -250,18 +275,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -278,98 +303,105 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
-.SS OR 0xbadc0de into an index of 0\aqs
+.SS OR 0xbadc0de into an index of 0\cqs
 .IP
 .nf
 \fC
-tpm2_nvdefine\ \-C\ o\ \-a\ "nt=extend|ownerread|policywrite|ownerwrite|writedefine"\ 1
+tpm2_nvdefine \-C o \-a \dqnt=extend|ownerread|policywrite|ownerwrite|writedefine\dq 1
 
-echo\ \aqmy\ data\aq\ |\ tpm2_nvextend\ \-C\ o\ \-i\-\ 1
+echo \aqmy data\aq | tpm2_nvextend \-C o \-i\- 1
 
-tpm2_nvread\ \-C\ o\ 1\ |\ xxd\ \-p\ \-c32
+tpm2_nvread \-C o 1 | xxd \-p \-c32
 db7472e3fe3309b011ec11565bce4ea6668cc8ecdef7e6fdcda5206687af3f43
-\f
+\fR
 .fi
 .SH Returns
 .PP
@@ -392,4 +424,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_nvincrement.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_nvincrement.1 Changed

@@ -1,67 +1,89 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_nvincrement" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_nvincrement\f(1) \- Increment counter in a Non\-Volatile
+\fBtpm2_nvincrement\fR(1) \- Increment counter in a Non\-Volatile
 (NV) index.
 .SH SYNOPSIS
 .PP
-\fBtpm2_nvincrement\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_nvincrement\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_nvincrement\f(1) \- Increment value of a Non\-Volatile (NV)
+\fBtpm2_nvincrement\fR(1) \- Increment value of a Non\-Volatile (NV)
 index setup as a counter.
 The index can be specified as raw handle or an offset value to the nv
-handle range "TPM2_HR_NV_INDEX".
+handle range \lqTPM2_HR_NV_INDEX\rq.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specifies the hierarchy used to authorize.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a hierarchy handle or nv\-index may be
+\fB\fCB<num>\fB\fR where a hierarchy handle or nv\-index may be
 used.
 .PP
-When \fB\-C\f isn\aqt explicitly passed the index handle will be
+When \fB\-C\fR isn\cqt explicitly passed the index handle will be
 used to authorize against the index.
-The index auth value is set via the \fB\-p\f option to
-\fBtpm2_nvdefine\f(1).
+The index auth value is set via the \fB\-p\fR option to
+\fBtpm2_nvdefine\fR(1).
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash unless rphash is also required.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the NV index or
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
+.RE
+.IP \bu 2
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
+.RS 2
+.PP
+The name of the NV index that must be provided when only calculating the
+cpHash without actually dispatching the command to the TPM.
+.RE
+.IP \bu 2
+\fBARGUMENT\fR the command line argument specifies the NV index or
 offset number.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -74,8 +96,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -84,45 +105,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -130,69 +151,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -201,40 +224,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -242,18 +266,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -270,97 +294,104 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
-.SS To increment the counter at index \fI0x150016\f
+.SS To increment the counter at index \fI0x150016\fR
 .IP
 .nf
 \fC
-tpm2_nvdefine\ \-C\ o\ \-s\ 8\ \-a\ "ownerread|authread|authwrite|nt=1"\ 0x1500016\ \-p\ index
+tpm2_nvdefine \-C o \-s 8 \-a \dqownerread|authread|authwrite|nt=1\dq 0x1500016 \-p index
 
-tpm2_nvincrement\ \-C\ 0x1500016\ \ 0x1500016\ \-P\ "index"
+tpm2_nvincrement \-C 0x1500016  0x1500016 \-P \dqindex\dq
 
-tpm2_nvread\ 0x1500016\ \-P\ index\ |\ xxd\ \-p
-\f
+tpm2_nvread 0x1500016 \-P index | xxd \-p
+\fR
 .fi
 .SH Returns
 .PP
@@ -383,4 +414,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_nvread.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_nvread.1 Changed

@@ -1,53 +1,53 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_nvread" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_nvread\f(1) \- Read the data stored in a Non\-Volatile (NV)s
-index.
+\fBtpm2_nvread\fR(1) \- Read the data stored in a Non\-Volatile
+(NV)s index.
 .SH SYNOPSIS
 .PP
-\fBtpm2_nvread\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_nvread\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_nvread\f(1) \- Read the data stored in a Non\-Volatile (NV)s
-index.
+\fBtpm2_nvread\fR(1) \- Read the data stored in a Non\-Volatile
+(NV)s index.
 The index can be specified as raw handle or an offset value to the nv
-handle range "TPM2_HR_NV_INDEX".
+handle range \lqTPM2_HR_NV_INDEX\rq.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specifies the hierarchy used to authorize.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a hierarchy handle or nv\-index may be
+\fB\fCB<num>\fB\fR where a hierarchy handle or nv\-index may be
 used.
 .PP
-When \fB\-C\f isn\aqt explicitly passed the index handle will be
+When \fB\-C\fR isn\cqt explicitly passed the index handle will be
 used to authorize against the index.
-The index auth value is set via the \fB\-p\f option to
-\fBtpm2_nvdefine\f(1).
+The index auth value is set via the \fB\-p\fR option to
+\fBtpm2_nvdefine\fR(1).
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to write data
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-size\f=\fINATURAL_NUMBER\f:
+\fB\-s\fR, \fB\-\-size\fR=\fINATURAL_NUMBER\fR:
 .RS 2
 .PP
 Specifies the size of data to be read in bytes, starting from 0 if
@@ -56,33 +56,63 @@
 of the index will be used.
 .RE
 .IP \bu 2
-\fB\-\-offset\f=\fINATURAL_NUMBER\f:
+\fB\-\-offset\fR=\fINATURAL_NUMBER\fR:
 .RS 2
 .PP
 The offset within the NV index to start reading from.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash, unless rphash is also required.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the NV index or
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
+.RS 2
+.PP
+The name of the NV index that must be provided when only calculating the
+cpHash without actually dispatching the command to the TPM.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
+.RE
+.IP \bu 2
+\fB\-\-print\-yaml\fR:
+.RS 2
+.PP
+Output the content of the NV index in a human readable format, useful
+for displaying the content of counter, bits and extend and pin indices.
+When this argument is provided size and offset is ignored.
+.RE
+.IP \bu 2
+\fBARGUMENT\fR the command line argument specifies the NV index or
 offset number.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -95,8 +125,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -105,45 +134,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -151,69 +180,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -222,40 +253,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -263,18 +295,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -291,84 +323,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.d)
 .RE
 .SH EXAMPLES
@@ -376,14 +415,14 @@
 .IP
 .nf
 \fC
-tpm2_nvdefine\ \-C\ o\ \-s\ 32\ \-a\ "ownerread|policywrite|ownerwrite"\ 1
+tpm2_nvdefine \-C o \-s 32 \-a \dqownerread|policywrite|ownerwrite\dq 1
 
-echo\ "please123abc"\ >\ nv.dat
+echo \dqplease123abc\dq > nv.dat
 
-tpm2_nvwrite\ \-C\ o\ \-i\ nv.dat\ 1
+tpm2_nvwrite \-C o \-i nv.dat 1
 
-tpm2_nvread\ \-C\ o\ \-s\ 32\ 1
-\f
+tpm2_nvread \-C o \-s 32 1
+\fR
 .fi
 .SH Returns
 .PP
@@ -406,4 +445,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_nvreadlock.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_nvreadlock.1 Changed

@@ -1,69 +1,91 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_nvreadlock" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_nvreadlock\f(1) \- Lock the Non\-Volatile (NV) index for
+\fBtpm2_nvreadlock\fR(1) \- Lock the Non\-Volatile (NV) index for
 further reads.
 .SH SYNOPSIS
 .PP
-\fBtpm2_nvreadlock\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_nvreadlock\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_nvreadlock\f(1) \- Lock the Non\-Volatile (NV) index for
+\fBtpm2_nvreadlock\fR(1) \- Lock the Non\-Volatile (NV) index for
 further reads.
 The lock on the NN index is unlocked when the TPM is restarted and the
 NV index becomes readable again.
 The index can be specified as raw handle or an offset value to the nv
-handle range "TPM2_HR_NV_INDEX".
+handle range \lqTPM2_HR_NV_INDEX\rq.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specifies the hierarchy used to authorize.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a hierarchy handle or nv\-index may be
+\fB\fCB<num>\fB\fR where a hierarchy handle or nv\-index may be
 used.
 .PP
-When \fB\-C\f isn\aqt explicitly passed the index handle will be
+When \fB\-C\fR isn\cqt explicitly passed the index handle will be
 used to authorize against the index.
-The index auth value is set via the \fB\-p\f option to
-\fBtpm2_nvdefine\f(1).
+The index auth value is set via the \fB\-p\fR option to
+\fBtpm2_nvdefine\fR(1).
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash unless rphash is also required.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the NV index or
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
+.RE
+.IP \bu 2
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
+.RS 2
+.PP
+The name of the NV index that must be provided when only calculating the
+cpHash without actually dispatching the command to the TPM.
+.RE
+.IP \bu 2
+\fBARGUMENT\fR the command line argument specifies the NV index or
 offset number.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -76,8 +98,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -86,45 +107,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -132,69 +153,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -203,40 +226,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -244,18 +268,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -272,84 +296,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -357,17 +388,17 @@
 .IP
 .nf
 \fC
-tpm2_nvdefine\ \-Q\ \ \ 1\ \-C\ o\ \-s\ 32\ \\
-\-a\ "ownerread|policywrite|ownerwrite|read_stclear"
+tpm2_nvdefine \-Q   1 \-C o \-s 32 \rs
+\-a \dqownerread|policywrite|ownerwrite|read_stclear\dq
 
-echo\ "foobar"\ >\ nv.readlock
+echo \dqfoobar\dq > nv.readlock
 
-tpm2_nvwrite\ \-Q\ \ \ 0x01000001\ \-C\ o\ \-i\ nv.readlock
+tpm2_nvwrite \-Q   0x01000001 \-C o \-i nv.readlock
 
-tpm2_nvread\ \-Q\ \ \ 1\ \-C\ o\ \-s\ 6\ \-o\ 0
+tpm2_nvread \-Q   1 \-C o \-s 6 \-o 0
 
-tpm2_nvreadlock\ \-Q\ \ \ 1\ \-C\ o
-\f
+tpm2_nvreadlock \-Q   1 \-C o
+\fR
 .fi
 .SH Returns
 .PP
@@ -390,4 +421,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_nvreadpublic.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_nvreadpublic.1 Changed

@@ -1,18 +1,18 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_nvreadpublic" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_nvreadpublic\f(1) \- Display all defined Non\-Volatile (NV)s
-indices.
+\fBtpm2_nvreadpublic\fR(1) \- Display all defined Non\-Volatile
+(NV)s indices.
 .SH SYNOPSIS
 .PP
-\fBtpm2_nvreadpublic\f \fIOPTIONS\f
+\fBtpm2_nvreadpublic\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_nvreadpublic\f(1) \- Display all defined Non\-Volatile (NV)s
-indices to stdout in a YAML format.
+\fBtpm2_nvreadpublic\fR(1) \- Display all defined Non\-Volatile
+(NV)s indices to stdout in a YAML format.
 .PP
 Display metadata for all defined NV indices.
 Metadata includes:
@@ -23,67 +23,112 @@
 .IP \bu 2
 The auth policy.
 .IP \bu 2
-The NV attributes as defined in section "NV Attributes".
+The NV attributes as defined in section \lqNV Attributes\rq.
 .SS Example Output
+.IP
+.nf
+\fC
+0x1500015:
+  hash algorithm:
+    friendly: sha256
+    value: 0xB
+  attributes:
+    friendly: ownerwrite|ownerread
+    value: 0x2000200
+  size: 32
+  authorization policy:
+
+0x1500017:
+  hash algorithm:
+    friendly: sha256
+    value: 0xB
+  attributes:
+    friendly: ownerwrite|ownerread
+    value: 0x2000200
+  size: 32
+  authorization policy:
+\fR
+.fi
+.SH OPTIONS
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
 .PP
-``` 0x1500015: hash algorithm: friendly: sha256 value: 0xB attributes:
-friendly: ownerwrite|ownerread value: 0x2000200 size: 32 authorization
-policy:
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash unless rphash is also required.
+.RE
+.IP \bu 2
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
 .PP
-0x1500017: hash algorithm: friendly: sha256 value: 0xB attributes:
-friendly: ownerwrite|ownerread value: 0x2000200 size: 32 authorization
-policy: ```
-.SH OPTIONS
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIPOLICY_SESSION\fR:
+.RS 2
 .PP
-This tool takes no tool specific options.
+Specify an auxiliary session for auditing and or encryption/decryption
+of the parameters.
+.RE
+.IP \bu 2
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
+.RS 2
+.PP
+The name of the NV index that must be provided when only calculating the
+cpHash without actually dispatching the command to the TPM.
+.RE
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
 Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -100,113 +145,123 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 .RE
 .SH NV Attributes
 .PP
 NV Attributes are used to control various properties of the NV defined
 space.
 When specified as an option, either the raw bitfield mask or
-"nice\-names" may be used.
+\lqnice\-names\rq may be used.
 The values can be found in Table 204 Part 2 of the TPM2.0 specification,
 which can be found here:
 .PP
 <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf>
 .PP
 Nice names are calculated by taking the name field of table 204 and
-removing the prefix \fBTPMA_NV_\f and lowercasing the result.
-Thus, \fBTPMA_NV_PPWRITE\f becomes ppwrite.
-Nice names can be joined using the bitwise or "|" symbol.
+removing the prefix \fBTPMA_NV_\fR and lowercasing the result.
+Thus, \fBTPMA_NV_PPWRITE\fR becomes ppwrite.
+Nice names can be joined using the bitwise or \lq|\rq symbol.
 .PP
-Note that the \fBTPM_NT\f field is 4 bits wide, and thus can be set
-via \fBnt=\f format.
-For instance, to set The fields \fBTPMA_NV_OWNERREAD\f,
-\fBTPMA_NV_OWNERWRITE\f, \fBTPMA_NV_POLICYWRITE\f, and
-\fBTPMA_NT = 0x2\f, the argument would be:
+Note that the \fBTPM_NT\fR field is 4 bits wide, and thus can be set
+via \fBnt=\fR format.
+For instance, to set The fields \fBTPMA_NV_OWNERREAD\fR,
+\fBTPMA_NV_OWNERWRITE\fR, \fBTPMA_NV_POLICYWRITE\fR, and
+\fBTPMA_NT = 0x2\fR, the argument would be:
 .PP
-\fBownerread|ownerwrite|policywrite|nt=0x2\f
+\fBownerread|ownerwrite|policywrite|nt=0x2\fR
 .PP
 Additionally, the NT field, which denotes the type of the NV index, can
 also be specified via friendly names: * ordinary \- Ordinary contains
 data that is opaque to the TPM that can only be modified using
 TPM2_NV_Write.
+* extend \- Extend is used similarly to a PCR and can only be modified
+with TPM2_NV_Extend.
+Its size is determined by the length of the hash algorithm used.
 * counter \- Counter contains an 8\-octet value that is to be used as a
 counter and can only be modified with TPM2_NV_Increment * bits \- Bit
 Field contains an 8\-octet value to be used as a bit field and can only
@@ -216,18 +271,18 @@
 * pinpass \- PIN Pass contains an 8\-octet pinCount that increments on a
 PIN authorization success and a pinLimit.
 .PP
-For instance, to set The fields \fBTPMA_NV_OWNERREAD\f,
-\fBTPMA_NV_OWNERWRITE\f, \fBTPMA_NV_POLICYWRITE\f, and
-\fBTPMA_NT = bits\f, the argument would be:
+For instance, to set The fields \fBTPMA_NV_OWNERREAD\fR,
+\fBTPMA_NV_OWNERWRITE\fR, \fBTPMA_NV_POLICYWRITE\fR, and
+\fBTPMA_NT = bits\fR, the argument would be:
 .PP
-\fBownerread|ownerwrite|policywrite|nt=bits\f
+\fBownerread|ownerwrite|policywrite|nt=bits\fR
 .SH EXAMPLES
 .SS List the defined NV indices to stdout
 .IP
 .nf
 \fC
 tpm2_nvreadpublic
-\f
+\fR
 .fi
 .SH Returns
 .PP
@@ -250,4 +305,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_nvsetbits.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_nvsetbits.1 Changed

@@ -1,74 +1,98 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_nvsetbits" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_nvsetbits\f(1) \- Bitwise OR bits into a Non\-Volatile (NV).
+\fBtpm2_nvsetbits\fR(1) \- Bitwise OR bits into a Non\-Volatile
+(NV).
 .SH SYNOPSIS
 .PP
-\fBtpm2_nvsetbits\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_nvsetbits\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_nvsetbits\f(1) \- Bitwise OR bits into a Non\-Volatile (NV).
-The NV index must be of type "bits" which is specified via the "nt"
-field when creating the NV space with tpm2_nvdefine(1).
+\fBtpm2_nvsetbits\fR(1) \- Bitwise OR bits into a Non\-Volatile
+(NV).
+The NV index must be of type \lqbits\rq which is specified via the
+\lqnt\rq field when creating the NV space with tpm2_nvdefine(1).
 The index can be specified as raw handle or an offset value to the NV
-handle range "TPM2_HR_NV_INDEX".
+handle range \lqTPM2_HR_NV_INDEX\rq.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specifies the hierarchy used to authorize.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a hierarchy handle or nv\-index may be
+\fB\fCB<num>\fB\fR where a hierarchy handle or nv\-index may be
 used.
 .PP
-When \fB\-C\f isn\aqt explicitly passed the index handle will be
+When \fB\-C\fR isn\cqt explicitly passed the index handle will be
 used to authorize against the index.
-The index auth value is set via the \fB\-p\f option to
-\fBtpm2_nvdefine\f(1).
+The index auth value is set via the \fB\-p\fR option to
+\fBtpm2_nvdefine\fR(1).
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-bits\f=\fIBITS\f:
+\fB\-i\fR, \fB\-\-bits\fR=\fIBITS\fR:
 .RS 2
 .PP
 Specifies the bit value as a number to bitwise OR into the current value
 of the NV index.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash, unless rphash is also required.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the NV index or
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
+.RE
+.IP \bu 2
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
+.RS 2
+.PP
+The name of the NV index that must be provided when only calculating the
+cpHash without actually dispatching the command to the TPM.
+.RE
+.IP \bu 2
+\fBARGUMENT\fR the command line argument specifies the NV index or
 offset number.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -81,8 +105,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -91,45 +114,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -137,69 +160,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -208,40 +233,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -249,18 +275,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -277,98 +303,105 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
-.SS OR 0xbadc0de into an index of 0\aqs
+.SS OR 0xbadc0de into an index of 0\cqs
 .IP
 .nf
 \fC
-tpm2_nvdefine\ \-C\ o\ \-a\ "nt=bits|ownerread|policywrite|ownerwrite|writedefine"\ 1
+tpm2_nvdefine \-C o \-a \dqnt=bits|ownerread|policywrite|ownerwrite|writedefine\dq 1
 
-tpm2_nvsetbits\ \-C\ o\ \-i\ 0xbadc0de\ 1
+tpm2_nvsetbits \-C o \-i 0xbadc0de 1
 
-tpm2_nvread\ \-C\ o\ 1\ |\ xxd\ \-p\ |\ sed\ s/\aq^0*\aq/0x/
+tpm2_nvread \-C o 1 | xxd \-p | sed s/\aq\ha0*\aq/0x/
 0xbadc0de
-\f
+\fR
 .fi
 .SH Returns
 .PP
@@ -391,4 +424,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_nvundefine.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_nvundefine.1 Changed

@@ -1,75 +1,110 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_nvundefine" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_nvundefine\f(1) \- Delete a Non\-Volatile (NV) index.
+\fBtpm2_nvundefine\fR(1) \- Delete a Non\-Volatile (NV) index.
 .SH SYNOPSIS
 .PP
-\fBtpm2_nvundefine\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_nvundefine\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_nvundefine\f(1) \- Deletes a Non\-Volatile (NV) index that
-was previously defined with \fBtpm2_nvdefine\f(1).
+\fBtpm2_nvundefine\fR(1) \- Deletes a Non\-Volatile (NV) index that
+was previously defined with \fBtpm2_nvdefine\fR(1).
 The index is specified as an argument.
 It can be specified as raw handle or an offset value to the nv handle
-range "TPM2_HR_NV_INDEX".
+range \lqTPM2_HR_NV_INDEX\rq.
 .PP
 The tool is also capable of deleting NV indices with attribute
-\fCTPMA_NV_POLICY_DELETE\f, and the tool uses this attribute for the
-default hierarchy to select when \fC\-C\f is missing.
-The default value for \fC\-C\f is the "owner" hierarchy when
-\fCTPMA_NV_POLICY_DELETE\f is clear and "platform" when
-\fCTPMA_NV_POLICY_DELETE\f is set.
+\fCTPMA_NV_POLICY_DELETE\fR, and the tool uses this attribute for
+the default hierarchy to select when \fC\-C\fR is missing.
+The default value for \fC\-C\fR is the \lqowner\rq hierarchy
+when \fCTPMA_NV_POLICY_DELETE\fR is clear and \lqplatform\rq
+when \fCTPMA_NV_POLICY_DELETE\fR is set.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specifies the hierarchy used to authorize.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a hierarchy handle may be specified.
+\fB\fCB<num>\fB\fR where a hierarchy handle may be specified.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIPOLICY_SESSION\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIPOLICY_SESSION\fR:
 .RS 2
-.PP
 Specify a policy session to use when the NV index has attribute
-\fCTPMA_NV_POLICY_DELETE\f set.
+\fCTPMA_NV_POLICY_DELETE\fR set.
+This can also be used to specify an auxiliary session for auditing and
+or encryption/decryption of the parameters.
+Note:
+.IP "1." 3
+If TPM2_CC_NV_UndefineSpaceSpecial is invoked then only one additional
+aux session can be specified.
+The order of how sessions are specified also matters.
+First specification of \fC\-S\fR is interpreted as the session for
+satisfying the ADMIN role required for TPM2_CC_NV_UndefineSpaceSpecial.
+.IP "2." 3
+If TPM2_CC_NV_Undefine is invoked then only two additional aux sessions
+can be specified.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash, it simply returns a cpHash
+unless rphash is also required.
+.RE
+.IP \bu 2
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the NV index or
+\fB\-\-with\-policydelete\fR=\fINONE\fR
+.RS 2
+.PP
+This must be specified when calculating cpHash with
+\fB\-\-tcti=none\fR.
+This is a requirement because there is no way to know if the attribute
+TPMA_NV_POLICYDELETE has been set from the NV index name alone.
+.RE
+.IP \bu 2
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
+.RS 2
+.PP
+The name of the NV index that must be provided when only calculating the
+cpHash without actually dispatching the command to the TPM.
+.RE
+.IP \bu 2
+\fBARGUMENT\fR the command line argument specifies the NV index or
 offset number.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -82,8 +117,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -92,45 +126,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -138,69 +172,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -209,40 +245,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -250,18 +287,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -278,84 +315,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -363,36 +407,35 @@
 .IP
 .nf
 \fC
-tpm2_nvdefine\ 1
+tpm2_nvdefine 1
 
-tpm2_nvundefine\ 1
-\f
+tpm2_nvundefine 1
+\fR
 .fi
-.SS Define an ordinary NV index with attribute
-\fCTPMA_NV_POLICY_DELETE\f and delete it
+.SS Define an ordinary NV index with attribute \fCTPMA_NV_POLICY_DELETE\fR and delete it
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ s.ctx
+tpm2_startauthsession \-S s.ctx
 
-tpm2_policyauthvalue\ \-S\ s.ctx
+tpm2_policyauthvalue \-S s.ctx
 
-tpm2_policycommandcode\ \-S\ s.ctx\ \-L\ policy.dat\ TPM2_CC_NV_UndefineSpaceSpecial
+tpm2_policycommandcode \-S s.ctx \-L policy.dat TPM2_CC_NV_UndefineSpaceSpecial
 
-tpm2_nvdefine\ \-C\ p\ \-s\ 32\ \\
-\ \ \-a\ "ppread|ppwrite|authread|authwrite|platformcreate|policydelete|write_stclear|read_stclear"\ \\
-\ \ \-L\ policy.dat\ 1
+tpm2_nvdefine \-C p \-s 32 \rs
+  \-a \dqppread|ppwrite|authread|authwrite|platformcreate|policydelete|write_stclear|read_stclear\dq \rs
+  \-L policy.dat 1
 
-tpm2_flushcontext\ s.ctx
+tpm2_flushcontext s.ctx
 
-tpm2_startauthsession\ \-\-policy\-session\ \-S\ s.ctx
+tpm2_startauthsession \-\-policy\-session \-S s.ctx
 
-tpm2_policyauthvalue\ \-S\ s.ctx
+tpm2_policyauthvalue \-S s.ctx
 
-tpm2_policycommandcode\ \-S\ s.ctx\ TPM2_CC_NV_UndefineSpaceSpecial
+tpm2_policycommandcode \-S s.ctx TPM2_CC_NV_UndefineSpaceSpecial
 
-tpm2_nvundefine\ \-S\ s.ctx\ 1
-\f
+tpm2_nvundefine \-S s.ctx 1
+\fR
 .fi
 .SH Returns
 .PP
@@ -415,4 +458,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_nvwrite.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_nvwrite.1 Changed

@@ -1,23 +1,23 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_nvwrite" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_nvwrite\f(1) \- Write data to a Non\-Volatile (NV) index.
+\fBtpm2_nvwrite\fR(1) \- Write data to a Non\-Volatile (NV) index.
 .SH SYNOPSIS
 .PP
-\fBtpm2_nvwrite\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_nvwrite\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_nvwrite\f(1) \- Write data specified via \fIFILE\f to a
-Non\-Volatile (NV) index.
-If \fIFILE\f is not specified, it defaults to stdin.
+\fBtpm2_nvwrite\fR(1) \- Write data specified via \fIFILE\fR to
+a Non\-Volatile (NV) index.
+If \fIFILE\fR is not specified, it defaults to stdin.
 The index is specified as an argument and can be a raw handle or an
-offset value to the nv handle range "TPM2_HR_NV_INDEX".
+offset value to the nv handle range \lqTPM2_HR_NV_INDEX\rq.
 .SH OPTIONS
 .IP \bu 2
-\fBARGUMENT\f=\fINUMBER\f
+\fBARGUMENT\fR=\fINUMBER\fR
 .RS 2
 .PP
 Specify the NV index to write to as an offset to the starting NV index
@@ -25,60 +25,84 @@
 Example: tpm2_nvwrite 1 is same as tpm2_nvwrite 0x01000001
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-input\f=\fIFILE\f:
+\fB\-i\fR, \fB\-\-input\fR=\fIFILE\fR:
 .RS 2
 .PP
-Specifies the input file with data to write to NV.
+This is a mandatory input to specify the input file with data to write
+to NV.
+The input can also be specified from stdin with \fB\-i\-\fR option.
 .RE
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specifies the hierarchy used to authorize.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a hierarchy handle or nv\-index may be
+\fB\fCB<num>\fB\fR where a hierarchy handle or nv\-index may be
 used.
 .PP
-When \fB\-C\f isn\aqt explicitly passed the index handle will be
+When \fB\-C\fR isn\cqt explicitly passed the index handle will be
 used to authorize against the index.
-The index auth value is set via the \fB\-p\f option to
-\fBtpm2_nvdefine\f(1).
+The index auth value is set via the \fB\-p\fR option to
+\fBtpm2_nvdefine\fR(1).
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
 .RE
 .IP \bu 2
-\fB\-\-offset\f=\fINATURAL_NUMBER\f:
+\fB\-\-offset\fR=\fINATURAL_NUMBER\fR:
 .RS 2
 .PP
 The offset within the NV index to start writing at.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash unless rphash is also required.
+.RE
+.IP \bu 2
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
+.RE
+.IP \bu 2
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
+.RS 2
+.PP
+The name of the NV index that must be provided when only calculating the
+cpHash without actually dispatching the command to the TPM.
 .RE
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -91,8 +115,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -101,45 +124,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -147,69 +170,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -218,40 +243,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -259,18 +285,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -287,97 +313,104 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
-.SS Write the file nv.data to index \fI0x01000001\f
+.SS Write the file nv.data to index \fI0x01000001\fR
 .IP
 .nf
 \fC
-tpm2_nvdefine\ \-Q\ \ \ 1\ \-C\ o\ \-s\ 32\ \-a\ "ownerread|policywrite|ownerwrite"
+tpm2_nvdefine \-Q   1 \-C o \-s 32 \-a \dqownerread|policywrite|ownerwrite\dq
 
-echo\ "please123abc"\ >\ nv.test_w
+echo \dqplease123abc\dq > nv.test_w
 
-tpm2_nvwrite\ \-Q\ \ \ 1\ \-C\ o\ \-i\ nv.test_w
-\f
+tpm2_nvwrite \-Q   1 \-C o \-i nv.test_w
+\fR
 .fi
 .SH Returns
 .PP
@@ -400,4 +433,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_nvwritelock.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_nvwritelock.1 Changed

@@ -1,76 +1,98 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_nvwritelock" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_nvwritelock\f(1) \- Lock the Non\-Volatile (NV) index for
+\fBtpm2_nvwritelock\fR(1) \- Lock the Non\-Volatile (NV) index for
 further writes.
 .SH SYNOPSIS
 .PP
-\fBtpm2_nvwritelock\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_nvwritelock\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_nvwritelock\f(1) \- Lock the Non\-Volatile (NV) index for
+\fBtpm2_nvwritelock\fR(1) \- Lock the Non\-Volatile (NV) index for
 further writes.
 The lock on the NV index is unlocked when the TPM is restarted and the
 NV index becomes writable again.
 The index can be specified as raw handle or an offset value to the nv
-handle range "TPM2_HR_NV_INDEX".
+handle range \lqTPM2_HR_NV_INDEX\rq.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specifies the hierarchy used to authorize.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a hierarchy handle or nv\-index may be
+\fB\fCB<num>\fB\fR where a hierarchy handle or nv\-index may be
 used.
 .PP
-When \fB\-C\f isn\aqt explicitly passed the index handle will be
+When \fB\-C\fR isn\cqt explicitly passed the index handle will be
 used to authorize against the index.
-The index auth value is set via the \fB\-p\f option to
-\fBtpm2_nvdefine\f(1).
+The index auth value is set via the \fB\-p\fR option to
+\fBtpm2_nvdefine\fR(1).
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
 .RE
 .IP \bu 2
-\fB\-\-global\f:
+\fB\-\-global\fR:
 .RS 2
 .PP
 Lock all NV indices with attribute TPMA_NV_GLOBALLOCK.
 This option does not require an NV index or offset as an argument.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash unless rphash is also required.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the NV index or
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+This can be used to specify an auxiliary session for auditing and or
+encryption/decryption of the parameters.
+.RE
+.IP \bu 2
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
+.RS 2
+.PP
+The name of the NV index that must be provided when only calculating the
+cpHash without actually dispatching the command to the TPM.
+.RE
+.IP \bu 2
+\fBARGUMENT\fR the command line argument specifies the NV index or
 offset number.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -83,8 +105,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -93,45 +114,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -139,69 +160,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -210,40 +233,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -251,18 +275,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -279,84 +303,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -364,31 +395,31 @@
 .IP
 .nf
 \fC
-tpm2_nvdefine\ \-C\ o\ \-s\ 32\ \\
-\ \ \-a\ "ownerread|policywrite|ownerwrite|writedefine"\ 1
+tpm2_nvdefine \-C o \-s 32 \rs
+  \-a \dqownerread|policywrite|ownerwrite|writedefine\dq 1
 
-echo\ "foobar"\ >\ nv.writelock
+echo \dqfoobar\dq > nv.writelock
 
-tpm2_nvwrite\ \-C\ o\ \-i\ nv.writelock\ 1
+tpm2_nvwrite \-C o \-i nv.writelock 1
 
-tpm2_nvwritelock\ \-C\ o\ 1
+tpm2_nvwritelock \-C o 1
 
-#\ fails\ with\ "NV\ access\ locked"
-tpm2_nvwrite\ \-C\ o\ \-i\ nv.writelock\ 1
-\f
+# fails with \dqNV access locked\dq
+tpm2_nvwrite \-C o \-i nv.writelock 1
+\fR
 .fi
 .SS Global Lock
 .IP
 .nf
 \fC
-tpm2_nvdefine\ \-C\ o\ \-s\ 32\ \\
-\ \ \-a\ "ownerread|policywrite|ownerwrite|globallock"\ 1
+tpm2_nvdefine \-C o \-s 32 \rs
+  \-a \dqownerread|policywrite|ownerwrite|globallock\dq 1
 
-tpm2_nvwritelock\ \-C\ o\ \-\-global
+tpm2_nvwritelock \-C o \-\-global
 
-#\ this\ command\ fails\ with\ "NV\ access\ locked".
-echo\ foo\ |\ tpm2_nvwrite\ \-C\ o\ \-i\-\ 1
-\f
+# this command fails with \dqNV access locked\dq.
+echo foo | tpm2_nvwrite \-C o \-i\- 1
+\fR
 .fi
 .SH Returns
 .PP
@@ -411,4 +442,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_pcrallocate.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_pcrallocate.1 Changed

@@ -1,18 +1,18 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_pcrallocate" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_pcrallocate\f(1) \- Configure PCRs and bank algorithms.
+\fBtpm2_pcrallocate\fR(1) \- Configure PCRs and bank algorithms.
 .SH SYNOPSIS
 .PP
-\fBtpm2_pcrallocate\f \fIOPTIONS\f *ARGUMENT
+\fBtpm2_pcrallocate\fR \fIOPTIONS\fR *ARGUMENT
 .SH DESCRIPTION
 .PP
-\fBtpm2_pcrallocate\f(1) \- Allow the user to specify a PCR
+\fBtpm2_pcrallocate\fR(1) \- Allow the user to specify a PCR
 allocation for the TPM.
-An allocation is the enabling or disabling of PCRs and it\aqs banks.
+An allocation is the enabling or disabling of PCRs and it\cqs banks.
 A PCR can have multiple banks, where each bank is associated with a
 specific hashing algorithm.
 Allocation is specified in the argument.
@@ -22,33 +22,42 @@
 .PP
 Allocation is a list of banks and selected pcrs.
 The values should follow the pcr bank specifiers standards, see section
-"PCR Bank Specifiers".
+\lqPCR Bank Specifiers\rq.
 .PP
 The new allocations become effective after the next reboot.
 .PP
-\fBNote\f: This command requires platform authorization.
+\fBNote\fR: This command requires platform authorization.
 .SH OPTIONS
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Optional authorization value.
-Authorization values should follow the "authorization formatting
-standards", see section "Authorization Formatting".
+Authorization values should follow the \lqauthorization formatting
+standards\rq, see section \lqAuthorization Formatting\rq.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the PCR
+\fBARGUMENT\fR the command line argument specifies the PCR
 allocation.
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -61,8 +70,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -71,45 +79,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -117,69 +125,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -188,13 +198,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -205,7 +215,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -216,6 +226,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -249,6 +261,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -276,7 +290,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -285,27 +299,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -313,21 +335,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -340,6 +364,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -352,61 +378,60 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH Object Attributes
 .PP
 Object Attributes are used to control various properties of created
 objects.
 When specified as an option, either the raw bitfield mask or
-"nice\-names" may be used.
+\lqnice\-names\rq may be used.
 The values can be found in Table 31 Part 2 of the TPM2.0 specification,
 which can be found here:
 .PP
 <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf>
 .PP
 Nice names are calculated by taking the name field of table 31 and
-removing the prefix \fBTPMA_OBJECT_\f and lowercasing the result.
-Thus, \fBTPMA_OBJECT_FIXEDTPM\f becomes fixedtpm.
-Nice names can be joined using the bitwise or "|" symbol.
+removing the prefix \fBTPMA_OBJECT_\fR and lowercasing the result.
+Thus, \fBTPMA_OBJECT_FIXEDTPM\fR becomes fixedtpm.
+Nice names can be joined using the bitwise or \lq|\rq symbol.
 .PP
-For instance, to set The fields \fBTPMA_OBJECT_FIXEDTPM\f,
-\fBTPMA_OBJECT_NODA\f, and \fBTPMA_OBJECT_SIGN_ENCRYPT\f, the
+For instance, to set The fields \fBTPMA_OBJECT_FIXEDTPM\fR,
+\fBTPMA_OBJECT_NODA\fR, and \fBTPMA_OBJECT_SIGN_ENCRYPT\fR, the
 argument would be:
 .PP
-\fBfixedtpm|noda|sign\f specifying the object attributes
-\fIATTRIBUTES\f.
+\fBfixedtpm|noda|sign\fR specifying the object attributes
+\fIATTRIBUTES\fR.
 .SH PCR Bank Specifiers
 .PP
 PCR Bank Selection lists follow the below specification:
 .IP
 .nf
 \fC
-<BANK>:<PCR>,<PCR>\ or\ <BANK>:all
-\f
+<BANK>:<PCR>,<PCR> or <BANK>:all
+\fR
 .fi
 .PP
-multiple banks may be separated by \aq+\aq.
+multiple banks may be separated by `+'.
 .PP
 For example:
 .IP
 .nf
 \fC
 sha1:3,4+sha256:all
-\f
+\fR
 .fi
 .PP
 will select PCRs 3 and 4 from the SHA1 bank and PCRs 0 to 23 from the
@@ -421,31 +446,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -453,18 +479,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -481,84 +507,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -567,14 +600,21 @@
 .nf
 \fC
 tpm2_pcrallocate
-\f
+\fR
 .fi
 .SS To make a custom allocation with a platform authorization
 .IP
 .nf
 \fC
-tpm2_pcrallocate\ \-P\ abc\ sha1:7,8,9,10,16,17,18,19+sha256:all
-\f
+tpm2_pcrallocate \-P abc sha1:7,8,9,10,16,17,18,19+sha256:all
+\fR
+.fi
+.SS To completly switch from SHA1 bank to SHA256 with a platform authorization
+.IP
+.nf
+\fC
+tpm2_pcrallocate \-P abc sha1:none+sha256:all
+\fR
 .fi
 .SH Returns
 .PP
@@ -597,4 +637,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_pcrevent.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_pcrevent.1 Changed

@@ -1,32 +1,34 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_pcrevent" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_pcrevent\f(1) \- Hashes a file and optionally extends a pcr.
+\fBtpm2_pcrevent\fR(1) \- Hashes a file and optionally extends a
+pcr.
 .SH SYNOPSIS
 .PP
-\fBtpm2_pcrevent\f \fIOPTIONS\f \fIFILE\f
-\fIPCR_INDEX\f
+\fBtpm2_pcrevent\fR \fIOPTIONS\fR \fIFILE\fR
+\fIPCR_INDEX\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_pcrevent\f(1) \- Hashes \fIFILE\f if specified or stdin.
+\fBtpm2_pcrevent\fR(1) \- Hashes \fIFILE\fR if specified or
+stdin.
 It uses all of the hashing algorithms that the TPM supports.
 .PP
 Optionally, if a PCR index is specified, it extends that PCR for all
 supported algorithms with the hash digest.
-\fIFILE\f and _PCR_INDEX_ arguments don\aqt need to come in any
+\fIFILE\fR and _PCR_INDEX_ arguments don\cqt need to come in any
 particular order.
 .PP
 In either case, it outputs to stdout the hash algorithm used and the
 digest value, one per line:
 .PP
-\fIalg\f:\fIdigest\f
+\fIalg\fR:\fIdigest\fR
 .PP
-Where \fIalg\f is the algorithm used (like sha1) and \fIdigest\f
-is the digest resulting from the hash computation of \fIalg\f on the
-data.
+Where \fIalg\fR is the algorithm used (like sha1) and
+\fIdigest\fR is the digest resulting from the hash computation of
+\fIalg\fR on the data.
 .PP
 See sections 23.1 and sections 17 of the TPM2.0
 Specification (https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-3-Commands-01.38.pdf)
@@ -34,59 +36,69 @@
 .PP
 These options control extending the pcr:
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for PCR.
 .RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
 Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -103,84 +115,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 .RE
 .SH Authorization Formatting
 .PP
@@ -190,45 +209,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -236,69 +255,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -307,24 +328,24 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .SH EXAMPLES
 .SS Hash a file
 .IP
 .nf
 \fC
-echo\ "foo"\ >\ data
-tpm2_pcrevent\ data
-\f
+echo \dqfoo\dq > data
+tpm2_pcrevent data
+\fR
 .fi
 .SS Hash a file and extend PCR 8
 .IP
 .nf
 \fC
-echo\ "foo"\ >\ data
-tpm2_pcrevent\ 8\ data
-\f
+echo \dqfoo\dq > data
+tpm2_pcrevent 8 data
+\fR
 .fi
 .SH Returns
 .PP
@@ -347,4 +368,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_pcrextend.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_pcrextend.1 Changed

@@ -1,19 +1,19 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_pcrextend" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_pcrextend\f(1) \- Extends a PCR.
+\fBtpm2_pcrextend\fR(1) \- Extends a PCR.
 .SH SYNOPSIS
 .PP
-\fBtpm2_pcrextend\f \fIOPTIONS\f \fIPCR_DIGEST_SPEC\f
+\fBtpm2_pcrextend\fR \fIOPTIONS\fR \fIPCR_DIGEST_SPEC\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_pcrextend\f(1) \- Extends the pcrs with values indicated by
-\fIPCR_DIGEST_SPEC\f.
+\fBtpm2_pcrextend\fR(1) \- Extends the pcrs with values indicated by
+\fIPCR_DIGEST_SPEC\fR.
 .PP
-A \fIPCR_DIGEST_SPEC\f is defined as follows:
+A \fIPCR_DIGEST_SPEC\fR is defined as follows:
 .IP \bu 2
 A numerical PCR identifier.
 .IP \bu 2
@@ -28,10 +28,10 @@
 .nf
 \fC
 4:sha1=f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
-\f
+\fR
 .fi
 .PP
-\fBNote\f: Multiple specifications of PCR and hash are allowed.
+\fBNote\fR: Multiple specifications of PCR and hash are allowed.
 Multiple hashes cause the PCR to be extended with both hashes.
 Multiple same PCR values cause the PCR to be extended multiple times.
 Extension is done in order from left to right as specified.
@@ -45,49 +45,50 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
 Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -104,108 +105,115 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 .RE
 .PP
 PCR bank specifiers (common/pcr.md)
 .SH EXAMPLES
-.SS Extend PCR 4\aqs SHA1 bank with a hash
+.SS Extend PCR 4\cqs SHA1 bank with a hash
 .IP
 .nf
 \fC
-tpm2_pcrextend\ 4:sha1=f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
-\f
+tpm2_pcrextend 4:sha1=f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
+\fR
 .fi
-.SS Extend PCR 4\aqs SHA1 and SHA256 banks with hashes
+.SS Extend PCR 4\cqs SHA1 and SHA256 banks with hashes
 .IP
 .nf
 \fC
-tpm2_pcrextend\ 4:sha1=f1d2d2f924e986ac86fdf7b36c94bcdf32beec15,sha256:b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
-\f
+tpm2_pcrextend 4:sha1=f1d2d2f924e986ac86fdf7b36c94bcdf32beec15,sha256=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
+\fR
 .fi
-.SS Extend PCR 4\aqs SHA1 and PCR 7\aqs SHA256 bank with hashes
+.SS Extend PCR 4\cqs SHA1 and PCR 7\cqs SHA256 bank with hashes
 .IP
 .nf
 \fC
-tpm2_pcrextend\ 4:sha1=f1d2d2f924e986ac86fdf7b36c94bcdf32beec15\ 7:sha256:b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
-\f
+tpm2_pcrextend 4:sha1=f1d2d2f924e986ac86fdf7b36c94bcdf32beec15 7:sha256=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
+\fR
 .fi
 .SH Returns
 .PP
@@ -228,4 +236,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_pcrread.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_pcrread.1 Changed

@@ -1,33 +1,33 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_pcrread" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_pcrread\f(1) \- List PCR values.
+\fBtpm2_pcrread\fR(1) \- List PCR values.
 .SH SYNOPSIS
 .PP
-\fBtpm2_pcrread\f \fIOPTIONS\f \fIPCR_LIST_OR_ALG\f
+\fBtpm2_pcrread\fR \fIOPTIONS\fR \fIPCR_LIST_OR_ALG\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_pcrread\f(1) \- Displays PCR values.
-Without any arguments, \fBtpm2_pcrread\f(1) outputs all PCRs and
+\fBtpm2_pcrread\fR(1) \- Displays PCR values.
+Without any arguments, \fBtpm2_pcrread\fR(1) outputs all PCRs and
 their hash banks.
 One can use specify the hash algorithm or a pcr list as an argument to
 filter the output.
 .PP
 To only output PCR banks with a given algorithm, specify the hashing
 algorithm as the argument.
-Algorithms should follow the "formatting standards", see section
-"Algorithm Specifiers".
-Also, see section "Supported Hash Algorithms" for a list of supported
-hash algorithms.
+Algorithms should follow the \lqformatting standards\rq, see section
+\lqAlgorithm Specifiers\rq.
+Also, see section \lqSupported Hash Algorithms\rq for a list of
+supported hash algorithms.
 .PP
 To output a list of PCR banks (sha1, sha256, etc) and ids (0, 1, 2 etc)
 specify a PCR selection list as the argument as specified via section
-"PCR Bank Specifiers".
+\lqPCR Bank Specifiers\rq.
 .PP
-Also read \fBNOTES\f section below.
+Also read \fBNOTES\fR section below.
 .PP
 Output is written in a YAML format to stdout, with each algorithm
 followed by a PCR index and its value.
@@ -36,68 +36,89 @@
 .IP
 .nf
 \fC
-$\ tpm2_pcrread\ sha1:0+sha256:0
-sha1\ :
-\ \ 0\ \ :\ 0000000000000000000000000000000000000003
-sha256\ :
-\ \ 0\ \ :\ 0000000000000000000000000000000000000000000000000000000000000003
-\f
+$ tpm2_pcrread sha1:0+sha256:0
+sha1 :
+  0  : 0000000000000000000000000000000000000003
+sha256 :
+  0  : 0000000000000000000000000000000000000000000000000000000000000003
+\fR
 .fi
 .SH OPTIONS
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR:
 .RS 2
 .PP
 The output file to write the PCR values in binary format, optional.
 .RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
+.IP \bu 2
+\fB\-F\fR, \fB\-\-pcrs_format\fR=\fIFORMAT\fR:
+.RS 2
+.PP
+Format selection for the binary blob in the PCR output file.
+`values' will output a binary blob of the PCR values.
+`serialized' will output a binary blob of the PCR values in the form of
+serialized data structure in little endian format.
+Optional.
+Default is `values'.
+.RE
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
 Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -114,84 +135,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 .RE
 .PP
 PCR bank specifiers (common/pcr.md)
@@ -199,21 +227,21 @@
 .PP
 Supported hash algorithms are:
 .IP \bu 2
-\fB0x4\f or \fBsha1\f for \fBTPM_ALG_SHA1\f
+\fB0x4\fR or \fBsha1\fR for \fBTPM_ALG_SHA1\fR
 .IP \bu 2
-\fB0xB\f or \fBsha256\f for \fBTPM_ALG_SHA256\f
-\fB(default)\f
+\fB0xB\fR or \fBsha256\fR for \fBTPM_ALG_SHA256\fR
+\fB(default)\fR
 .IP \bu 2
-\fB0xC\f or \fBsha384\f for \fBTPM_ALG_SHA384\f
+\fB0xC\fR or \fBsha384\fR for \fBTPM_ALG_SHA384\fR
 .IP \bu 2
-\fB0xD\f or \fBsha512\f for \fBTPM_ALG_SHA512\f
+\fB0xD\fR or \fBsha512\fR for \fBTPM_ALG_SHA512\fR
 .IP \bu 2
-\fB0x12\f or \fBsm3_256\f for \fBTPM_ALG_SM3_256\f
+\fB0x12\fR or \fBsm3_256\fR for \fBTPM_ALG_SM3_256\fR
 .PP
-\fBNOTE\f: Your TPM may not support all algorithms.
+\fBNOTE\fR: Your TPM may not support all algorithms.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -224,7 +252,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -235,6 +263,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -268,6 +298,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -295,7 +327,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -304,27 +336,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
+.IP \bu 2
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+sm4 \- Default SM4: sm4128
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
+.IP \bu 2
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -332,21 +372,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -359,6 +401,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -371,48 +415,47 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
 .SH EXAMPLES
 .SS Display all PCR values
 .IP
 .nf
 \fC
 tpm2_pcrread
-\f
+\fR
 .fi
 .SS Display the PCR values with a specified bank
 .IP
 .nf
 \fC
-tpm2_pcrread\ sha1
-\f
+tpm2_pcrread sha1
+\fR
 .fi
 .SS Display the PCR values with specified banks and store in a file
 .IP
 .nf
 \fC
-tpm2_pcrread\ \-o\ pcrs\ sha1:16,17,18+sha256:16,17,18
-\f
+tpm2_pcrread \-o pcrs sha1:16,17,18+sha256:16,17,18
+\fR
 .fi
 .SS Display the supported PCR bank algorithms and exit
 .IP
 .nf
 \fC
 tpm2_pcrread
-\f
+\fR
 .fi
 .SH NOTES
 .PP
@@ -441,4 +484,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_pcrreset.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_pcrreset.1 Changed

@@ -1,75 +1,85 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_pcrreset" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_pcrreset\f(1) \- Reset one or more PCR banks
+\fBtpm2_pcrreset\fR(1) \- Reset one or more PCR banks
 .SH SYNOPSIS
 .PP
-\fBtpm2_pcrreset\f \fIOPTIONS\f \fIPCR_INDEX\f ...
+\fBtpm2_pcrreset\fR \fIOPTIONS\fR \fIPCR_INDEX\fR \&...
 .SH DESCRIPTION
 .PP
-\fBtpm2_pcrreset\f(1) \- Reset PCR value in all banks for specified
+\fBtpm2_pcrreset\fR(1) \- Reset PCR value in all banks for specified
 index.
 More than one PCR index can be specified.
 .PP
 The reset value is manufacturer\-dependent and is either sequence of 00
 or FF on the length of the hash algorithm for each supported bank.
 .PP
-\fIPCR_INDEX\f is a space separated list of PCR indexes to be reset
+\fIPCR_INDEX\fR is a space separated list of PCR indexes to be reset
 when issuing the command.
 .SH OPTIONS
 .PP
 This tool accepts no tool specific options.
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
 Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -86,103 +96,110 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 .RE
 .SH EXAMPLES
 .SS Reset a single PCR
 .IP
 .nf
 \fC
-tpm2_pcrreset\ 23
-\f
+tpm2_pcrreset 23
+\fR
 .fi
 .SS Reset multiple PCRs
 .IP
 .nf
 \fC
-tpm2_pcrreset\ 16\ 23
-\f
+tpm2_pcrreset 16 23
+\fR
 .fi
 .SH NOTES
 .PP
-On operating system\aqs locality (generally locality 0), only PCR 23
+On operating system\cqs locality (generally locality 0), only PCR 23
 can be reset.
 PCR\-16 can also be reset on this locality, depending on TPM
 manufacturers which could define this PCR as resettable.
@@ -212,4 +229,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policyauthorize.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policyauthorize.1 Changed

@@ -1,50 +1,50 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policyauthorize" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policyauthorize\f(1) \- Allows for mutable policies by
+\fBtpm2_policyauthorize\fR(1) \- Allows for mutable policies by
 tethering to a signing authority.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policyauthorize\f \fIOPTIONS\f
+\fBtpm2_policyauthorize\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policyauthorize\f(1) \- This command allows for policies to
+\fBtpm2_policyauthorize\fR(1) \- This command allows for policies to
 change by associating the policy to a signing authority and allowing the
 policy contents to change.
 .IP "1." 3
 If the input session is a trial session this tool generates a policy
-digest that associates a signing authority\aqs public key name with
+digest that associates a signing authority\cqs public key name with
 the policy being authorized.
 .IP "2." 3
 If the input session is real policy session
-\fBtpm2_policyauthorize\f(1) looks for a verification ticket from
+\fBtpm2_policyauthorize\fR(1) looks for a verification ticket from
 the TPM to attest that the TPM has verified the signature on the policy
 digest before authorizing the policy in the policy digest.
 .SH OPTIONS
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the policy digest.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-input\f=\fIFILE\f:
+\fB\-i\fR, \fB\-\-input\fR=\fIFILE\fR:
 .RS 2
 .PP
 The policy digest that has to be authorized.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-qualification\f=\fIFILE_OR_HEX\f:
+\fB\-q\fR, \fB\-\-qualification\fR=\fIFILE_OR_HEX\fR:
 .RS 2
 .PP
 The policy qualifier data signed in conjunction with the input policy
@@ -53,19 +53,28 @@
 signature and can either be a path or hex string.
 .RE
 .IP \bu 2
-\fB\-n\f, \fB\-\-name\f=\fIFILE\f:
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
 .RS 2
 .PP
 File containing the name of the verifying public key.
 This ties the final policy digest with a signer.
-This can be retrieved with \fBtpm2_readpublic\f(1)
+This can be retrieved with \fBtpm2_readpublic\fR(1)
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-ticket\f=\fIFILE\f:
+\fB\-t\fR, \fB\-\-ticket\fR=\fIFILE\fR:
 .RS 2
 .PP
 The ticket file to record the validation structure.
-This is generated with \fBtpm2_verifysignature\f(1).
+This is generated with \fBtpm2_verifysignature\fR(1).
+.RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
 .RE
 .SS References
 .SH COMMON OPTIONS
@@ -73,31 +82,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -105,18 +115,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -133,172 +143,178 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .PP
-Starts a \fItrial\f session, builds a PCR policy.
+Starts a \fItrial\fR session, builds a PCR policy.
 This PCR policy digest is then an input to the
-\fBtpm2_policyauthorize\f(1) along with policy qualifier data and a
+\fBtpm2_policyauthorize\fR(1) along with policy qualifier data and a
 signer public.
 The resultant policy digest is then used in creation of objects.
 .PP
 Subsequently when the PCR change and so does the PCR policy digest, the
-actual policy digest from the \fBtpm2_policyauthorize\f(1) used in
+actual policy digest from the \fBtpm2_policyauthorize\fR(1) used in
 creation of the object will not change.
 At runtime the new PCR policy needs to be satisfied along with
 verification of the signature on the PCR policy digest using
-\fBtpm2_policyauthorize\f(1)
+\fBtpm2_policyauthorize\fR(1)
 .SS Create a signing authority
 .IP
 .nf
 \fC
-openssl\ genrsa\ \-out\ signing_key_private.pem\ 2048
+openssl genrsa \-out signing_key_private.pem 2048
 
-openssl\ rsa\ \-in\ signing_key_private.pem\ \-out\ signing_key_public.pem\ \-pubout
+openssl rsa \-in signing_key_private.pem \-out signing_key_public.pem \-pubout
 
-tpm2_loadexternal\ \-G\ rsa\ \-C\ o\ \-u\ signing_key_public.pem\ \-c\ signing_key.ctx\ \-n\ signing_key.name
-\f
+tpm2_loadexternal \-G rsa \-C o \-u signing_key_public.pem \-c signing_key.ctx \-n signing_key.name
+\fR
 .fi
-.SS Create a policy to be authorized like a PCR policy
+.SS Create the authorize policy digest
 .IP
 .nf
 \fC
-tpm2_pcrread\ \-opcr0.sha256\ sha256:0
+tpm2_startauthsession \-S session.ctx
 
-tpm2_startauthsession\ \-S\ session.ctx
+tpm2_policyauthorize \-S session.ctx \-L authorized.policy \-n signing_key.name
 
-tpm2_policypcr\ \-S\ session.ctx\ \-l\ sha256:0\ \-f\ pcr0.sha256\ \-L\ pcr.policy
-
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_flushcontext session.ctx
+\fR
 .fi
-.SS Sign the policy
+.SS Create a policy to be authorized like a PCR policy
 .IP
 .nf
 \fC
-openssl\ dgst\ \-sha256\ \-sign\ signing_key_private.pem\ \-out\ pcr.signature\ pcr.policy
-\f
+tpm2_pcrread \-opcr0.sha256 sha256:0
+
+tpm2_startauthsession \-S session.ctx
+
+tpm2_policypcr \-S session.ctx \-l sha256:0 \-f pcr0.sha256 \-L pcr.policy_desired
+
+tpm2_flushcontext session.ctx
+\fR
 .fi
-.SS Authorize the policy in the policy digest
+.SS Sign the policy
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx
-
-tpm2_policyauthorize\ \-S\ session.ctx\ \-L\ authorized.policy\ \-i\ pcr.policy\ \-n\ signing_key.name
-
-tpm2_flushcontext\ session.ctx
-\f
+openssl dgst \-sha256 \-sign signing_key_private.pem \-out pcr.signature pcr.policy_desired
+\fR
 .fi
-.SS Create a TPM object like a sealing object with the authorized policy
-based authentication
+.SS Create a TPM object like a sealing object with the authorized policy based authentication
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-g\ sha256\ \-G\ rsa\ \-c\ prim.ctx
+tpm2_createprimary \-C o \-g sha256 \-G rsa \-c prim.ctx
 
-tpm2_create\ \-g\ sha256\ \-u\ sealing_pubkey.pub\ \-r\ sealing_prikey.pub\ \-i\-\ \-C\ prim.ctx\ \-L\ authorized.policy\ <<<\ "secret\ to\ seal"
-\f
+tpm2_create \-g sha256 \-u sealing_pubkey.pub \-r sealing_prikey.pub \-i\- \-C prim.ctx \-L authorized.policy <<< \dqsecret to seal\dq
+\fR
 .fi
-.SS Satisfy policy and unseal the secret
+.SS Verify the desired policy digest comes from the signing authority, read the actual value of PCR and check that read policy and desired policy are equal.
 .IP
 .nf
 \fC
-tpm2_verifysignature\ \-c\ signing_key.ctx\ \-g\ sha256\ \-m\ pcr.policy\ \-s\ pcr.signature\ \-t\ verification.tkt\ \-f\ rsassa
+tpm2_verifysignature \-c signing_key.ctx \-g sha256 \-m  pcr.policy_desired \-s pcr.signature \-t verification.tkt \-f rsassa
 
-tpm2_startauthsession\ \\\-\-policy\-session\ \-S\ session.ctx
+tpm2_startauthsession \rs\-\-policy\-session \-S session.ctx
 
-tpm2_policypcr\ \-S\ session.ctx\ \-l\ sha256:0\ \-L\ pcr.policy
+tpm2_policypcr \-S session.ctx \-l sha256:0 \-L pcr.policy_read
 
-tpm2_policyauthorize\ \-S\ session.ctx\ \-L\ authorized.policy\ \-i\ pcr.policy\ \-n\ signing_key.name\ \-t\ verification.tkt
+tpm2_policyauthorize \-S session.ctx \-L authorized.policy \-i pcr.policy_desired \-n signing_key.name \-t verification.tkt
 
-tpm2_load\ \-C\ prim.ctx\ \-u\ sealing_pubkey.pub\ \-r\ sealing_prikey.pub\ \-c\ sealing_key.ctx
+tpm2_load \-C prim.ctx \-u sealing_pubkey.pub \-r sealing_prikey.pub \-c sealing_key.ctx
 
-unsealed=$(tpm2_unseal\ \-p"session:session.ctx"\ \-c\ sealing_key.ctx)
+unsealed=$(tpm2_unseal \-p\dqsession:session.ctx\dq \-c sealing_key.ctx)
 
-echo\ $unsealed
+echo $unsealed
 
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -319,17 +335,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policyauthorizenv.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policyauthorizenv.1 Changed

@@ -1,63 +1,64 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policyauthorizenv" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policyauthorizenv\f(1) \- Allows for mutable policies by
+\fBtpm2_policyauthorizenv\fR(1) \- Allows for mutable policies by
 referencing to a policy from an NV index.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policyauthorizenv\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_policyauthorizenv\fR \fIOPTIONS\fR
+\fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policyauthorizenv\f(1) \- This command allows for policies
+\fBtpm2_policyauthorizenv\fR(1) \- This command allows for policies
 to change by referencing the authorization policy written to an NV
 index.
 The NV index containing the authorization policy should remain readable
 even for trial session.
 The index can be specified as raw handle or an offset value to the nv
-handle range "TPM2_HR_NV_INDEX".
+handle range \lqTPM2_HR_NV_INDEX\rq.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specifies the hierarchy used to authorize.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a hierarchy handle or nv\-index may be
+\fB\fCB<num>\fB\fR where a hierarchy handle or nv\-index may be
 used.
 .PP
-When \fB\-C\f isn\aqt explicitly passed the index handle will be
+When \fB\-C\fR isn\cqt explicitly passed the index handle will be
 used to authorize against the index.
-The index auth value is set via the \fB\-p\f option to
-\fBtpm2_nvdefine\f(1).
+The index auth value is set via the \fB\-p\fR option to
+\fBtpm2_nvdefine\fR(1).
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the policy digest.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -71,31 +72,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -103,18 +105,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -131,91 +133,98 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .PP
 Create a policypassword and write the policy digest to an NV Index.
 Build a policyauthorizenv policy referencing the NV index in a
-\fItrial\f session.
+\fItrial\fR session.
 The resultant policy digest is then used in creation of objects.
 .PP
 In a policy authorization session, first satisfy the policy written to
@@ -227,61 +236,59 @@
 .nf
 \fC
 nv_test_index=0x01500001
-tpm2_nvdefine\ \-C\ o\ \-p\ nvpass\ $nv_test_index\ \-a\ "authread|authwrite"\ \-s\ 34
-\f
+tpm2_nvdefine \-C o \-p nvpass $nv_test_index \-a \dqauthread|authwrite\dq \-s 34
+\fR
 .fi
 .SS Define the auth policy
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx
-tpm2_policypassword\ \-S\ session.ctx\ \-L\ policy.pass
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx
+tpm2_policypassword \-S session.ctx \-L policy.pass
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SS Write the auth policy to the NV Index
 .IP
 .nf
 \fC
-echo\ "000b"\ |\ xxd\ \-p\ \-r\ |\ cat\ \-\ policy.pass\ |\ \\
-tpm2_nvwrite\ \-C\ $nv_test_index\ \-P\ nvpass\ $nv_test_index\ \-i\-
-\f
+echo \dq000b\dq | xxd \-p \-r | cat \- policy.pass | \rs
+tpm2_nvwrite \-C $nv_test_index \-P nvpass $nv_test_index \-i\-
+\fR
 .fi
 .SS Define the policyauthorizenv
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx
-tpm2_policyauthorizenv\ \-S\ session.ctx\ \-C\ $nv_test_index\ \-P\ nvpass\ \\
-\-L\ policyauthorizenv.1500001\ $nv_test_index
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx
+tpm2_policyauthorizenv \-S session.ctx \-C $nv_test_index \-P nvpass \rs
+\-L policyauthorizenv.1500001 $nv_test_index
+tpm2_flushcontext session.ctx
+\fR
 .fi
-.SS Create and load a sealing object with auth policy =
-policyauthorizenv
+.SS Create and load a sealing object with auth policy = policyauthorizenv
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx
+tpm2_createprimary \-C o \-c prim.ctx
 
-echo\ "secretdata"\ |\ \\
-tpm2_create\ \-C\ prim.ctx\ \-u\ key.pub\ \-r\ key.priv\ \\
-\-a\ "fixedtpm|fixedparent|adminwithpolicy"\ \-L\ policyauthorizenv.1500001\ \-i\-
+echo \dqsecretdata\dq | \rs
+tpm2_create \-C prim.ctx \-u key.pub \-r key.priv \rs
+\-a \dqfixedtpm|fixedparent|adminwithpolicy\dq \-L policyauthorizenv.1500001 \-i\-
 
-tpm2_load\ \-C\ prim.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-c\ key.ctx
-\f
+tpm2_load \-C prim.ctx \-u key.pub \-r key.priv \-c key.ctx
+\fR
 .fi
-.SS Satisfy the auth policy stored in the NV Index and thus
-policyauthorizenv
+.SS Satisfy the auth policy stored in the NV Index and thus policyauthorizenv
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-policy\-session
-tpm2_policypassword\ \-S\ session.ctx
-tpm2_policyauthorizenv\ \-S\ session.ctx\ \-C\ $nv_test_index\ \-P\ nvpass\ $nv_test_index
-tpm2_unseal\ \-c\ key.ctx\ \-p\ session:session.ctx
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx \-\-policy\-session
+tpm2_policypassword \-S session.ctx
+tpm2_policyauthorizenv \-S session.ctx \-C $nv_test_index \-P nvpass $nv_test_index
+tpm2_unseal \-c key.ctx \-p session:session.ctx
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -302,17 +309,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policyauthvalue.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policyauthvalue.1 Changed

@@ -1,37 +1,46 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policyauthvalue" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policyauthvalue\f(1) \- Enables binding a policy to the
+\fBtpm2_policyauthvalue\fR(1) \- Enables binding a policy to the
 authorization value of the authorized TPM object.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policyauthvalue\f \fIOPTIONS\f
+\fBtpm2_policyauthvalue\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policyauthvalue\f(1) \- Enables a policy that requires the
-object\aqs authentication passphrase be provided.
+\fBtpm2_policyauthvalue\fR(1) \- Enables a policy that requires the
+object\cqs authentication passphrase be provided.
 This is equivalent to authenticating using the object passphrase in
 plaintext or HMAC.
 It enforces it as a policy.
 It provides a mechanism to allow for password authentication when an
 object only allows policy based authorization, ie object attribute
-"userwithauth" is 0.
+\lquserwithauth\rq is 0.
 .SH OPTIONS
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the compounded policy digest.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
+.RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
 .RE
 .SS References
 .SH COMMON OPTIONS
@@ -39,31 +48,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -71,18 +81,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -99,84 +109,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -185,51 +202,51 @@
 value.
 While we could authenticate with an ephemeral password session, in this
 example we will authenticate with the plaintext passphrase in a policy
-session instead using the \fBtpm2_policyauthvalue\f(1) tool.
+session instead using the \fBtpm2_policyauthvalue\fR(1) tool.
 .SS Create the password policy
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.dat
+tpm2_startauthsession \-S session.dat
 
-tpm2_policyauthvalue\ \-S\ session.dat\ \-L\ policy.dat
+tpm2_policyauthvalue \-S session.dat \-L policy.dat
 
-tpm2_flushcontext\ session.dat
-\f
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SS Create the object with a passphrase and the password policy
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx
+tpm2_createprimary \-C o \-c prim.ctx
 
-tpm2_create\ \-g\ sha256\ \-G\ aes\ \-u\ key.pub\ \-r\ key.priv\ \-C\ prim.ctx\ \-L\ policy.dat\ \\
-\ \ \-p\ testpswd
-\f
+tpm2_create \-g sha256 \-G aes \-u key.pub \-r key.priv \-C prim.ctx \-L policy.dat \rs
+  \-p testpswd
+\fR
 .fi
 .SS Authenticate with plaintext passphrase input
 .IP
 .nf
 \fC
-tpm2_load\ \-C\ prim.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-n\ key.name\ \-c\ key.ctx
+tpm2_load \-C prim.ctx \-u key.pub \-r key.priv \-n key.name \-c key.ctx
 
-echo\ "plaintext"\ >\ plain.txt
-tpm2_encryptdecrypt\ \-c\ key.ctx\ \-o\ encrypt.out\ plain.txt\ \-p\ testpswd
-\f
+echo \dqplaintext\dq > plain.txt
+tpm2_encryptdecrypt \-c key.ctx \-o encrypt.out plain.txt \-p testpswd
+\fR
 .fi
 .SS Authenticate with password and the policy
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-\-policy\-session\ \-S\ session.dat
+tpm2_startauthsession \-\-policy\-session \-S session.dat
 
-tpm2_policyauthvalue\ \-S\ session.dat
+tpm2_policyauthvalue \-S session.dat
 
-tpm2_encryptdecrypt\ \-c\ key.ctx\ \-o\ encrypt.out\ \-p\ session:session.dat+testpswd\ \\
+tpm2_encryptdecrypt \-c key.ctx \-o encrypt.out \-p session:session.dat+testpswd \rs
 plain.txt
 
-tpm2_flushcontext\ session.dat
-\f
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SH Returns
 .PP
@@ -250,17 +267,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policycommandcode.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policycommandcode.1 Changed

@@ -1,72 +1,84 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policycommandcode" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policycommandcode\f(1) \- Restrict TPM object authorization
+\fBtpm2_policycommandcode\fR(1) \- Restrict TPM object authorization
 to specific TPM commands.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policycommandcode\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_policycommandcode\fR \fIOPTIONS\fR
+\fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policycommandcode\f(1) \- Restricts TPM object authorization
-to specific TPM commands.
+\fBtpm2_policycommandcode\fR(1) \- Restricts TPM object
+authorization to specific TPM commands.
 Useful when you want to allow only specific commands to interact with
 the TPM object.
 .PP
 As an argument it takes the command as an integer or friendly string
 value.
 Friendly string to COMMAND CODE mapping can be found in section
-\fICOMMAND CODE MAPPINGS\f.
+\fICOMMAND CODE MAPPINGS\fR.
 .SH OPTIONS
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-A session file from \fBtpm2_startauthsession\f(1)\aqs \fB\-S\f
-option.
+A session file from \fBtpm2_startauthsession\fR(1)\cqs
+\fB\-S\fR option.
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the policy digest.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies TPM2 command code.
+\fBARGUMENT\fR the command line argument specifies TPM2 command
+code.
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SS References
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -74,18 +86,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -102,84 +114,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH COMMAND CODE MAPPINGS
@@ -246,57 +265,57 @@
 0x177 \-TPM2_CC_ZGen_2Phase: 0x18d
 .SH EXAMPLES
 .PP
-Start a \fIpolicy\f session and extend it with a specific command
+Start a \fIpolicy\fR session and extend it with a specific command
 like unseal.
 Attempts to perform other operations would fail.
 .SS Create an unseal\-only policy
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.dat
+tpm2_startauthsession \-S session.dat
 
-tpm2_policycommandcode\ \-S\ session.dat\ \-L\ policy.dat\ TPM2_CC_Unseal
+tpm2_policycommandcode \-S session.dat \-L policy.dat TPM2_CC_Unseal
 
-tpm2_flushcontext\ session.dat
-\f
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SS Create the object with unseal\-only auth policy
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx
+tpm2_createprimary \-C o \-c prim.ctx
 
-tpm2_create\ \-C\ prim.ctx\ \-u\ sealkey.pub\ \-r\ sealkey.priv\ \-L\ policy.dat\ \\
-\ \ \-i\-\ <<<\ "SEALED\-SECRET"
-\f
+tpm2_create \-C prim.ctx \-u sealkey.pub \-r sealkey.priv \-L policy.dat \rs
+  \-i\- <<< \dqSEALED\-SECRET\dq
+\fR
 .fi
 .SS Try unseal operation
 .IP
 .nf
 \fC
-tpm2_load\ \-C\ prim.ctx\ \-u\ sealkey.pub\ \-r\ sealkey.priv\ \-n\ sealkey.name\ \\
-\ \ \-c\ sealkey.ctx
+tpm2_load \-C prim.ctx \-u sealkey.pub \-r sealkey.priv \-n sealkey.name \rs
+  \-c sealkey.ctx
 
-tpm2_startauthsession\ \-\-policy\-session\ \-S\ session.dat
+tpm2_startauthsession \-\-policy\-session \-S session.dat
 
-tpm2_policycommandcode\ \-S\ session.dat\ \-L\ policy.dat\ TPM2_CC_Unseal
+tpm2_policycommandcode \-S session.dat \-L policy.dat TPM2_CC_Unseal
 
-tpm2_unseal\ \-p\ session:session.dat\ \-c\ sealkey.ctx
+tpm2_unseal \-p session:session.dat \-c sealkey.ctx
 SEALED\-SECRET
 
-tpm2_flushcontext\ session.dat
-\f
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SS Try any other operation
 .IP
 .nf
 \fC
-echo\ "Encrypt\ Me"\ >\ plain.txt
+echo \dqEncrypt Me\dq > plain.txt
 
-tpm2_encryptdecrypt\ plain.txt\ \-o\ enc.txt\ \-c\ sealkey.ctx\ plain.txt
-ERROR:\ Esys_EncryptDecrypt2(0x12F)\ \-\ tpm:error(2.0):\ authValue\ or\ authPolicy\ is
-not\ available\ for\ selected\ entity
-\f
+tpm2_encryptdecrypt plain.txt \-o enc.txt \-c sealkey.ctx plain.txt
+ERROR: Esys_EncryptDecrypt2(0x12F) \- tpm:error(2.0): authValue or authPolicy is
+not available for selected entity
+\fR
 .fi
 .SH Returns
 .PP
@@ -317,17 +336,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policycountertimer.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policycountertimer.1 Changed

@@ -1,18 +1,19 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policycountertimer" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policycountertimer\f(1) \- Enables policy authorization by
+\fBtpm2_policycountertimer\fR(1) \- Enables policy authorization by
 evaluating the comparison operation on the TPM parameters time, clock,
 reset count, restart count and TPM clock safe flag.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policycountertimer\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_policycountertimer\fR \fIOPTIONS\fR
+\fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policycountertimer\f(1) \- Enables policy authorization by
+\fBtpm2_policycountertimer\fR(1) \- Enables policy authorization by
 evaluating the comparison operation on the TPM parameters time, clock,
 reset count, restart count and TPM clock safe flag.
 If time/clock, it is input as milliseconds value.
@@ -21,125 +22,135 @@
 .IP
 .nf
 \fC
-tpm2_policycountertimer\ \-S\ session.ctx\ safe
-tpm2_policycountertimer\ \-S\ session.ctx\ clock=<N\ ms>
-tpm2_policycountertimer\ \-S\ session.ctx\ time=<N\ ms>
-tpm2_policycountertimer\ \-S\ session.ctx\ resets=<N>
-tpm2_policycountertimer\ \-S\ session.ctx\ restarts=<N>
-\f
+tpm2_policycountertimer \-S session.ctx safe
+tpm2_policycountertimer \-S session.ctx clock=<N ms>
+tpm2_policycountertimer \-S session.ctx time=<N ms>
+tpm2_policycountertimer \-S session.ctx resets=<N>
+tpm2_policycountertimer \-S session.ctx restarts=<N>
+\fR
 .fi
 .PP
 By default comparison tests for equality and also by default it tests
 for time.
 .SH OPTIONS
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the policy digest.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f or saved off of a previous tool run.
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR or saved off of a previous tool run.
 .RE
 .IP \bu 2
-\fB\-\-eq\f
+\fB\eneq\fR
 .RS 2
 .PP
 if value of current time in the TPM = value of specified input time.
 .RE
 .IP \bu 2
-\fB\-\-neq\f
+\fB\enneq\fR
 .PP
 if value of current time in the TPM != value of specified input time.
 .IP \bu 2
-\fB\-\-sgt\f
+\fB\ensgt\fR
 .PP
 if signed value of current time in the TPM > signed value of specified
 input time.
 .IP \bu 2
-\fB\-\-ugt\f
+\fB\enugt\fR
 .PP
 if unsigned value of current time in the TPM > unsigned value of
 specified input time.
 .IP \bu 2
-\fB\-\-slt\f
+\fB\enslt\fR
 .PP
 if signed value of current time in the TPM < signed value of specified
 input time.
 .IP \bu 2
-\fB\-\-ult\f
+\fB\enult\fR
 .PP
 if unsigned value of current time in the TPM < unsigned value of
 specified input time.
 .IP \bu 2
-\fB\-\-sge\f
+\fB\ensge\fR
 .PP
 if signed value of current time in the TPM >= signed value of specified
 input time.
 .IP \bu 2
-\fB\-\-uge\f
+\fB\enuge\fR
 .PP
 if unsigned value of current time in the TPM >= unsigned value of
 specified input time.
 .IP \bu 2
-\fB\-\-sle\f
+\fB\ensle\fR
 .PP
 if signed value of current time in the TPM <= unsigned value of
 specified input time.
 .IP \bu 2
-\fB\-\-ule\f
+\fB\enule\fR
 .PP
 if unsigned value of current time in the TPM <= unsigned value of
 specified input time.
 .IP \bu 2
-\fB\-\-bs\f
+\fB\enbs\fR
 .RS 2
 .PP
 if all bits set in value of current time in the TPM are set in value of
 specified input time.
 .RE
 .IP \bu 2
-\fB\-\-bc\f
+\fB\enbc\fR
 .RS 2
 .PP
 if all bits set in value of current time in the TPM are clear in value
 of specified input time.
 .RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SS References
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -147,18 +158,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -175,84 +186,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -263,31 +281,31 @@
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx
+tpm2_startauthsession \-S session.ctx
 
-tpm2_policycountertimer\ \-S\ session.ctx\ \-L\ policy.countertimer\ \-\-ult\ 60000
+tpm2_policycountertimer \-S session.ctx \-L policy.countertimer \-\-ult 60000
 
-tpm2_flushcontext\ session.ctx
+tpm2_flushcontext session.ctx
 
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx\ \-Q
+tpm2_createprimary \-C o \-c prim.ctx \-Q
 
-echo\ "SUPERSECRET"\ |\ \\
-tpm2_create\ \-Q\ \-u\ key.pub\ \-r\ key.priv\ \-i\-\ \-C\ prim.ctx\ \\
-\-L\ policy.countertimer\ \-a\ "fixedtpm|fixedparent"\ \-c\ key.ctx
-\f
+echo \dqSUPERSECRET\dq | \rs
+tpm2_create \-Q \-u key.pub \-r key.priv \-i\- \-C prim.ctx \rs
+\-L policy.countertimer \-a \dqfixedtpm|fixedparent\dq \-c key.ctx
+\fR
 .fi
 .SS Unsealing should work in the first minute after TPM restart
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-policy\-session
+tpm2_startauthsession \-S session.ctx \-\-policy\-session
 
-tpm2_policycountertimer\ \-S\ session.ctx\ \-\-ult\ 60000
+tpm2_policycountertimer \-S session.ctx \-\-ult 60000
 
-tpm2_unseal\ \-c\ key.ctx\ \-p\ session:session.ctx
+tpm2_unseal \-c key.ctx \-p session:session.ctx
 
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -308,17 +326,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policycphash.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policycphash.1 Changed

@@ -1,71 +1,78 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policycphash" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policycphash\f(1) \- Couples a policy with command
+\fBtpm2_policycphash\fR(1) \- Couples a policy with command
 parameters of the command.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policycphash\f \fIOPTIONS\f
+\fBtpm2_policycphash\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policycphash\f(1) \- Couples a policy with command
+\fBtpm2_policycphash\fR(1) \- Couples a policy with command
 parameters of the command.
 This is a deferred assertion where the hash of the command parameters in
 a TPM command is checked against the one specified in the policy.
 .SH OPTIONS
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the compounded policy digest.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f:
+\fB\-\-cphash\-input\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file containing the command parameter hash of the command.
 .RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR:
+.RS 2
+.PP
+\fBDEPRECATED\fR, use \fB\encphash\-input\fR instead.
+.RE
 .SS References
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -73,18 +80,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -101,84 +108,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -188,47 +202,47 @@
 .IP
 .nf
 \fC
-openssl\ genrsa\ \-out\ signing_key_private.pem\ 2048
-openssl\ rsa\ \-in\ signing_key_private.pem\ \-out\ signing_key_public.pem\ \-pubout
-tpm2_loadexternal\ \-G\ rsa\ \-C\ o\ \-u\ signing_key_public.pem\ \-c\ signing_key.ctx\ \\
-\-n\ signing_key.name
-tpm2_startauthsession\ \-S\ session.ctx\ \-g\ sha256
-tpm2_policyauthorize\ \-S\ session.ctx\ \-L\ authorized.policy\ \-n\ signing_key.name
-tpm2_flushcontext\ session.ctx
-tpm2_nvdefine\ 1\ \-a\ "policywrite|authwrite|ownerread|nt=bits"\ \-L\ authorized.policy
-\f
+openssl genrsa \-out signing_key_private.pem 2048
+openssl rsa \-in signing_key_private.pem \-out signing_key_public.pem \-pubout
+tpm2_loadexternal \-G rsa \-C o \-u signing_key_public.pem \-c signing_key.ctx \rs
+\-n signing_key.name
+tpm2_startauthsession \-S session.ctx \-g sha256
+tpm2_policyauthorize \-S session.ctx \-L authorized.policy \-n signing_key.name
+tpm2_flushcontext session.ctx
+tpm2_nvdefine 1 \-a \dqpolicywrite|authwrite|ownerread|nt=bits\dq \-L authorized.policy
+\fR
 .fi
 .SS Create policycphash
 .IP
 .nf
 \fC
-tpm2_nvsetbits\ 1\ \-i\ 1\ \-\-cphash\ cp.hash
-tpm2_startauthsession\ \-S\ session.ctx\ \-g\ sha256
-tpm2_policycphash\ \-S\ session.ctx\ \-L\ policy.cphash\ \-\-cphash\ cp.hash
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_nvsetbits 1 \-i 1 \-\-cphash cp.hash
+tpm2_startauthsession \-S session.ctx \-g sha256
+tpm2_policycphash \-S session.ctx \-L policy.cphash \-\-cphash cp.hash
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SS Sign and verify policycphash
 .IP
 .nf
 \fC
-openssl\ dgst\ \-sha256\ \-sign\ signing_key_private.pem\ \\
-\-out\ policycphash.signature\ policy.cphash
-tpm2_verifysignature\ \-c\ signing_key.ctx\ \-g\ sha256\ \-m\ policy.cphash\ \\
-\-s\ policycphash.signature\ \-t\ verification.tkt\ \-f\ rsassa
-\f
+openssl dgst \-sha256 \-sign signing_key_private.pem \rs
+\-out policycphash.signature policy.cphash
+tpm2_verifysignature \-c signing_key.ctx \-g sha256 \-m policy.cphash \rs
+\-s policycphash.signature \-t verification.tkt \-f rsassa
+\fR
 .fi
 .SS Satisfy policycphash and execute nvsetbits
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-policy\-session\ \-g\ sha256
-tpm2_policycphash\ \-S\ session.ctx\ \-\-cphash\ cp.hash
-tpm2_policyauthorize\ \-S\ session.ctx\ \-i\ policy.cphash\ \-n\ signing_key.name\ \\
-\-t\ verification.tkt
-tpm2_nvsetbits\ 1\ \-i\ 1\ \-P\ "session:session.ctx"
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx \-\-policy\-session \-g sha256
+tpm2_policycphash \-S session.ctx \-\-cphash cp.hash
+tpm2_policyauthorize \-S session.ctx \-i policy.cphash \-n signing_key.name \rs
+\-t verification.tkt
+tpm2_nvsetbits 1 \-i 1 \-P \dqsession:session.ctx\dq
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -249,17 +263,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policyduplicationselect.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policyduplicationselect.1 Changed

@@ -1,46 +1,46 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policyduplicationselect" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policyduplicationselect\f(1) \- Restricts duplication to a
+\fBtpm2_policyduplicationselect\fR(1) \- Restricts duplication to a
 specific new parent.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policyduplicationselect\f \fIOPTIONS\f
+\fBtpm2_policyduplicationselect\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policyduplicationselect\f(1) \- Restricts duplication to a
+\fBtpm2_policyduplicationselect\fR(1) \- Restricts duplication to a
 specific new parent.
 .SH OPTIONS
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
 .RE
 .IP \bu 2
-\fB\-n\f, \fB\-\-object\-name\f=\fIFILE\f:
+\fB\-n\fR, \fB\-\-object\-name\fR=\fIFILE\fR:
 .RS 2
 .PP
 Input name file of the object to be duplicated.
 .RE
 .IP \bu 2
-\fB\-N\f, \fB\-\-parent\-name\f=\fIFILE\f:
+\fB\-N\fR, \fB\-\-parent\-name\fR=\fIFILE\fR:
 .RS 2
 .PP
 Input name file of the new parent.
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the policy digest.
 .RE
 .IP \bu 2
-\fB\-\-include\-object\f:
+\fB\-\-include\-object\fR:
 .RS 2
 .PP
 If exists, the object name will be included in the value in policy
@@ -52,31 +52,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -84,18 +85,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -112,84 +113,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -198,50 +206,50 @@
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ n\ \-g\ sha256\ \-G\ rsa\ \-c\ dst_n.ctx\ \-Q
-tpm2_createprimary\ \-C\ o\ \-g\ sha256\ \-G\ rsa\ \-c\ src_o.ctx\ \-Q
-\f
+tpm2_createprimary \-C n \-g sha256 \-G rsa \-c dst_n.ctx \-Q
+tpm2_createprimary \-C o \-g sha256 \-G rsa \-c src_o.ctx \-Q
+\fR
 .fi
 .SS Create the restricted parent policy
 .IP
 .nf
 \fC
-tpm2_readpublic\ \-c\ dst_n.ctx\ \-n\ dst_n.name\ \-Q
-tpm2_startauthsession\ \-S\ session.ctx
-tpm2_policyduplicationselect\ \-S\ session.ctx\ \ \-N\ dst_n.name\ \\
-\-L\ policydupselect.dat\ \-Q
-tpm2_flushcontext\ session.ctx
-rm\ session.ctx
-\f
+tpm2_readpublic \-c dst_n.ctx \-n dst_n.name \-Q
+tpm2_startauthsession \-S session.ctx
+tpm2_policyduplicationselect \-S session.ctx  \-N dst_n.name \rs
+\-L policydupselect.dat \-Q
+tpm2_flushcontext session.ctx
+rm session.ctx
+\fR
 .fi
 .SS Create the object to be duplicated using the policy
 .IP
 .nf
 \fC
-tpm2_create\ \-C\ src_o.ctx\ \-g\ sha256\ \-G\ rsa\ \-r\ dupkey.priv\ \-u\ dupkey.pub\ \\
-\-L\ policydupselect.dat\ \ \-a\ "sensitivedataorigin|sign|decrypt"\ \-c\ dupkey.ctx\ \-Q
-tpm2_readpublic\ \-c\ dupkey.ctx\ \-n\ dupkey.name\ \-Q
-\f
+tpm2_create \-C src_o.ctx \-g sha256 \-G rsa \-r dupkey.priv \-u dupkey.pub \rs
+\-L policydupselect.dat  \-a \dqsensitivedataorigin|sign|decrypt\dq \-c dupkey.ctx \-Q
+tpm2_readpublic \-c dupkey.ctx \-n dupkey.name \-Q
+\fR
 .fi
 .SS Satisfy the policy and duplicate the object
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-policy\-session
-tpm2_policyduplicationselect\ \-S\ session.ctx\ \ \-N\ dst_n.name\ \-n\ dupkey.name\ \-Q
-tpm2_duplicate\ \-C\ dst_n.ctx\ \-c\ dupkey.ctx\ \-G\ null\ \-p\ session:session.ctx\ \\
-\-r\ new_dupkey.priv\ \-s\ dupseed.dat
-tpm2_flushcontext\ \ session.ctx
-rm\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx \-\-policy\-session
+tpm2_policyduplicationselect \-S session.ctx  \-N dst_n.name \-n dupkey.name \-Q
+tpm2_duplicate \-C dst_n.ctx \-c dupkey.ctx \-G null \-p session:session.ctx \rs
+\-r new_dupkey.priv \-s dupseed.dat
+tpm2_flushcontext  session.ctx
+rm session.ctx
+\fR
 .fi
 .SH NOTES
 .IP \bu 2
-This command usually cooperates with \fBtpm2_duplicate\f(1), so
-referring to the man page of \fBtpm2_duplicate\f(1) is recommended.
+This command usually cooperates with \fBtpm2_duplicate\fR(1), so
+referring to the man page of \fBtpm2_duplicate\fR(1) is recommended.
 .IP \bu 2
-This command will set the policy session\aqs command code to
-\fBTPM_CC_Duplicate\f which enables duplication role of the policy.
+This command will set the policy session\cqs command code to
+\fBTPM_CC_Duplicate\fR which enables duplication role of the policy.
 .SH Returns
 .PP
 Tools can return any of the following codes:
@@ -261,17 +269,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policylocality.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policylocality.1 Changed

@@ -1,29 +1,29 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policylocality" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policylocality\f(1) \- Restrict TPM object authorization to
+\fBtpm2_policylocality\fR(1) \- Restrict TPM object authorization to
 specific localities.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policylocality\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_policylocality\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policylocality\f(1) \- Restricts TPM object authorization to
-specific TPM locality.
+\fBtpm2_policylocality\fR(1) \- Restricts TPM object authorization
+to specific TPM locality.
 Useful when you want to allow only specific locality with the TPM
 object.
 A locality indicates the source of the command, for example it could be
-from the application layer or the driver layer, each would have it\aqs
+from the application layer or the driver layer, each would have it\cqs
 own locality integer.
 Localities are hints to the TPM and are enforced by the software
 communicating to the TPM.
-Thus they are \fBnot trusted\f inputs on their own and are
+Thus they are \fBnot trusted\fR inputs on their own and are
 implemented in platform specific ways.
 .PP
-As an argument it takes the \fILOCALITY\f as an integer or friendly
+As an argument it takes the \fILOCALITY\fR as an integer or friendly
 name.
 .PP
 Localities are fixed to a byte in size and have two representations,
@@ -31,62 +31,73 @@
 .PP
 Localities 0 through 4 are the normal locality representation and are
 represented as set bit indexes.
-Thus locality 0 is indicated by \fC1<<0\f and locality 4 is
-indicated by \fC1<<4\f.
+Thus locality 0 is indicated by \fC1<<0\fR and locality 4 is
+indicated by \fC1<<4\fR.
 Rather then using raw numbers, these localities can also be specified by
-the friendly names of: \- zero: locality 0 or \fC1<<0\f \- one:
-locality 1 or \fC1<<1\f \- two: locality 2 or \fC1<<2\f \-
-three: locality 3 or \fC1<<3\f \- four: locality 4 or \fC1<<4\f
+the friendly names of: \- zero: locality 0 or \fC1<<0\fR \- one:
+locality 1 or \fC1<<1\fR \- two: locality 2 or \fC1<<2\fR \-
+three: locality 3 or \fC1<<3\fR \- four: locality 4 or
+\fC1<<4\fR
 .PP
 Anything from the range 32 \- 255 are extended localities.
 .SH OPTIONS
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-A session file from \fBtpm2_startauthsession\f(1)\aqs \fB\-S\f
-option.
+A session file from \fBtpm2_startauthsession\fR(1)\cqs
+\fB\-S\fR option.
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the policy digest.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the locality
+\fBARGUMENT\fR the command line argument specifies the locality
 number.
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SS References
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -94,18 +105,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -122,129 +133,136 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .PP
-Start a \fIpolicy\f session and extend it with a specific locality
+Start a \fIpolicy\fR session and extend it with a specific locality
 number (like 3).
 Attempts to perform other operations would fail.
 .SS Create an policy restricted by locality 3
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.dat
+tpm2_startauthsession \-S session.dat
 
-tpm2_policylocality\ \-S\ session.dat\ \-L\ policy.dat\ three
+tpm2_policylocality \-S session.dat \-L policy.dat three
 
-tpm2_flushcontext\ session.dat
-\f
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SS Create the object with auth policy
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx
+tpm2_createprimary \-C o \-c prim.ctx
 
-tpm2_create\ \-C\ prim.ctx\ \-u\ sealkey.pub\ \-r\ sealkey.priv\ \-L\ policy.dat\ \\
-\-i\-\ <<<\ "SEALED\-SECRET"
-\f
+tpm2_create \-C prim.ctx \-u sealkey.pub \-r sealkey.priv \-L policy.dat \rs
+\-i\- <<< \dqSEALED\-SECRET\dq
+\fR
 .fi
 .SS Try unseal operation
 .IP
 .nf
 \fC
-tpm2_load\ \-C\ prim.ctx\ \-u\ sealkey.pub\ \-r\ sealkey.priv\ \-n\ sealkey.name\ \\
-\-c\ sealkey.ctx
+tpm2_load \-C prim.ctx \-u sealkey.pub \-r sealkey.priv \-n sealkey.name \rs
+\-c sealkey.ctx
 
-tpm2_startauthsession\ \\\-\-policy\-session\ \-S\ session.dat
+tpm2_startauthsession \rs\-\-policy\-session \-S session.dat
 
-tpm2_policylocality\ \-S\ session.dat\ \-L\ policy.dat\ three
+tpm2_policylocality \-S session.dat \-L policy.dat three
 
-#\ Change\ to\ locality\ 3,\ Note:\ this\ operation\ varies\ on\ different\ platforms
+# Change to locality 3, Note: this operation varies on different platforms
 
-tpm2_unseal\ \-p\ session:session.dat\ \-c\ sealkey.ctx
+tpm2_unseal \-p session:session.dat \-c sealkey.ctx
 
-tpm2_flushcontext\ session.dat
-\f
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SH Returns
 .PP
@@ -265,17 +283,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policynamehash.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policynamehash.1 Changed

@@ -1,37 +1,37 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policynamehash" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policynamehash\f(1) \- Couples a policy with names of
+\fBtpm2_policynamehash\fR(1) \- Couples a policy with names of
 specific objects.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policynamehash\f \fIOPTIONS\f
+\fBtpm2_policynamehash\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policynamehash\f(1) \- Couples a policy with names of
+\fBtpm2_policynamehash\fR(1) \- Couples a policy with names of
 specific objects.
 This is a deferred assertion where the hash of the names of all object
 handles in a TPM command is checked against the one specified in the
 policy.
 .SH OPTIONS
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the compounded policy digest.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
 .RE
 .IP \bu 2
-\fB\-n\f, \fB\-\-name\f=\fIFILE\f:
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file containing the name hash of the referenced objects.
@@ -42,31 +42,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -74,18 +75,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -102,84 +103,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -191,93 +199,92 @@
 .nf
 \fC
 
-openssl\ genrsa\ \-out\ signing_key_private.pem\ 2048
+openssl genrsa \-out signing_key_private.pem 2048
 
-openssl\ rsa\ \-in\ signing_key_private.pem\ \-out\ signing_key_public.pem\ \-pubout
+openssl rsa \-in signing_key_private.pem \-out signing_key_public.pem \-pubout
 
-tpm2_loadexternal\ \-G\ rsa\ \-C\ o\ \-u\ signing_key_public.pem\ \-c\ signing_key.ctx\ \\
-\-n\ signing_key.name
+tpm2_loadexternal \-G rsa \-C o \-u signing_key_public.pem \-c signing_key.ctx \rs
+\-n signing_key.name
 
-tpm2_startauthsession\ \-S\ session.ctx\ \-g\ sha256
+tpm2_startauthsession \-S session.ctx \-g sha256
 
-tpm2_policyauthorize\ \-S\ session.ctx\ \-L\ authorized.policy\ \-n\ signing_key.name
+tpm2_policyauthorize \-S session.ctx \-L authorized.policy \-n signing_key.name
 
-tpm2_policycommandcode\ \-S\ session.ctx\ \-L\ policy.dat\ TPM2_CC_Duplicate
+tpm2_policycommandcode \-S session.ctx \-L policy.dat TPM2_CC_Duplicate
 
-tpm2_flushcontext\ session.ctx
+tpm2_flushcontext session.ctx
 
-tpm2_createprimary\ \-C\ o\ \-g\ sha256\ \-G\ rsa\ \-c\ primary.ctx\ \-Q
+tpm2_createprimary \-C o \-g sha256 \-G rsa \-c primary.ctx \-Q
 
-##\ The\ duplicable\ key
-tpm2_create\ \-Q\ \-C\ primary.ctx\ \-g\ sha256\ \-G\ rsa\ \-r\ key.prv\ \-u\ key.pub\ \\
-\-L\ policy.dat\ \-a\ "sensitivedataorigin|sign|decrypt"
+## The duplicable key
+tpm2_create \-Q \-C primary.ctx \-g sha256 \-G rsa \-r key.prv \-u key.pub \rs
+\-L policy.dat \-a \dqsensitivedataorigin|sign|decrypt\dq
 
-tpm2_load\ \-Q\ \-C\ primary.ctx\ \-r\ key.prv\ \-u\ key.pub\ \-c\ key.ctx
-\f
+tpm2_load \-Q \-C primary.ctx \-r key.prv \-u key.pub \-c key.ctx
+\fR
 .fi
 .SH Create the new parent
 .IP
 .nf
 \fC
 
-tpm2_create\ \-Q\ \-C\ primary.ctx\ \-g\ sha256\ \-G\ rsa\ \-r\ new_parent.prv\ \\
-\-u\ new_parent.pub\ \\
-\-a\ "decrypt|fixedparent|fixedtpm|restricted|sensitivedataorigin"
+tpm2_create \-Q \-C primary.ctx \-g sha256 \-G rsa \-r new_parent.prv \rs
+\-u new_parent.pub \rs
+\-a \dqdecrypt|fixedparent|fixedtpm|restricted|sensitivedataorigin\dq
 
-tpm2_loadexternal\ \-Q\ \-C\ o\ \-u\ new_parent.pub\ \-c\ new_parent.ctx
-\f
+tpm2_loadexternal \-Q \-C o \-u new_parent.pub \-c new_parent.ctx
+\fR
 .fi
-.SH Modify the duplicable key policy to namehash policy to restrict
-parent and key
+.SH Modify the duplicable key policy to namehash policy to restrict parent and key
 .IP
 .nf
 \fC
-tpm2_readpublic\ \-Q\ \-c\ new_parent.ctx\ \-n\ new_parent.name
+tpm2_readpublic \-Q \-c new_parent.ctx \-n new_parent.name
 
-tpm2_readpublic\ \-Q\ \-c\ key.ctx\ \-n\ key.name
+tpm2_readpublic \-Q \-c key.ctx \-n key.name
 
-cat\ key.name\ new_parent.name\ |\ openssl\ dgst\ \-sha256\ \-binary\ >\ name.hash
+cat key.name new_parent.name | openssl dgst \-sha256 \-binary > name.hash
 
-tpm2_startauthsession\ \-S\ session.ctx\ \-g\ sha256
+tpm2_startauthsession \-S session.ctx \-g sha256
 
-tpm2_policynamehash\ \-L\ policy.namehash\ \-S\ session.ctx\ \-n\ name.hash
+tpm2_policynamehash \-L policy.namehash \-S session.ctx \-n name.hash
 
-tpm2_flushcontext\ session.ctx
+tpm2_flushcontext session.ctx
 
-openssl\ dgst\ \-sha256\ \-sign\ signing_key_private.pem\ \\
-\-out\ policynamehash.signature\ policy.namehash
+openssl dgst \-sha256 \-sign signing_key_private.pem \rs
+\-out policynamehash.signature policy.namehash
 
-tpm2_startauthsession\ \-S\ session.ctx\ \-g\ sha256
+tpm2_startauthsession \-S session.ctx \-g sha256
 
-tpm2_policyauthorize\ \-S\ session.ctx\ \-L\ authorized.policy\ \-i\ policy.namehash\ \\
-\-n\ signing_key.name
+tpm2_policyauthorize \-S session.ctx \-L authorized.policy \-i policy.namehash \rs
+\-n signing_key.name
 
-tpm2_policycommandcode\ \-S\ session.ctx\ \-L\ policy.dat\ TPM2_CC_Duplicate
+tpm2_policycommandcode \-S session.ctx \-L policy.dat TPM2_CC_Duplicate
 
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SH Satisfy the policy and attempt key duplication
 .IP
 .nf
 \fC
-tpm2_verifysignature\ \-c\ signing_key.ctx\ \-g\ sha256\ \-m\ policy.namehash\ \\
-\-s\ policynamehash.signature\ \-t\ verification.tkt\ \-f\ rsassa
+tpm2_verifysignature \-c signing_key.ctx \-g sha256 \-m policy.namehash \rs
+\-s policynamehash.signature \-t verification.tkt \-f rsassa
 
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-policy\-session\ \-g\ sha256
+tpm2_startauthsession \-S session.ctx \-\-policy\-session \-g sha256
 
-tpm2_policynamehash\ \-S\ session.ctx\ \-n\ name.hash
+tpm2_policynamehash \-S session.ctx \-n name.hash
 
-tpm2_policyauthorize\ \-S\ session.ctx\ \-i\ policy.namehash\ \-n\ signing_key.name\ \\
-\-t\ verification.tkt
+tpm2_policyauthorize \-S session.ctx \-i policy.namehash \-n signing_key.name \rs
+\-t verification.tkt
 
-tpm2_policycommandcode\ \-S\ session.ctx\ TPM2_CC_Duplicate
+tpm2_policycommandcode \-S session.ctx TPM2_CC_Duplicate
 
-tpm2_duplicate\ \-C\ new_parent.ctx\ \-c\ key.ctx\ \-G\ null\ \-p\ "session:session.ctx"\ \\
-\-r\ dupprv.bin\ \-s\ dupseed.dat
+tpm2_duplicate \-C new_parent.ctx \-c key.ctx \-G null \-p \dqsession:session.ctx\dq \rs
+\-r dupprv.bin \-s dupseed.dat
 
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -298,17 +305,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policynv.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policynv.1 Changed

@@ -1,74 +1,78 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policynv" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policynv\f(1) \- Evaluates policy authorization by comparing
-a specified value against the contents in the specified NV Index.
+\fBtpm2_policynv\fR(1) \- Evaluates policy authorization by
+comparing a specified value against the contents in the specified NV
+Index.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policynv\f \fIOPTIONS\f \fIARGUMENT\f
-\fIARGUMENT\f
+\fBtpm2_policynv\fR \fIOPTIONS\fR \fIARGUMENT\fR
+\fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policynv\f(1) \- This command evaluates policy authorization
-by comparing the contents written to an NV index against the one
-specified in the tool options.
+\fBtpm2_policynv\fR(1) \- This command evaluates policy
+authorization by comparing the contents written to an NV index against
+the one specified in the tool options.
 The tool takes two arguments \- (1) The NV index specified as raw handle
-or an offset value to the nv handle range "TPM2_HR_NV_INDEX" and (2)
-Comparison operator for magnitude comparison and or bit test operations.
+or an offset value to the nv handle range \lqTPM2_HR_NV_INDEX\rq and
+(2) Comparison operator for magnitude comparison and or bit test
+operations.
 In the specification the NV index holding the data is called operandA
 and the data that the user specifies to compare is called operandB.
-The comparison operator can be specified as follows: * "eq" if operandA
-= operandB * "neq" if operandA != operandB * "sgt" if signed operandA >
-signed operandB * "ugt" if unsigned operandA > unsigned operandB * "slt"
-if signed operandA < signed operandB * "ult" if unsigned operandA <
-unsigned operandB * "sge" if signed operandA >= signed operandB * "uge"
-if unsigned operandA >= unsigned operandB * "sle" if signed operandA <=
-unsigned operandB * "ule" if unsigned operandA <= unsigned operandB *
-"bs" if all bits set in operandA are set in operandB * "bc" if all bits
-set in operandA are clear in operandB
+The comparison operator can be specified as follows: * \lqeq\rq if
+operandA = operandB * \lqneq\rq if operandA != operandB *
+\lqsgt\rq if signed operandA > signed operandB * \lqugt\rq if
+unsigned operandA > unsigned operandB * \lqslt\rq if signed operandA
+< signed operandB * \lqult\rq if unsigned operandA < unsigned
+operandB * \lqsge\rq if signed operandA >= signed operandB *
+\lquge\rq if unsigned operandA >= unsigned operandB * \lqsle\rq
+if signed operandA <= unsigned operandB * \lqule\rq if unsigned
+operandA <= unsigned operandB * \lqbs\rq if all bits set in operandA
+are set in operandB * \lqbc\rq if all bits set in operandA are clear
+in operandB
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specifies the hierarchy used to authorize.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .IP \bu 2
-\fB\fC<num>\f\f where a hierarchy handle or nv\-index may be
+\fB\fCB<num>\fB\fR where a hierarchy handle or nv\-index may be
 used.
 .PP
-When \fB\-C\f isn\aqt explicitly passed the index handle will be
+When \fB\-C\fR isn\cqt explicitly passed the index handle will be
 used to authorize against the index.
-The index auth value is set via the \fB\-p\f option to
-\fBtpm2_nvdefine\f(1).
+The index auth value is set via the \fB\-p\fR option to
+\fBtpm2_nvdefine\fR(1).
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the policy digest.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f or saved off of a previous tool run.
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR or saved off of a previous tool run.
 .RE
 .IP \bu 2
-\fB\-\-offset\f=\fINATURAL_NUMBER\f:
+\fB\-\-offset\fR=\fINATURAL_NUMBER\fR:
 .RS 2
 .PP
 The offset within the NV index to start comparing at.
@@ -76,7 +80,7 @@
 shall not exceed the size of the operand specified in the options.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -85,13 +89,14 @@
 the command, it simply returns a cpHash.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-input\f=\fIFILE\f:
+\fB\-i\fR, \fB\-\-input\fR=\fIFILE\fR:
 .RS 2
 .PP
 Specifies the input file with data to compare to NV Index contents.
 In the standard specification, this is termed as operand or operandB
 more specifically .
-It can be specified as a file input or stdin if option value is a "\-".
+It can be specified as a file input or stdin if option value is a
+\lq\-\rq.
 .RE
 .SS References
 .SH COMMON OPTIONS
@@ -99,31 +104,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -131,18 +137,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -159,84 +165,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -253,31 +266,29 @@
 .nf
 \fC
 nv_test_index=0x01500001
-tpm2_nvdefine\ \-C\ o\ \-p\ nvpass\ $nv_test_index\ \-a\ "authread|authwrite"\ \-s\ 1
-echo\ "aa"\ |\ xxd\ \-r\ \-p\ |\ tpm2_nvwrite\ \-P\ nvpass\ \-i\-\ $nv_test_index
-\f
+tpm2_nvdefine \-C o \-p nvpass $nv_test_index \-a \dqauthread|authwrite\dq \-s 1
+echo \dqaa\dq | xxd \-r \-p | tpm2_nvwrite \-P nvpass \-i\- $nv_test_index
+\fR
 .fi
-.SS Attempt defining policynv with wrong comparison value specified in
-options.
+.SS Attempt defining policynv with wrong comparison value specified in options.
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-policy\-session
-###\ This\ should\ fail
-echo\ 0xBB\ |\ tpm2_policynv\ \-S\ session.ctx\ \-L\ policy.nv\ \-i\-\ 0x1500001\ eq\ \-P\ nvpass
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx \-\-policy\-session
+### This should fail
+echo 0xBB | tpm2_policynv \-S session.ctx \-L policy.nv \-i\- 0x1500001 eq \-P nvpass
+tpm2_flushcontext session.ctx
+\fR
 .fi
-.SS Attempt defining policynv with right comparison value specified in
-options.
+.SS Attempt defining policynv with right comparison value specified in options.
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-policy\-session
-###\ This\ should\ pass
-echo\ 0xAA\ |\ tpm2_policynv\ \-S\ session.ctx\ \-L\ policy.nv\ \-i\-\ 0x1500001\ eq\ \-P\ nvpass
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx \-\-policy\-session
+### This should pass
+echo 0xAA | tpm2_policynv \-S session.ctx \-L policy.nv \-i\- 0x1500001 eq \-P nvpass
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -298,17 +309,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policynvwritten.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policynvwritten.1 Changed

@@ -1,68 +1,78 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policynvwritten" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policynvwritten\f(1) \- Restrict TPM object authorization to
-the written state of an NV index.
+\fBtpm2_policynvwritten\fR(1) \- Restrict TPM object authorization
+to the written state of an NV index.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policynvwritten\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_policynvwritten\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policynvwritten\f(1) \- Restricts TPM object authorization
+\fBtpm2_policynvwritten\fR(1) \- Restricts TPM object authorization
 to the written state of an NV index.
 Useful when creating write once NV indexes.
 .PP
-As an \fIARGUMENT\f it takes the expected written state of the NV
+As an \fIARGUMENT\fR it takes the expected written state of the NV
 index.
 It can be specified as s|c|0|1.
 .SH OPTIONS
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-A session file from \fBtpm2_startauthsession\f(1)\aqs \fB\-S\f
-option.
+A session file from \fBtpm2_startauthsession\fR(1)\cqs
+\fB\-S\fR option.
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the policy digest.
 .RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SS References
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -70,18 +80,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -98,118 +108,125 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .PP
 Create a write once NV index.
 To do this the NV index is defined with a write policy that is valid
-only if the NV index attribute "TPMA_NV_WRITTEN" was never set.
+only if the NV index attribute \lqTPMA_NV_WRITTEN\rq was never set.
 .SS Define the NV index write policy
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.dat
-tpm2_policycommandcode\ \-S\ session.dat\ TPM2_CC_NV_Write
-tpm2_policynvwritten\ \-S\ session.dat\ \-L\ nvwrite.policy\ c
-tpm2_flushcontext\ session.dat
-\f
+tpm2_startauthsession \-S session.dat
+tpm2_policycommandcode \-S session.dat TPM2_CC_NV_Write
+tpm2_policynvwritten \-S session.dat \-L nvwrite.policy c
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SS Define the NV index with the policy
 .IP
 .nf
 \fC
-\ tpm2_nvdefine\ \-s\ 1\ \-a\ "authread|policywrite"\ \-p\ nvrdpass\ \-L\ nvwrite.policy
-\f
+ tpm2_nvdefine \-s 1 \-a \dqauthread|policywrite\dq \-p nvrdpass \-L nvwrite.policy
+\fR
 .fi
 .SS Write the NV index by satisfying the policy
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.dat\ \-\-policy\-session
-tpm2_policycommandcode\ \-S\ session.dat\ TPM2_CC_NV_Write
-tpm2_policynvwritten\ \-S\ session.dat\ c
-echo\ 0xAA\ |\ xxd\ \-r\ \-p\ |\ tpm2_nvwrite\ 0x01000000\ \-i\-\ \-P\ session:session.dat
-tpm2_flushcontext\ session.dat
-\f
+tpm2_startauthsession \-S session.dat \-\-policy\-session
+tpm2_policycommandcode \-S session.dat TPM2_CC_NV_Write
+tpm2_policynvwritten \-S session.dat c
+echo 0xAA | xxd \-r \-p | tpm2_nvwrite 0x01000000 \-i\- \-P session:session.dat
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SH Returns
 .PP
@@ -230,17 +247,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policyor.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policyor.1 Changed

@@ -1,52 +1,56 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policyor" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policyor\f(1) \- logically OR\aqs two policies together.
+\fBtpm2_policyor\fR(1) \- logically OR\cqs two policies together.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policyor\f \fIOPTIONS\f
+\fBtpm2_policyor\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policyor\f(1) \- Generates a policy_or event with the TPM.
+\fBtpm2_policyor\fR(1) \- Generates a policy_or event with the TPM.
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1).
+\fBtpm2_startauthsession\fR(1).
 If the input session is a trial session this tool generates a policy
 digest that compounds two or more input policy digests such that the
 resulting policy digest requires at least one of the policy events being
 true.
-If the input session is real policy session \fBtpm2_policyor\f(1)
+If the input session is real policy session \fBtpm2_policyor\fR(1)
 authenticates the object successfully if at least one of the policy
 events are true.
 .SH OPTIONS
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the compounded policy digest.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the list of files
+\fBARGUMENT\fR the command line argument specifies the list of files
 for the policy digests that has to be compounded resulting in individual
 policies being added to final policy digest that can authenticate the
 object.
 The list begins with the policy digest hash alg.
 Example sha256:policy1,policy2
 .IP \bu 2
-\fB\-l\f, \fB\-\-policy\-list\f=\fIPOLICY_FILE\f_LIST:
+\fB\-l\fR, \fB\-\-policy\-list\fR=\fIPOLICY_FILE\fR_LIST:
 .RS 2
 .PP
-This option is retained for backwards compatibility.
+This option is DEPRECATED yet is retained for backwards compatibility.
 Use the argument method instead.
+\fBNOTE\fR: When \fB\-l\fR and an argument is specified it\cqs
+the same as specifying it all at once.
+For instance: \fCtpm2_policyor \-l sha256:file1 sha256:file2\fR is
+the same as \fCtpm2_policyor sha256:file1,file2\fR.
 .RE
 .SS References
 .SH COMMON OPTIONS
@@ -54,31 +58,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -86,18 +91,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -114,84 +119,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -203,62 +215,59 @@
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx
-tpm2_policypcr\ \-S\ session.ctx\ \-L\ policy.pcr\ \-l\ sha256:0,1,2,3
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx
+tpm2_policypcr \-S session.ctx \-L policy.pcr \-l sha256:0,1,2,3
+tpm2_flushcontext session.ctx
+\fR
 .fi
-.SS Create policypassword as second truth value for compounding the
-policies
+.SS Create policypassword as second truth value for compounding the policies
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx
-tpm2_policypassword\ \-S\ session.ctx\ \-L\ policy.pass
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx
+tpm2_policypassword \-S session.ctx \-L policy.pass
+tpm2_flushcontext session.ctx
+\fR
 .fi
-.SS Compound the two policies in an OR fashion with tpm2_policyor
-command
+.SS Compound the two policies in an OR fashion with tpm2_policyor command
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx
-tpm2_policyor\ \-S\ session.ctx\ \-L\ policy.or\ sha256:policy.pass,policy.pcr
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx
+tpm2_policyor \-S session.ctx \-L policy.or sha256:policy.pass,policy.pcr
+tpm2_flushcontext session.ctx
+\fR
 .fi
-.SS Create a sealing object and attach the auth policy from
-tpm2_policyor command
+.SS Create a sealing object and attach the auth policy from tpm2_policyor command
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-c\ prim.ctx\ \-Q
-echo\ "secret"\ |\ tpm2_create\ \-C\ prim.ctx\ \-c\ key.ctx\ \-u\ key.pub\ \-r\ key.priv\ \\
-\-L\ policy.or\ \-i\-
-\f
+tpm2_createprimary \-c prim.ctx \-Q
+echo \dqsecret\dq | tpm2_create \-C prim.ctx \-c key.ctx \-u key.pub \-r key.priv \rs
+\-L policy.or \-i\-
+\fR
 .fi
 .SS Satisfy auth policy using password and unseal the secret
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-policy\-session
-tpm2_policypassword\ \-S\ session.ctx
-tpm2_policyor\ \-S\ session.ctx\ sha256:policy.pass,policy.pcr
-tpm2_unseal\ \-c\ key.ctx\ \-p\ session:session.ctx
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx \-\-policy\-session
+tpm2_policypassword \-S session.ctx
+tpm2_policyor \-S session.ctx sha256:policy.pass,policy.pcr
+tpm2_unseal \-c key.ctx \-p session:session.ctx
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SS Satisfy auth policy using pcr and unseal the secret
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-policy\-session
-tpm2_policypcr\ \-S\ session.ctx\ \-l\ sha256:0,1,2,3
-tpm2_policyor\ \-S\ session.ctx\ sha256:policy.pass,policy.pcr
-tpm2_unseal\ \-c\ key.ctx\ \-p\ session:session.ctx
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx \-\-policy\-session
+tpm2_policypcr \-S session.ctx \-l sha256:0,1,2,3
+tpm2_policyor \-S session.ctx sha256:policy.pass,policy.pcr
+tpm2_unseal \-c key.ctx \-p session:session.ctx
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -279,17 +288,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policypassword.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policypassword.1 Changed

@@ -1,36 +1,45 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policypassword" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policypassword\f(1) \- Enables binding a policy to the
+\fBtpm2_policypassword\fR(1) \- Enables binding a policy to the
 authorization value of the authorized TPM object.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policypassword\f \fIOPTIONS\f
+\fBtpm2_policypassword\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policypassword\f(1) \- Enables a policy that requires the
-object\aqs authentication passphrase be provided.
+\fBtpm2_policypassword\fR(1) \- Enables a policy that requires the
+object\cqs authentication passphrase be provided.
 This is equivalent to authenticating using the object passphrase in
 plaintext, only this enforces it as a policy.
 It provides a mechanism to allow for password authentication when an
 object only allows policy based authorization, ie object attribute
-"userwithauth" is 0.
+\lquserwithauth\rq is 0.
 .SH OPTIONS
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the compounded policy digest.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
+.RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
 .RE
 .SS References
 .SH COMMON OPTIONS
@@ -38,31 +47,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -70,18 +80,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -98,84 +108,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -184,51 +201,51 @@
 value.
 While we could authenticate with an ephemeral password session, in this
 example we will authenticate with the plaintext passphrase in a policy
-session instead using the \fBtpm2_policypassword\f(1) tool.
+session instead using the \fBtpm2_policypassword\fR(1) tool.
 .SS Create the password policy
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.dat
+tpm2_startauthsession \-S session.dat
 
-tpm2_policypassword\ \-S\ session.dat\ \-L\ policy.dat
+tpm2_policypassword \-S session.dat \-L policy.dat
 
-tpm2_flushcontext\ session.dat
-\f
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SS Create the object with a passphrase and the password policy
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx
+tpm2_createprimary \-C o \-c prim.ctx
 
-tpm2_create\ \-g\ sha256\ \-G\ aes\ \-u\ key.pub\ \-r\ key.priv\ \-C\ prim.ctx\ \-L\ policy.dat\ \\
-\ \ \-p\ testpswd
-\f
+tpm2_create \-g sha256 \-G aes \-u key.pub \-r key.priv \-C prim.ctx \-L policy.dat \rs
+  \-p testpswd
+\fR
 .fi
 .SS Authenticate with plaintext passphrase input
 .IP
 .nf
 \fC
-tpm2_load\ \-C\ prim.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-n\ key.name\ \-c\ key.ctx
+tpm2_load \-C prim.ctx \-u key.pub \-r key.priv \-n key.name \-c key.ctx
 
-echo\ "plaintext"\ >\ plain.txt
-tpm2_encryptdecrypt\ \-c\ key.ctx\ \-o\ encrypt.out\ plain.txt\ \-p\ testpswd\ plain.txt
-\f
+echo \dqplaintext\dq > plain.txt
+tpm2_encryptdecrypt \-c key.ctx \-o encrypt.out plain.txt \-p testpswd plain.txt
+\fR
 .fi
 .SS Authenticate with password and the policy
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \\\-\-policy\-session\ \-S\ session.dat
+tpm2_startauthsession \rs\-\-policy\-session \-S session.dat
 
-tpm2_policypassword\ \-S\ session.dat\ \-L\ policy.dat
+tpm2_policypassword \-S session.dat \-L policy.dat
 
-tpm2_encryptdecrypt\ \-c\ key.ctx\ \-o\ encrypt.out\ \\
-\ \ \-p\ session:session.dat+testpswd\ plain.txt
+tpm2_encryptdecrypt \-c key.ctx \-o encrypt.out \rs
+  \-p session:session.dat+testpswd plain.txt
 
-tpm2_flushcontext\ session.dat
-\f
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SH Returns
 .PP
@@ -249,17 +266,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policypcr.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policypcr.1 Changed

@@ -1,41 +1,42 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policypcr" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policypcr\f(1) \- Create a policy that includes specific PCR
-values.
+\fBtpm2_policypcr\fR(1) \- Create a policy that includes specific
+PCR values.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policypcr\f \fIOPTIONS\f
+\fBtpm2_policypcr\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policypcr\f(1) \- Generates a PCR policy event with the TPM.
+\fBtpm2_policypcr\fR(1) \- Generates a PCR policy event with the
+TPM.
 A PCR policy event creates a policy bound to specific PCR values and is
 useful within larger policies constructed using policyor and
 policyauthorize events.
-See \fBtpm2_policyor(1)\f and \fBtpm2_policyauthorize(1)\f
+See \fBtpm2_policyor(1)\fR and \fBtpm2_policyauthorize(1)\fR
 respectively for their usages.
 The PCR data factored into the policy can be specified in one of 3 ways:
 1.
 A file containing a concatenated list of PCR values as in the output
-from \fBtpm2_pcrread\f.
+from \fBtpm2_pcrread\fR.
 2.
 Requiring the PCR values be read off the TPM by not specifying a PCR
 file input.
 3.
 The digest of all the PCR values directly specified as an
-\fBargument\f.
+\fBargument\fR.
 .SH OPTIONS
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the policy digest.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-pcr\f=\fIFILE\f:
+\fB\-f\fR, \fB\-\-pcr\fR=\fIFILE\fR:
 .RS 2
 .PP
 Optional Path or Name of the file containing expected PCR values for the
@@ -43,33 +44,32 @@
 Default is to read the current PCRs per the set list.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-pcr\-list\f=\fIPCR\f:
+\fB\-l\fR, \fB\-\-pcr\-list\fR=\fIPCR\fR:
 .RS 2
 .PP
-The list of PCR banks and selected PCRs\aq ids for each bank.
+The list of PCR banks and selected PCRs\cq ids for each bank.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
 .RE
 .IP \bu 2
-\fBARGUMENT\f: The calculated digest of all PCR values specified as
+\fBARGUMENT\fR: The calculated digest of all PCR values specified as
 a hex byte stream.
-Eg:
-\fCopenssl\ dgst\ \-sha256\ \-binary\ pcr.bin\ |\ xxd\ \-p\ \-c\ 32\f
+Eg: \fCopenssl dgst \-sha256 \-binary pcr.bin | xxd \-p \-c 32\fR
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -82,8 +82,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -92,45 +91,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -138,69 +137,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -209,28 +210,28 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH PCR Bank Specifiers
 .PP
 PCR Bank Selection lists follow the below specification:
 .IP
 .nf
 \fC
-<BANK>:<PCR>,<PCR>\ or\ <BANK>:all
-\f
+<BANK>:<PCR>,<PCR> or <BANK>:all
+\fR
 .fi
 .PP
-multiple banks may be separated by \aq+\aq.
+multiple banks may be separated by `+'.
 .PP
 For example:
 .IP
 .nf
 \fC
 sha1:3,4+sha256:all
-\f
+\fR
 .fi
 .PP
 will select PCRs 3 and 4 from the SHA1 bank and PCRs 0 to 23 from the
@@ -240,37 +241,38 @@
 PCR Selections allow for up to 5 hash to pcr selection mappings.
 This is a limitation in design in the single call to the tpm to get the
 pcr values.
-\fIPCR\f.
+\fIPCR\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -278,18 +280,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -306,136 +308,143 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .PP
-Starts a \fItrial\f session, builds a PCR policy and uses that
+Starts a \fItrial\fR session, builds a PCR policy and uses that
 policy in the creation of an object.
-Then, it uses a \fIpolicy\f session to unseal some data stored in
+Then, it uses a \fIpolicy\fR session to unseal some data stored in
 the object.
 .SS Step 1: create a policy
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ e\ \-g\ sha256\ \-G\ ecc\ \-c\ primary.ctx
+tpm2_createprimary \-C e \-g sha256 \-G ecc \-c primary.ctx
 
-tpm2_pcrread\ \-o\ pcr.dat\ "sha1:0,1,2,3"
+tpm2_pcrread \-o pcr.dat \dqsha1:0,1,2,3\dq
 
-tpm2_startauthsession\ \-S\ session.dat
+tpm2_startauthsession \-S session.dat
 
-tpm2_policypcr\ \-S\ session.dat\ \-l\ "sha1:0,1,2,3"\ \-f\ pcr.dat\ \-L\ policy.dat
+tpm2_policypcr \-S session.dat \-l \dqsha1:0,1,2,3\dq \-f pcr.dat \-L policy.dat
 
-tpm2_flushcontext\ session.dat
-\f
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SH Step 2: create an object using that policy
 .IP
 .nf
 \fC
-tpm2_create\ \-Q\ \-u\ key.pub\ \-r\ key.priv\ \-C\ primary.ctx\ \-L\ policy.dat\ \\
-\-i\-\ <<<\ "12345678"
+tpm2_create \-Q \-u key.pub \-r key.priv \-C primary.ctx \-L policy.dat \rs
+\-i\- <<< \dq12345678\dq
 
-tpm2_load\ \-C\ primary.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-n\ unseal.key.name\ \\
-\-c\ unseal.key.ctx
-\f
+tpm2_load \-C primary.ctx \-u key.pub \-r key.priv \-n unseal.key.name \rs
+\-c unseal.key.ctx
+\fR
 .fi
 .SS Step 3: Satisfy the policy
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-\-policy\-session\ \-S\ session.dat
+tpm2_startauthsession \-\-policy\-session \-S session.dat
 
-tpm2_policypcr\ \-S\ session.dat\ \-l\ "sha1:0,1,2,3"\ \-f\ pcr.dat\ \-L\ policy.dat
-\f
+tpm2_policypcr \-S session.dat \-l \dqsha1:0,1,2,3\dq \-f pcr.dat \-L policy.dat
+\fR
 .fi
 .SS Step 4: Use the policy
 .IP
 .nf
 \fC
-tpm2_unseal\ \-psession:session.dat\ \-c\ unseal.key.ctx
+tpm2_unseal \-psession:session.dat \-c unseal.key.ctx
 12345678
 
-tpm2_flushcontext\ session.dat
-\f
+tpm2_flushcontext session.dat
+\fR
 .fi
 .SH Returns
 .PP
@@ -456,17 +465,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policyrestart.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policyrestart.1 Changed

@@ -1,20 +1,20 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policyrestart" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policyrestart\f(1) \- Restart an existing session with the
+\fBtpm2_policyrestart\fR(1) \- Restart an existing session with the
 TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policyrestart\f \fIOPTIONS\f
+\fBtpm2_policyrestart\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policyrestart\f(1) \- Restarts a session with the TPM back
-to it\aqs initial state.
-This is useful when the TPM gives one a \fBTPM_RC_PCR_CHANGED\f
-(\fC0x00000128\f) error code when using a PCR policy session.
+\fBtpm2_policyrestart\fR(1) \- Restarts a session with the TPM back
+to it\cqs initial state.
+This is useful when the TPM gives one a \fBTPM_RC_PCR_CHANGED\fR
+(\fC0x00000128\fR) error code when using a PCR policy session.
 .PP
 This will be returned if a PCR state affecting policy is altered during
 the session.
@@ -22,45 +22,55 @@
 would still need to satisfy the policy.
 .SH OPTIONS
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-Optional, A session file from \fBtpm2_startauthsession\f(1)\aqs
-\fB\-S\f option.
+Optional, A session file from \fBtpm2_startauthsession\fR(1)\cqs
+\fB\-S\fR option.
 This session is used in lieu of starting a session and using the PCR
 policy options.
 .RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the command parameters.
+This is commonly termed as cpHash.
+NOTE: When this option is selected, The tool will not actually execute
+the command, it simply returns a cpHash.
+.RE
 .SS References
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -68,18 +78,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -96,119 +106,126 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
-.SS Start a \fIpolicy\f session and restart it, unsealing some data.
+.SS Start a \fIpolicy\fR session and restart it, unsealing some data.
 .IP
 .nf
 \fC
-#\ create\ a\ policy\ and\ bind\ it\ to\ an\ object
-tpm2_startauthsession\ \-S\ session.dat
+# create a policy and bind it to an object
+tpm2_startauthsession \-S session.dat
 
-tpm2_policypcr\ \-S\ session.dat\ \-l\ "sha1:0,1,2,3"\ \-L\ policy.dat
+tpm2_policypcr \-S session.dat \-l \dqsha1:0,1,2,3\dq \-L policy.dat
 
-tpm2_createprimary\ \-c\ primary.ctx
+tpm2_createprimary \-c primary.ctx
 
-tpm2_create\ \-Cprimary.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-L\ policy.dat\ \-i\-\ <<<\ "secret"
+tpm2_create \-Cprimary.ctx \-u key.pub \-r key.priv \-L policy.dat \-i\- <<< \dqsecret\dq
 
-tpm2_load\ \-C\ primary.ctx\ \-c\ key.ctx\ \-u\ key.pub\ \-r\ key.priv
+tpm2_load \-C primary.ctx \-c key.ctx \-u key.pub \-r key.priv
 
-tpm2_flushcontext\ session.dat
+tpm2_flushcontext session.dat
 
-#\ satisfy\ the\ policy\ and\ use\ the\ object
-tpm2_startauthsession\ \-\-policy\ \-S\ session.dat
+# satisfy the policy and use the object
+tpm2_startauthsession \-\-policy \-S session.dat
 
-tpm2_policypcr\ \-S\ session.dat\ \-l\ "sha1:0,1,2,3"
+tpm2_policypcr \-S session.dat \-l \dqsha1:0,1,2,3\dq
 
-#\ PCR\ event\ occurs\ here\ causing\ unseal\ to\ fail
-tpm2_pcrevent\ 0\ <<<\ "event\ data"
+# PCR event occurs here causing unseal to fail
+tpm2_pcrevent 0 <<< \dqevent data\dq
 
-tpm2_unseal\ \-psession:session.dat\ \-c\ key.ct
-ERROR:\ Esys_Unseal(0x128)\ \-\ tpm:error(2.0):\ PCR\ have\ changed\ since\ checked
+tpm2_unseal \-psession:session.dat \-c key.ct
+ERROR: Esys_Unseal(0x128) \- tpm:error(2.0): PCR have changed since checked
 
-#\ Clear\ the\ policy\ digest\ to\ initial\ state,\ note\ access\ to\ object\ no\ longer\ allowed\ by
-#\ policy\ so\ policyor\ would\ be\ useful\ here.
-tpm2_policyrestart\ \-S\ session.dat
-\f
+# Clear the policy digest to initial state, note access to object no longer allowed by
+# policy so policyor would be useful here.
+tpm2_policyrestart \-S session.dat
+\fR
 .fi
 .SH Returns
 .PP
@@ -229,17 +246,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policysecret.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policysecret.1 Changed

@@ -1,48 +1,48 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policysecret" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policysecret\f(1) \- Couples the authorization of an object
+\fBtpm2_policysecret\fR(1) \- Couples the authorization of an object
 to that of an existing object.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policysecret\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_policysecret\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policysecret\f(1) \- Couples the authorization of an object
+\fBtpm2_policysecret\fR(1) \- Couples the authorization of an object
 to that of an existing object without requiring exposing the existing
 secret until time of object use.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-object\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-object\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 A context object specifier of a transient/permanent/persistent object.
 Either a file path of a object context blob or a
 loaded/persistent/permanent handle id.
-See section "Context Object Format".
+See section \lqContext Object Format\rq.
 As an argument, it takes the auth value of the associated TPM object, a
 single dash \- can be used to read the auth value from stdin.
-The argument follows the "authorization formatting standards", see
-section "Authorization Formatting".
+The argument follows the \lqauthorization formatting standards\rq,
+see section \lqAuthorization Formatting\rq.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the policy digest.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-expiration\f=\fINATURAL_NUMBER\f:
+\fB\-t\fR, \fB\-\-expiration\fR=\fINATURAL_NUMBER\fR:
 .RS 2
 .PP
 Set the expiration time of the policy in seconds.
@@ -51,27 +51,27 @@
 the authorization.
 .RE
 .IP \bu 2
-\fB\-\-ticket\f=\fIFILE\f:
+\fB\-\-ticket\fR=\fIFILE\fR:
 .RS 2
 .PP
 The ticket file to record the authorization ticket structure.
 .RE
 .IP \bu 2
-\fB\-\-timeout\f=\fIFILE\f:
+\fB\-\-timeout\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file path to record the timeout structure returned.
 .RE
 .IP \bu 2
-\fB\-x\f, \fB\-\-nonce\-tpm\f:
+\fB\-x\fR, \fB\-\-nonce\-tpm\fR:
 .RS 2
 .PP
-Enable the comparison of the current session\aqs nonceTPM to ensure
+Enable the comparison of the current session\cqs nonceTPM to ensure
 the validity of the policy authorization is limited to the current
 session.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-qualification\f=\fIFILE_OR_HEX_STR\f:
+\fB\-q\fR, \fB\-\-qualification\fR=\fIFILE_OR_HEX_STR\fR:
 .RS 2
 .PP
 Optional, the policy qualifier data that the signer can choose to
@@ -79,7 +79,7 @@
 Can be either a hex string or path.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -89,18 +89,18 @@
 policycphash.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the \fIAUTH\f
-to be set for the object specified with \fB\-c\f.
+\fBARGUMENT\fR the command line argument specifies the
+\fIAUTH\fR to be set for the object specified with \fB\-c\fR.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -113,8 +113,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -123,45 +122,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -169,69 +168,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -240,40 +241,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -281,18 +283,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -309,91 +311,98 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .PP
 Associate auth value of a sealing object to the owner hierarchy
 password.
-* Start a trial auth session and run \fBtpm2_policysecret\f(1) to
+* Start a trial auth session and run \fBtpm2_policysecret\fR(1) to
 create policy that can only be satisfied if owner hierarchy auth value
 is supplied.
 * Start a real policy session and provide the owner hierarchy auth
@@ -405,39 +414,39 @@
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx
+tpm2_startauthsession \-S session.ctx
 
-tpm2_policysecret\ \-S\ session.ctx\ \-c\ o\ \-L\ secret.policy
+tpm2_policysecret \-S session.ctx \-c o \-L secret.policy
 
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SS Create a TPM object using the policy
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-Q\ \-C\ o\ \-g\ sha256\ \-G\ rsa\ \-c\ prim.ctx
+tpm2_createprimary \-Q \-C o \-g sha256 \-G rsa \-c prim.ctx
 
-tpm2_create\ \-Q\ \-g\ sha256\ \-u\ sealing_key.pub\ \-r\ sealing_key.priv\ \-i\-\ \\
-\ \ \-C\ prim.ctx\ \-L\ secret.policy\ <<<\ "SEALED\-SECRET"
+tpm2_create \-Q \-g sha256 \-u sealing_key.pub \-r sealing_key.priv \-i\- \rs
+  \-C prim.ctx \-L secret.policy <<< \dqSEALED\-SECRET\dq
 
-tpm2_load\ \-C\ prim.ctx\ \-u\ sealing_key.pub\ \-r\ sealing_key.priv\ \\
-\ \ \-c\ sealing_key.ctx
-\f
+tpm2_load \-C prim.ctx \-u sealing_key.pub \-r sealing_key.priv \rs
+  \-c sealing_key.ctx
+\fR
 .fi
 .SS Satisfy the policy and unseal the secret
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-\-policy\-session\ \-S\ session.ctx
+tpm2_startauthsession \-\-policy\-session \-S session.ctx
 
-tpm2_policysecret\ \-S\ session.ctx\ \-c\ o\ \-L\ secret.policy
+tpm2_policysecret \-S session.ctx \-c o \-L secret.policy
 
-tpm2_unseal\ \-p\ "session:session.ctx"\ \-c\ sealing_key.ctx
+tpm2_unseal \-p \dqsession:session.ctx\dq \-c sealing_key.ctx
 SEALED\-SECRET
 
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -458,17 +467,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policysigned.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policysigned.1 Changed

@@ -1,58 +1,58 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policysigned" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policysigned\f(1) \- Enables policy authorization by
+\fBtpm2_policysigned\fR(1) \- Enables policy authorization by
 verifying signature of optional TPM2 parameters.
 The signature is generated by a signing authority.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policysigned\f \fIOPTIONS\f
+\fBtpm2_policysigned\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policysigned\f(1) \- Enables policy authorization by
+\fBtpm2_policysigned\fR(1) \- Enables policy authorization by
 verifying signature of optional TPM2 parameters.
 The signature is generated by a signing authority.
 The optional TPM2 parameters being cpHashA, nonceTPM, policyRef and
 expiration.
 .SH OPTIONS
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the compounded policy digest.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Context object for the key context used for the operation.
 Either a file or a handle number.
-See section "Context Object Format".
+See section \lqContext Object Format\rq.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm used to digest the message.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-signature\f=\fIFILE\f:
+\fB\-s\fR, \fB\-\-signature\fR=\fIFILE\fR:
 .RS 2
 .PP
 The input signature file of the signature to be validated.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-format\f=\fIFORMAT\f:
+\fB\-f\fR, \fB\-\-format\fR=\fIFORMAT\fR:
 .RS 2
 .PP
 Set the input signature file to a specified format.
@@ -62,7 +62,7 @@
 The tool currently supports rsassa and ecdsa.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-expiration\f=\fINATURAL_NUMBER\f:
+\fB\-t\fR, \fB\-\-expiration\fR=\fINATURAL_NUMBER\fR:
 .RS 2
 .PP
 Set the expiration time of the policy in seconds.
@@ -73,26 +73,26 @@
 the authorization.
 .RE
 .IP \bu 2
-\fB\-\-cphash\-input\f=\fIFILE\f:
+\fB\-\-cphash\-input\fR=\fIFILE\fR:
 .RS 2
 .PP
 The command parameter hash (cpHash), enforcing the TPM command to be
 authorized as well as its handle and parameter values.
 .RE
 .IP \bu 2
-\fB\-\-ticket\f=\fIFILE\f:
+\fB\-\-ticket\fR=\fIFILE\fR:
 .RS 2
 .PP
 The ticket file to record the authorization ticket structure.
 .RE
 .IP \bu 2
-\fB\-\-timeout\f=\fIFILE\f:
+\fB\-\-timeout\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file path to record the timeout structure returned.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-qualification\f=\fIFILE_OR_HEX_STR\f:
+\fB\-q\fR, \fB\-\-qualification\fR=\fIFILE_OR_HEX_STR\fR:
 .RS 2
 .PP
 Optional, the policy qualifier data that the signer can choose to
@@ -100,10 +100,10 @@
 Can be either a hex string or path.
 .RE
 .IP \bu 2
-\fB\-x\f, \fB\-\-nonce\-tpm\f:
+\fB\-x\fR, \fB\-\-nonce\-tpm\fR:
 .RS 2
 .PP
-Enable the comparison of the current session\aqs nonceTPM to ensure
+Enable the comparison of the current session\cqs nonceTPM to ensure
 the validity of the policy authorization is limited to the current
 session.
 .RE
@@ -113,31 +113,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -145,18 +146,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -173,84 +174,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -261,59 +269,58 @@
 .IP
 .nf
 \fC
-openssl\ genrsa\ \-out\ private.pem\ 2048
+openssl genrsa \-out private.pem 2048
 
-openssl\ rsa\ \-in\ private.pem\ \-outform\ PEM\ \-pubout\ \-out\ public.pem
-\f
+openssl rsa \-in private.pem \-outform PEM \-pubout \-out public.pem
+\fR
 .fi
-.SS Generate signature with nonceTPM, cpHashA, policyRef and expiration
-set to 0
+.SS Generate signature with nonceTPM, cpHashA, policyRef and expiration set to 0
 .IP
 .nf
 \fC
-echo\ "00\ 00\ 00\ 00"\ |\ xxd\ \-r\ \-p\ |\ \\
-openssl\ dgst\ \-sha256\ \-sign\ private.pem\ \-out\ signature.dat
-\f
+echo \dq00 00 00 00\dq | xxd \-r \-p | \rs
+openssl dgst \-sha256 \-sign private.pem \-out signature.dat
+\fR
 .fi
 .SS Load the verification key and Create the policysigned policy
 .IP
 .nf
 \fC
-tpm2_loadexternal\ \-C\ o\ \-G\ rsa\ \-u\ public.pem\ \-c\ signing_key.ctx
+tpm2_loadexternal \-C o \-G rsa \-u public.pem \-c signing_key.ctx
 
-tpm2_startauthsession\ \-S\ session.ctx
+tpm2_startauthsession \-S session.ctx
 
-tpm2_policysigned\ \-S\ session.ctx\ \-g\ sha256\ \-s\ signature.dat\ \-f\ rsassa\ \\
-\-c\ signing_key.ctx\ \-L\ policy.signed
+tpm2_policysigned \-S session.ctx \-g sha256 \-s signature.dat \-f rsassa \rs
+\-c signing_key.ctx \-L policy.signed
 
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SS Create a sealing object to use the policysigned
 .IP
 .nf
 \fC
-echo\ "plaintext"\ >\ secret.data
+echo \dqplaintext\dq > secret.data
 
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx
+tpm2_createprimary \-C o \-c prim.ctx
 
-tpm2_create\ \-u\ key.pub\ \-r\ sealing_key.priv\ \-c\ sealing_key.ctx\ \-C\ prim.ctx\ \\
-\-i\ secret.data\ \-L\ policy.signed
-\f
+tpm2_create \-u key.pub \-r sealing_key.priv \-c sealing_key.ctx \-C prim.ctx \rs
+\-i secret.data \-L policy.signed
+\fR
 .fi
 .SS Satisfy the policy and unseal secret
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-policy\-session
+tpm2_startauthsession \-S session.ctx \-\-policy\-session
 
-tpm2_policysigned\ \-S\ session.ctx\ \-g\ sha256\ \-s\ signature.dat\ \-f\ rsassa\ \\
-\-c\ signing_key.ctx\ \-L\ policy.signed
+tpm2_policysigned \-S session.ctx \-g sha256 \-s signature.dat \-f rsassa \rs
+\-c signing_key.ctx \-L policy.signed
 
-tpm2_unseal\ \-p\ session:session.ctx\ \-c\ sealing_key.ctx
+tpm2_unseal \-p session:session.ctx \-c sealing_key.ctx
 
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -334,17 +341,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policytemplate.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policytemplate.1 Changed

@@ -1,36 +1,36 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_policytemplate" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_policytemplate\f(1) \- Couples a policy with public template
-data digest of an object.
+\fBtpm2_policytemplate\fR(1) \- Couples a policy with public
+template data digest of an object.
 .SH SYNOPSIS
 .PP
-\fBtpm2_policytemplate\f \fIOPTIONS\f
+\fBtpm2_policytemplate\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_policytemplate\f(1) \- Couples a policy with public template
-data digest of an object.
+\fBtpm2_policytemplate\fR(1) \- Couples a policy with public
+template data digest of an object.
 This is a deferred assertion where the hash of the public template data
 of an object is checked against the one specified in the policy.
 .SH OPTIONS
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the compounded policy digest.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
 .RE
 .IP \bu 2
-\fB\-\-template\-hash\f=\fIFILE\f:
+\fB\entemplate\-hash\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file containing the hash of the public template of the object.
@@ -41,31 +41,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -73,18 +74,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -101,84 +102,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -186,22 +194,22 @@
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx\ \-\-template\-data\ template.data
+tpm2_createprimary \-C o \-c prim.ctx \-\-template\-data template.data
 
-cat\ template.data\ |\ openssl\ dgst\ \-sha256\ \-binary\ \-out\ template.hash
+cat template.data | openssl dgst \-sha256 \-binary \-out template.hash
 
-tpm2_startauthsession\ \-S\ session.ctx\ \-g\ sha256
-tpm2_policytemplate\ \-S\ session.ctx\ \-L\ policy.template\ \\
-\-\-template\-hash\ template.hash
-tpm2_flushcontext\ session.ctx
+tpm2_startauthsession \-S session.ctx \-g sha256
+tpm2_policytemplate \-S session.ctx \-L policy.template \rs
+\-\-template\-hash template.hash
+tpm2_flushcontext session.ctx
 
-tpm2_setprimarypolicy\ \-C\ o\ \-g\ sha256\ \-L\ policy.template
+tpm2_setprimarypolicy \-C o \-g sha256 \-L policy.template
 
-tpm2_startauthsession\ \-S\ session.ctx\ \-g\ sha256\ \-\-policy\-session
-tpm2_policytemplate\ \-S\ session.ctx\ \-\-template\-hash\ template.hash
-tpm2_createprimary\ \-C\ o\ \-c\ prim2.ctx\ \-P\ session:session.ctx
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_startauthsession \-S session.ctx \-g sha256 \-\-policy\-session
+tpm2_policytemplate \-S session.ctx \-\-template\-hash template.hash
+tpm2_createprimary \-C o \-c prim2.ctx \-P session:session.ctx
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -222,17 +230,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_policyticket.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_policyticket.1 Changed

@@ -1,54 +1,54 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_ticket" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_ticket\f(1) \- Enables policy authorization by verifying a
+\fBtpm2_ticket\fR(1) \- Enables policy authorization by verifying a
 ticket that represents a validated authorization that had an expiration
 time associated with it.
 .SH SYNOPSIS
 .PP
-\fBtpm2_ticket\f \fIOPTIONS\f
+\fBtpm2_ticket\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_ticket\f(1) \- Enables policy authorization by verifying a
+\fBtpm2_ticket\fR(1) \- Enables policy authorization by verifying a
 ticket that represents a validated authorization that had an expiration
 time associated with it.
 .SH OPTIONS
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 File to save the compounded policy digest.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
-The policy session file generated via the \fB\-S\f option to
-\fBtpm2_startauthsession\f(1).
+The policy session file generated via the \fB\-S\fR option to
+\fBtpm2_startauthsession\fR(1).
 .RE
 .IP \bu 2
-\fB\-n\f, \fB\-\-name\f=\fIFILE\f:
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
 .RS 2
 .PP
 Name of the object that validated the authorization.
 .RE
 .IP \bu 2
-\fB\-\-ticket\f=\fIFILE\f:
+\fB\-\-ticket\fR=\fIFILE\fR:
 .RS 2
 .PP
 The ticket file to record the authorization ticket structure.
 .RE
 .IP \bu 2
-\fB\-\-timeout\f=\fIFILE\f:
+\fB\-\-timeout\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file path to record the timeout structure returned.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-qualification\f=\fIFILE_OR_HEX_STR\f:
+\fB\-q\fR, \fB\-\-qualification\fR=\fIFILE_OR_HEX_STR\fR:
 .RS 2
 .PP
 Optional, the policy qualifier data that the signer can choose to
@@ -61,31 +61,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -93,18 +94,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -121,84 +122,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -209,75 +217,76 @@
 .IP
 .nf
 \fC
-openssl\ genrsa\ \-out\ private.pem\ 2048
+openssl genrsa \-out private.pem 2048
 
-openssl\ rsa\ \-in\ private.pem\ \-outform\ PEM\ \-pubout\ \-out\ public.pem
+openssl rsa \-in private.pem \-outform PEM \-pubout \-out public.pem
 
-tpm2_loadexternal\ \-C\ o\ \-G\ rsa\ \-u\ public.pem\ \-c\ signing_key.ctx\ \\
-\-n\ signing_key.name
-\f
+tpm2_loadexternal \-C o \-G rsa \-u public.pem \-c signing_key.ctx \rs
+\-n signing_key.name
+\fR
 .fi
 .SS Generate signature with the expiry time
 .IP
 .nf
 \fC
-EXPIRYTIME="FFFFFE0C"
+EXPIRYTIME=\dqFFFFFE0C\dq
 
-echo\ $EXPIRYTIME\ |\ xxd\ \-r\ \-p\ |\ \\
-openssl\ dgst\ \-sha256\ \-sign\ private.pem\ \-out\ signature.dat
-\f
+echo $EXPIRYTIME | xxd \-r \-p | \rs
+openssl dgst \-sha256 \-sign private.pem \-out signature.dat
+\fR
 .fi
 .SS Create the policy
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx
+tpm2_startauthsession \-S session.ctx
 
-tpm2_policysigned\ \-S\ session.ctx\ \-g\ sha256\ \-s\ signature.dat\ \-f\ rsassa\ \\
-\-c\ signing_key.ctx\ \-L\ policy.signed
+tpm2_policysigned \-S session.ctx \-g sha256 \-s signature.dat \-f rsassa \rs
+\-c signing_key.ctx \-L policy.signed
 
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_flushcontext session.ctx
+\fR
 .fi
 .SS Create a sealing object
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx\ \-Q
+tpm2_createprimary \-C o \-c prim.ctx \-Q
 
-echo\ "plaintext"\ >\ secret.dat
+echo \dqplaintext\dq > secret.dat
 
-tpm2_create\ \-u\ sealing_key.pub\ \-r\ sealing_key.priv\ \-c\ sealing_key.ctx\ \\
-\-C\ prim.ctx\ \-i\ secret.dat\ \-L\ policy.signed\ \-Q
-\f
+tpm2_create \-u sealing_key.pub \-r sealing_key.priv \-c sealing_key.ctx \rs
+\-C prim.ctx \-i secret.dat \-L policy.signed \-Q
+\fR
 .fi
 .SS Create ticket\-able policy
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-nonce\-tpm=nonce.test\ \-\-policy\-session
+tpm2_startauthsession \-S session.ctx \-\-nonce\-tpm=nonce.test \-\-policy\-session
 
-{\ cat\ nonce.test\ &\ echo\ $EXPIRYTIME\ |\ xxd\ \-r\ \-p;\ }\ |\ \\
-openssl\ dgst\ \-sha256\ \-sign\ private.pem\ \-out\ signature.dat
+{ cat nonce.test & echo $EXPIRYTIME | xxd \-r \-p; } | \rs
+openssl dgst \-sha256 \-sign private.pem \-out signature.dat
 
-tpm2_policysigned\ \-S\ session.ctx\ \-g\ sha256\ \-s\ signature.dat\ \-f\ rsassa\ \\
-\-c\ signing_key.ctx\ \-x\ nonce.test\ \-\-ticket\ tic.ket\ \-\-timeout\ time.out\ \\
-\-t\ 0xFFFFFE0C
+tpm2_policysigned \-S session.ctx \-g sha256 \-s signature.dat \-f rsassa \rs
+\-c signing_key.ctx \-x nonce.test \-\-ticket tic.ket \-\-timeout time.out \rs
+\-t 0xFFFFFE0C
 
-tpm2_flushcontext\ session.ctx
-\f
+tpm2_flushcontext session.ctx
+\fR
 .fi
-.SS Test with policyticket instead of policysigned
+.PP
+##Test with policyticket instead of policysigned
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ session.ctx\ \-\-policy\-session
+tpm2_startauthsession \-S session.ctx \-\-policy\-session
 
-tpm2_policyticket\ \-S\ session.ctx\ \-n\ signing_key.name\ \-\-ticket\ tic.ket\ \\
-\-\-timeout\ time.out
+tpm2_policyticket \-S session.ctx \-n signing_key.name \-\-ticket tic.ket \rs
+\-\-timeout time.out
 
-tpm2_unseal\ \-p\ session:session.ctx\ \-c\ sealing_key.ctx
-\f
+tpm2_unseal \-p session:session.ctx \-c sealing_key.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -298,17 +307,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_print.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_print.1 Changed

@@ -1,50 +1,70 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_print" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_print\f(1) \- Prints TPM data structures
+\fBtpm2_print\fR(1) \- Prints TPM data structures
 .SH SYNOPSIS
 .PP
-\fBtpm2_print\f \fIOPTIONS\f \fIARGUMENT\f or
-\fISTDIN\f
+\fBtpm2_print\fR \fIOPTIONS\fR \fIARGUMENT\fR or
+\fISTDIN\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_print\f(1) \- Decodes a TPM data structure and prints
+\fBtpm2_print\fR(1) \- Decodes a TPM data structure and prints
 enclosed elements to stdout as YAML.
-A file path containing a TPM object may be specified as the path
-argument.
+A file path containing a TPM object or a TSS2 Private Key in the PEM
+format may be specified as the path argument.
 Reads from stdin if unspecified.
 .SH OPTIONS
 .IP \bu 2
-\fB\-t\f, \fB\-\-type\f:
+\fB\-t\fR, \fB\-\-type\fR:
 .RS 2
 Required.
 Type of data structure.
 The option supports the following arguments:
 .IP \bu 2
-\fBTPMS_ATTEST\f
+\fBTPMS_ATTEST\fR
 .IP \bu 2
-\fBTPMS_CONTEXT\f
+\fBTPMS_CONTEXT\fR
 .IP \bu 2
-\fBTPM2B_PUBLIC\f
+\fBTPM2B_PUBLIC\fR
 .IP \bu 2
-\fBTPMT_PUBLIC\f
+\fBTPMT_PUBLIC\fR
+.IP \bu 2
+\fBTSSPRIVKEY_OBJ\fR
+.IP \bu 2
+\fBESYS_TR\fR
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the path of the
+\fBARGUMENT\fR the command line argument specifies the path of the
 TPM data.
+.IP \bu 2
+\fB\-f\fR, \fB\-\-format\fR:
+.RS 2
+.PP
+Format selection for the public key output file.
+`tss' (the default) will output a binary blob according to the TPM 2.0
+Specification.
+`pem' will output an OpenSSL compatible PEM encoded public key.
+`der' will output an OpenSSL compatible DER encoded public key.
+`tpmt' will output a binary blob of the TPMT_PUBLIC struct referenced by
+TPM 2.0 specs.
+.PP
+Public key format.
+This only works if option \fC\-\-type/\-t\fR is set to TPM2B_PUBLIC
+or TPMT_PUBLIC.
+.RE
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -57,8 +77,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -67,45 +86,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -113,69 +132,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -184,40 +205,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -225,18 +247,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -253,84 +275,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SS References
@@ -339,31 +368,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -371,18 +401,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -399,84 +429,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -485,33 +522,61 @@
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ e\ \-c\ primary.ctx
-tpm2_create\ \-C\ primary.ctx\ \-u\ key.pub\ \-r\ key.priv
-tpm2_load\ \-C\ primary.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-c\ key.ctx
-tpm2_quote\ \-c\ key.ctx\ \-l\ 0x0004:16,17,18+0x000b:16,17,18\ \-g\ sha256\ \-m\ msg.dat
-\f
+tpm2_createprimary \-C e \-c primary.ctx
+tpm2_create \-C primary.ctx \-u key.pub \-r key.priv
+tpm2_load \-C primary.ctx \-u key.pub \-r key.priv \-c key.ctx
+tpm2_quote \-c key.ctx \-l 0x0004:16,17,18+0x000b:16,17,18 \-g sha256 \-m msg.dat
+\fR
 .fi
 .SS Print a Quote
 .IP
 .nf
 \fC
-tpm2_print\ \-t\ TPMS_ATTEST\ msg.dat
-\f
+tpm2_print \-t TPMS_ATTEST msg.dat
+\fR
 .fi
 .SS Print a public file
 .IP
 .nf
 \fC
-tpm2_print\ \-t\ TPM2B_PUBLIC\ key.pub
-\f
+tpm2_print \-t TPM2B_PUBLIC key.pub
+\fR
 .fi
 .SS Print a tpmt public file
 .IP
 .nf
 \fC
-tpm2_readpublic\ \-c\ key.ctx\ \-f\ tpmt\ \-o\ key.tpmt
-tpm2_print\ \-t\ TPMT_PUBLIC\ key.tpmt
-\f
+tpm2_readpublic \-c key.ctx \-f tpmt \-o key.tpmt
+tpm2_print \-t TPMT_PUBLIC key.tpmt
+\fR
+.fi
+.SS Print a TPM2B_PUBLIC file and convert to PEM format
+.IP
+.nf
+\fC
+tpm2 print \-t TPM2B_PUBLIC \-f pem key.pub
+\fR
+.fi
+.SS Print public portion of TSSPRIVKEY PEM file and convert to PEM format
+.IP
+.nf
+\fC
+tpm2 print \-t TSSPRIVKEY_OBJ tssprivkey.pem
+tpm2 print \-t TSSPRIVKEY_OBJ tssprivkey.pem \-f pem > publickey.pem
+\fR
+.fi
+.SS Print the name of a serialized ESYS_TR handle.
+.PP
+Serialized ESYS_TR handles are returned from tools like
+\fCtpm2_evictcontrol\fR\cqs \fC\-o\fR and
+\fCtpm2_readpublic\fR\cqs \fC\-t\fR options.
+.IP
+.nf
+\fC
+tpm2_createprimary \-c primary.ctx
+tpm2_evictcontrol \-c primary.ctx \-o primary.tr
+tpm2 print \-t ESYS_TR primary.tr
+\fR
 .fi
 .SH Returns
 .PP
@@ -534,4 +599,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_quote.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_quote.1 Changed

@@ -1,67 +1,78 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_quote" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_quote\f(1) \- Provide a quote and signature from the TPM.
+\fBtpm2_quote\fR(1) \- Provide a quote and signature from the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_quote\f \fIOPTIONS\f
+\fBtpm2_quote\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_quote\f(1) \- Provide quote and signature for given list of
+\fBtpm2_quote\fR(1) \- Provide quote and signature for given list of
 PCRs in given algorithm/banks.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Context object for the quote signing key.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for AK specified by option
-\fB\-C\f.
+\fB\-C\fR.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-pcr\-list\f=\fIPCR\f:
+\fB\-l\fR, \fB\-\-pcr\-list\fR=\fIPCR\fR:
 .RS 2
 .PP
-The list of PCR banks and selected PCRs\aq ids for each bank.
-Also see \fBNOTES\f section below.
+The list of PCR banks and selected PCRs\cq ids for each bank.
+Also see \fBNOTES\fR section below.
 .RE
 .IP \bu 2
-\fB\-m\f, \fB\-\-message\f=\fIFILE\f:
+\fB\-m\fR, \fB\-\-message\fR=\fIFILE\fR:
 .RS 2
 .PP
 Message output file, records the quote message that makes up the data
 that is signed by the TPM.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-signature\f=\fIFILE\f:
+\fB\-s\fR, \fB\-\-signature\fR=\fIFILE\fR:
 .RS 2
 .PP
 Signature output file, records the signature in the format specified via
-the \fB\-f\f option.
+the \fB\-f\fR option.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-format\f=\fIFORMAT\f:
+\fB\-f\fR, \fB\-\-format\fR=\fIFORMAT\fR:
 .RS 2
 .PP
 Format selection for the signature output file.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-pcr\f=\fIFILE\f.
+\fB\-o\fR, \fB\-\-pcr\fR=\fIFILE\fR.
 .RS 2
 .PP
 PCR output file, optional, records the list of PCR values as defined by
-\fB\-l\f.
+\fB\-l\fR.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-qualification\f=\fIHEX_STRING_OR_PATH\f:
+\fB\-F\fR, \fB\-\-pcrs_format\fR=\fIFORMAT\fR:
+.RS 2
+.PP
+Format selection for the binary blob in the PCR output file.
+`values' will output a binary blob of the PCR values.
+`serialized' will output a binary blob of the PCR values in the form of
+serialized data structure in little endian format.
+Optional.
+Default is `serialized'.
+.RE
+.IP \bu 2
+\fB\-q\fR, \fB\-\-qualification\fR=\fIHEX_STRING_OR_PATH\fR:
 .RS 2
 .PP
 Data given as a Hex string or binary file to qualify the quote,
@@ -69,14 +80,28 @@
 This is typically used to add a nonce against replay attacks.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR:
 .RS 2
 .PP
 Hash algorithm for signature.
 Defaults to sha256.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-scheme\fR=\fIALGORITHM\fR:
+.RS 2
+.PP
+The signing scheme used to sign the message.
+Optional.
+Signing schemes should follow the \lqformatting standards\rq, see
+section \lqAlgorithm Specifiers\rq.
+Also, see section \lqSupported Signing Schemes\rq for a list of
+supported signature schemes.
+If specified, the signature scheme must match the key type.
+If left unspecified, a default signature scheme for the key type will be
+used.
+.RE
+.IP \bu 2
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -88,12 +113,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -106,8 +131,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -116,45 +140,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -162,69 +186,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -233,36 +259,36 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Signature Format Specifiers
 .PP
 Format selection for the signature output file.
-\fBtss\f (the default) will output a binary blob according to the
+\fBtss\fR (the default) will output a binary blob according to the
 TPM 2.0 specification and any potential compiler padding.
-The option \fBplain\f will output the plain signature data as
+The option \fBplain\fR will output the plain signature data as
 defined by the used cryptographic algorithm.
-signature \fIFORMAT\f.
+signature \fIFORMAT\fR.
 .SH PCR Bank Specifiers
 .PP
 PCR Bank Selection lists follow the below specification:
 .IP
 .nf
 \fC
-<BANK>:<PCR>,<PCR>\ or\ <BANK>:all
-\f
+<BANK>:<PCR>,<PCR> or <BANK>:all
+\fR
 .fi
 .PP
-multiple banks may be separated by \aq+\aq.
+multiple banks may be separated by `+'.
 .PP
 For example:
 .IP
 .nf
 \fC
 sha1:3,4+sha256:all
-\f
+\fR
 .fi
 .PP
 will select PCRs 3 and 4 from the SHA1 bank and PCRs 0 to 23 from the
@@ -277,31 +303,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -309,18 +336,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -337,98 +364,105 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ e\ \-c\ primary.ctx
+tpm2_createprimary \-C e \-c primary.ctx
 
-tpm2_create\ \-C\ primary.ctx\ \-u\ key.pub\ \-r\ key.priv
+tpm2_create \-C primary.ctx \-u key.pub \-r key.priv
 
-tpm2_load\ \-C\ primary.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-c\ key.ctx
+tpm2_load \-C primary.ctx \-u key.pub \-r key.priv \-c key.ctx
 
-tpm2_quote\ \-Q\ \-c\ key.ctx\ \-l\ 0x0004:16,17,18+0x000b:16,17,18
-\f
+tpm2_quote \-Q \-c key.ctx \-l 0x0004:16,17,18+0x000b:16,17,18
+\fR
 .fi
 .SH NOTES
 .PP
@@ -459,4 +493,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_rc_decode.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_rc_decode.1 Changed

@@ -1,24 +1,24 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_rc_decode" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_rc_decode\f(1) \- Decode TPM2 error codes to a human
+\fBtpm2_rc_decode\fR(1) \- Decode TPM2 error codes to a human
 readable format.
 .SH SYNOPSIS
 .PP
-\fBtpm2_rc_decode\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_rc_decode\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_rc_decode\f(1) \- Converts an \fIRC_CODE\f from the TPM
-or TSS2 software stack into human readable errors.
-Analogous to \fBstrerror\f(3), but for the TPM2 stack.
+\fBtpm2_rc_decode\fR(1) \- Converts an \fIRC_CODE\fR from the
+TPM or TSS2 software stack into human readable errors.
+Analogous to \fBstrerror\fR(3), but for the TPM2 stack.
 .SH OPTIONS
 .PP
 This tool takes no tool specific options.
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the error code to
+\fBARGUMENT\fR the command line argument specifies the error code to
 be parsed.
 .SS References
 .SH COMMON OPTIONS
@@ -26,31 +26,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -60,9 +61,9 @@
 .IP
 .nf
 \fC
-tpm2_rc_decode\ 0x1d5
-tpm:parameter(1):structure\ is\ the\ wrong\ size
-\f
+tpm2_rc_decode 0x1d5
+tpm:parameter(1):structure is the wrong size
+\fR
 .fi
 .SH Returns
 .PP
@@ -85,4 +86,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_readclock.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_readclock.1 Changed

@@ -1,17 +1,17 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_readclock" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_readclock\f(1) \- Retrieves the time information from the
+\fBtpm2_readclock\fR(1) \- Retrieves the time information from the
 TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_readclock\f \fIOPTIONS\f
+\fBtpm2_readclock\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_readclock\f(1) \-Reads the current TPMS_TIME_INFO structure
+\fBtpm2_readclock\fR(1) \-Reads the current TPMS_TIME_INFO structure
 from the TPM.
 The structure contains the current setting of Time, Clock, resetCount,
 and restartCount.
@@ -20,19 +20,18 @@
 .IP
 .nf
 \fC
-time:\ 13673142\ \ \ \ \ #\ 64\ bit\ value\ of\ time\ since\ last\ _TPM_Init\ or\ TPM2_Startup
-\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ #\ in\ ms.
+time: 13673142     # 64 bit value of time TPM has been powered on in ms.
 clock_info:
-\ \ clock:\ 13673142\ \ #\ 64\ bit\ value\ of\ time\ TPM\ has\ been\ powered\ on\ in\ ms.
-\ \ reset_count:\ 0\ \ \ #\ 32\ bit\ value\ of\ the\ number\ of\ TPM\ Resets\ since\ the\ last
-\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ #\ TPM2_Clear.
-\ \ restart_count:\ 0\ #\ 32\ bit\ value\ of\ the\ number\ of\ times\ that\ TPM2_Shutdown\ or
-\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ #\ _TPM_Hash_Start\ have\ occurred\ since\ the\ last\ TPM\ Reset\ or
-\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ #\ TPM2_Clear.
-\ \ safe:\ yes\ \ \ \ \ \ \ \ #\ boolean\ yes|no\ value\ that\ no\ value\ of\ Clock\ greater\ than
-\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ #\ the\ current\ value\ of\ Clock\ has\ been\ previously\ reported\ by
-\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ #\ the\ TPM.
-\f
+  clock: 13673142  # 64 bit value of time TPM has been powered on since last TPM2_Clear in ms.
+  reset_count: 0   # 32 bit value of the number of TPM Resets since the last
+                   # TPM2_Clear.
+  restart_count: 0 # 32 bit value of the number of times that TPM2_Shutdown or
+                   # _TPM_Hash_Start have occurred since the last TPM Reset or
+                   # TPM2_Clear.
+  safe: yes        # boolean yes|no value that no value of Clock greater than
+                   # the current value of Clock has been previously reported by
+                   # the TPM.
+\fR
 .fi
 .PP
 This tool takes no arguments and no tool specific options.
@@ -42,31 +41,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -74,18 +74,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -102,84 +102,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -188,13 +195,13 @@
 .nf
 \fC
 tpm2_readclock
-time:\ 13673142
+time: 13673142
 clock_info:
-\ \ clock:\ 13673142
-\ \ reset_count:\ 0
-\ \ restart_count:\ 0
-\ \ safe:\ yes
-\f
+  clock: 13673142
+  reset_count: 0
+  restart_count: 0
+  safe: yes
+\fR
 .fi
 .SH Returns
 .PP
@@ -217,4 +224,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_readpublic.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_readpublic.1 Changed

@@ -1,51 +1,52 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_readpublic" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_readpublic\f(1) \- Read the public area of a loaded object.
+\fBtpm2_readpublic\fR(1) \- Read the public area of a loaded object.
 .SH SYNOPSIS
 .PP
-\fBtpm2_readpublic\f \fIOPTIONS\f
+\fBtpm2_readpublic\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_readpublic\f(1) \- Reads the public area of a loaded object.
+\fBtpm2_readpublic\fR(1) \- Reads the public area of a loaded
+object.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-object\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-object\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Context object for the object to read.
 .RE
 .IP \bu 2
-\fB\-n\f, \fB\-\-name\f=\fIFILE\f:
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR:
 .RS 2
 .PP
 An optional file to save the name structure of the object.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-format\f:
+\fB\-f\fR, \fB\-\-format\fR:
 .RS 2
 .PP
 Format selection for the public key output file.
-\aqtss\aq (the default) will output a binary blob according to the
-TPM 2.0 Specification.
-\aqpem\aq will output an OpenSSL compatible PEM encoded public key.
-\aqder\aq will output an OpenSSL compatible DER encoded public key.
-\aqtpmt\aq will output a binary blob of the TPMT_PUBLIC struct
-referenced by TPM 2.0 specs.
+`tss' (the default) will output a binary blob according to the TPM 2.0
+Specification.
+`pem' will output an OpenSSL compatible PEM encoded public key.
+`der' will output an OpenSSL compatible DER encoded public key.
+`tpmt' will output a binary blob of the TPMT_PUBLIC struct referenced by
+TPM 2.0 specs.
 .PP
 Public key format.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR:
 .RS 2
 .PP
 The output file path, recording the public portion of the object.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-serialized\-handle\f=\fIHANDLE\f:
+\fB\-t\fR, \fB\-\-serialized\-handle\fR=\fIHANDLE\fR:
 .RS 2
 .PP
 If the object to be read is a persistent object specified by a raw
@@ -55,10 +56,10 @@
 objects name.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-qualified\-name\f=\fIFILE\f:
+\fB\-q\fR, \fB\-\-qualified\-name\fR=\fIFILE\fR:
 .RS 2
 .PP
-Saves the qualified name of the object to \fIFILE\f.
+Saves the qualified name of the object to \fIFILE\fR.
 The qualified name of the object is the name algorithm hash of the
 parents qualified and the objects name.
 Thus the qualified name of the object serves as proof of the objects
@@ -68,12 +69,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -86,38 +87,38 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -125,18 +126,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -153,95 +154,101 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 # EXAMPLES
 .RE
-.SS Create a primary object and read the public structure in an openssl
-compliant format
+.SS Create a primary object and read the public structure in an openssl compliant format
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-c\ primary.ctx
-tpm2_readpublic\ \-c\ primary.ctx\ \-o\ output.dat\ \-f\ pem
-\f
+tpm2_createprimary \-c primary.ctx
+tpm2_readpublic \-c primary.ctx \-o output.dat \-f pem
+\fR
 .fi
 .SS Serialize an existing persistent object handle to disk for later use
 .PP
@@ -257,29 +264,29 @@
 .IP
 .nf
 \fC
-#\ We\ assume\ that\ an\ object\ has\ already\ been\ persisted,\ for\ example
-tpm2_createprimary\ \-c\ primary.ctx
+# We assume that an object has already been persisted, for example
+tpm2_createprimary \-c primary.ctx
 
-#\ context\ files\ have\ all\ the\ information\ for\ the\ TPM\ to\ verify\ the\ object
-tpm2_evictcontrol\ \-c\ primary.ctx
-persistent\-handle:\ 0x81000001
-action:\ persisted
-\f
+# context files have all the information for the TPM to verify the object
+tpm2_evictcontrol \-c primary.ctx
+persistent\-handle: 0x81000001
+action: persisted
+\fR
 .fi
 .PP
 Next use the persistent handle to get a serialized handle:
 .IP
 .nf
 \fC
-#\ The\ persistent\ handle\ output\ could\ be\ at\ an\ attacker\ controlled\ object,
-#\ best\ practice\ is\ to\ use\ the\ option\ "\-o:\ for\ tpm2_evictcontrol\ to\ get\ a
-#\ serialized\ handle\ instead.
+# The persistent handle output could be at an attacker controlled object,
+# best practice is to use the option \dq\-o: for tpm2_evictcontrol to get a
+# serialized handle instead.
 
-tpm2_readpublic\ \-c\ 0x81000001\ \-o\ output.dat\ \-f\ pem\ \-t\ primary.handle
+tpm2_readpublic \-c 0x81000001 \-o output.dat \-f pem \-t primary.handle
 
-#\ use\ this\ verified\ handle\ in\ an\ encrypted\ session\ with\ the\ tpm
-tpm2_startauthsession\ \-\-policy\-session\ \-S\ session.ctx\ \-c\ primary.handle
-\f
+# use this verified handle in an encrypted session with the tpm
+tpm2_startauthsession \-\-policy\-session \-S session.ctx \-c primary.handle
+\fR
 .fi
 .PP
 For new objects, its best to use all serialized handles.
@@ -304,4 +311,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_rsadecrypt.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_rsadecrypt.1 Changed

@@ -1,63 +1,64 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_rsadecrypt" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_rsadecrypt\f(1) \- Performs an RSA decryption operation
+\fBtpm2_rsadecrypt\fR(1) \- Performs an RSA decryption operation
 using the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_rsadecrypt\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_rsadecrypt\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_rsadecrypt\f(1) \- Performs RSA decryption on the contents
+\fBtpm2_rsadecrypt\fR(1) \- Performs RSA decryption on the contents
 of file using the indicated padding scheme according to IETF RFC 3447
 (PKCS#1).
-Command line argument defaults to \fIstdin\f if not specified.
+Command line argument defaults to \fIstdin\fR if not specified.
 .PP
-The key referenced by key\-context is \fBrequired\f to be:
+The key referenced by key\-context is \fBrequired\fR to be:
 .IP "1." 3
 An RSA key
 .IP "2." 3
-Have the attribute \fIdecrypt\f \fBSET\f in it\aqs attributes.
+Have the attribute \fIdecrypt\fR \fBSET\fR in it\cqs
+attributes.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Context object pointing to the the public portion of RSA key to use for
 decryption.
 Either a file or a handle number.
-See section "Context Object Format".
+See section \lqContext Object Format\rq.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
-Optional authorization value to use the key specified by \fB\-c\f.
+Optional authorization value to use the key specified by \fB\-c\fR.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR:
 .RS 2
 .PP
 Optional output file path to record the decrypted data to.
-The default is to print the binary encrypted data to \fISTDOUT\f.
+The default is to print the binary encrypted data to \fISTDOUT\fR.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-scheme\f=\fIFORMAT\f:
+\fB\-s\fR, \fB\-\-scheme\fR=\fIFORMAT\fR:
 .RS 2
 .PP
 Optional, set the padding scheme (defaults to rsaes).
 .IP \bu 2
-null \- TPM_ALG_NULL uses the key\aqs scheme if set.
+null \- TPM_ALG_NULL uses the key\cqs scheme if set.
 .IP \bu 2
 rsaes \- TPM_ALG_RSAES which is RSAES_PKCSV1.5.
 .IP \bu 2
 oaep \- TPM_ALG_OAEP which is RSAES_OAEP.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-label\f=\fIFILE\f OR \fISTRING\f:
+\fB\-l\fR, \fB\-\-label\fR=\fIFILE\fR OR \fISTRING\fR:
 .RS 2
 .PP
 Optional, set the label data.The TPM requires the last byte of the label
@@ -65,7 +66,7 @@
 No other embedded 0 bytes can exist or the TPM will truncate your label.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -74,18 +75,18 @@
 the command, it simply returns a cpHash.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the file
+\fBARGUMENT\fR the command line argument specifies the file
 containing data to be decrypted.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -98,8 +99,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -108,45 +108,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -154,69 +154,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -225,40 +227,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -266,18 +269,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -294,84 +297,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -379,27 +389,27 @@
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-c\ primary.ctx
-tpm2_create\ \-C\ primary.ctx\ \-Grsa2048\ \-u\ key.pub\ \-r\ key.priv
-tpm2_load\ \-C\ primary.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-c\ key.ctx
-\f
+tpm2_createprimary \-c primary.ctx
+tpm2_create \-C primary.ctx \-Grsa2048 \-u key.pub \-r key.priv
+tpm2_load \-C primary.ctx \-u key.pub \-r key.priv \-c key.ctx
+\fR
 .fi
 .SS Encrypt using RSA
 .IP
 .nf
 \fC
-echo\ "my\ message"\ >\ msg.dat
-tpm2_rsaencrypt\ \-c\ key.ctx\ \-o\ msg.enc\ msg.dat
-\f
+echo \dqmy message\dq > msg.dat
+tpm2_rsaencrypt \-c key.ctx \-o msg.enc msg.dat
+\fR
 .fi
 .SS Decrypt using RSA
 .IP
 .nf
 \fC
-tpm2_rsadecrypt\ \-c\ key.ctx\ \-o\ msg.ptext\ msg.enc
-cat\ msg.ptext
-my\ message
-\f
+tpm2_rsadecrypt \-c key.ctx \-o msg.ptext msg.enc
+cat msg.ptext
+my message
+\fR
 .fi
 .SH Returns
 .PP
@@ -422,4 +432,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_rsaencrypt.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_rsaencrypt.1 Changed

@@ -1,55 +1,56 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_rsaencrypt" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_rsaencrypt\f(1) \- Performs an RSA encryption operation
+\fBtpm2_rsaencrypt\fR(1) \- Performs an RSA encryption operation
 using the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_rsaencrypt\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_rsaencrypt\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_rsaencrypt\f(1) \- Performs RSA encryption on the contents
+\fBtpm2_rsaencrypt\fR(1) \- Performs RSA encryption on the contents
 of file data using the indicated padding scheme according to IETF RFC
 3447 (PKCS#1).
-Input defaults to \fISTDIN\f if not specified.
+Input defaults to \fISTDIN\fR if not specified.
 .PP
-The key referenced by key\-context is \fBrequired\f to be:
+The key referenced by key\-context is \fBrequired\fR to be:
 .IP "1." 3
 An RSA key
 .IP "2." 3
-Have the attribute \fIencrypt\f \fBSET\f in it\aqs attributes.
+Have the attribute \fIencrypt\fR \fBSET\fR in it\cqs
+attributes.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Context object pointing to the the public portion of RSA key to use for
 encryption.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR:
 .RS 2
 .PP
 Optional output file path to record the encrypted data to.
 The default is to print the binary encrypted data to stdout.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-scheme\f=\fIFORMAT\f:
+\fB\-s\fR, \fB\-\-scheme\fR=\fIFORMAT\fR:
 .RS 2
 .PP
 Optional, set the padding scheme (defaults to rsaes).
 .IP \bu 2
-null \- TPM_ALG_NULL uses the key\aqs scheme if set.
+null \- TPM_ALG_NULL uses the key\cqs scheme if set.
 .IP \bu 2
 rsaes \- TPM_ALG_RSAES which is RSAES_PKCSV1.5.
 .IP \bu 2
 oaep \- TPM_ALG_OAEP which is RSAES_OAEP.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-label\f=\fIFILE\f or \fISTRING\f:
+\fB\-l\fR, \fB\-\-label\fR=\fIFILE\fR or \fISTRING\fR:
 .RS 2
 .PP
 Optional, set the label data.
@@ -59,18 +60,18 @@
 No other embedded 0 bytes can exist or the TPM will truncate your label.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the path of the
+\fBARGUMENT\fR the command line argument specifies the path of the
 file with data to be encrypted.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -83,8 +84,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -93,45 +93,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -139,69 +139,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -210,40 +212,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -251,18 +254,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -279,84 +282,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -364,27 +374,27 @@
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-c\ primary.ctx
-tpm2_create\ \-C\ primary.ctx\ \-Grsa2048\ \-u\ key.pub\ \-r\ key.priv
-tpm2_load\ \-C\ primary.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-c\ key.ctx
-\f
+tpm2_createprimary \-c primary.ctx
+tpm2_create \-C primary.ctx \-Grsa2048 \-u key.pub \-r key.priv
+tpm2_load \-C primary.ctx \-u key.pub \-r key.priv \-c key.ctx
+\fR
 .fi
 .SS Encrypt using RSA
 .IP
 .nf
 \fC
-echo\ "my\ message"\ >\ msg.dat
-tpm2_rsaencrypt\ \-c\ key.ctx\ \-o\ msg.enc\ msg.dat
-\f
+echo \dqmy message\dq > msg.dat
+tpm2_rsaencrypt \-c key.ctx \-o msg.enc msg.dat
+\fR
 .fi
 .SS Decrypt using RSA
 .IP
 .nf
 \fC
-tpm2_rsadecrypt\ \-c\ key.ctx\ \-o\ msg.ptext\ msg.enc
-cat\ msg.ptext
-my\ message
-\f
+tpm2_rsadecrypt \-c key.ctx \-o msg.ptext msg.enc
+cat msg.ptext
+my message
+\fR
 .fi
 .SH Returns
 .PP
@@ -407,4 +417,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_selftest.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_selftest.1 Changed

@@ -1,16 +1,16 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_selftest" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_selftest\f(1) \- Run TPM\aqs self\-test internal routines
+\fBtpm2_selftest\fR(1) \- Run TPM\cqs self\-test internal routines
 .SH SYNOPSIS
 .PP
-\fBtpm2_selftest\f \fIOPTIONS\f
+\fBtpm2_selftest\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_selftest\f(1) \- Cause the TPM to execute self\-test of its
+\fBtpm2_selftest\fR(1) \- Cause the TPM to execute self\-test of its
 capabilities.
 .PP
 Self\-test can be executed in two modes :
@@ -28,38 +28,39 @@
 The TPM will remain in failure mode until the next TPM initialization.
 .SH OPTIONS
 .IP \bu 2
-\fB\-f\f, \fB\-\-fulltest\f : Run self\-test in full mode
+\fB\-f\fR, \fB\-\-fulltest\fR : Run self\-test in full mode
 .SS References
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -67,18 +68,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -95,84 +96,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -181,14 +189,14 @@
 .nf
 \fC
 tpm2_selftest
-\f
+\fR
 .fi
 .SS Perform a complete TPM self\-test
 .IP
 .nf
 \fC
-tpm2_selftest\ \-f
-\f
+tpm2_selftest \-f
+\fR
 .fi
 .SH Returns
 .PP
@@ -211,4 +219,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_send.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_send.1 Changed

@@ -1,16 +1,16 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_send" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_send\f(1) \- Send a raw command buffer to the TPM.
+\fBtpm2_send\fR(1) \- Send a raw command buffer to the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_send\f \fIOPTIONS\f \fISTDIN\f
+\fBtpm2_send\fR \fIOPTIONS\fR \fISTDIN\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_send\f(1) \- Sends a TPM command to the TPM.
+\fBtpm2_send\fR(1) \- Sends a TPM command to the TPM.
 The command is read from a file as a binary stream and transmitted to
 the TPM using the TCTI specified by the caller.
 The response received from the TPM is written to the output file.
@@ -19,11 +19,11 @@
 to decode and display the response in a human readable form.
 .SH OPTIONS
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR:
 .RS 2
 .PP
 Output file to send response buffer to.
-Defaults to \fISTDOUT\f.
+Defaults to \fISTDOUT\fR.
 .RE
 .IP \bu 2
 **_STDIN** the file containing the TPM2 command.
@@ -33,31 +33,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -65,18 +66,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -93,98 +94,105 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .SS Send and receive raw commands to TPM
 .PP
-Send the contents of \fItpm2\-command.bin\f to a device and collect
-the response as \fItpm2\-response.bin\f.
+Send the contents of \fItpm2\-command.bin\fR to a device and collect
+the response as \fItpm2\-response.bin\fR.
 .IP
 .nf
 \fC
-tpm2_send\ <\ tpm2\-command.bin\ >\ tpm2\-response.bin
+tpm2_send < tpm2\-command.bin > tpm2\-response.bin
 
-tpm2_send\ <\ tpm2\-command.bin\ \-o\ tpm2\-response.bin
-\f
+tpm2_send < tpm2\-command.bin \-o tpm2\-response.bin
+\fR
 .fi
 .SH Returns
 .PP
@@ -207,4 +215,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_sessionconfig.1 Added

@@ -0,0 +1,290 @@
+.\" Automatically generated by Pandoc 2.5
+.\"
+.TH "tpm2_sessionconfig" "1" "" "tpm2\-tools" "General Commands Manual"
+.hy
+.SH NAME
+.PP
+\fBtpm2_sessionconfig\fR(1) \- Configure session attributes and
+print session info from a session file.
+.SH SYNOPSIS
+.PP
+\fBtpm2_sessionconfig\fR \fIOPTIONS\fR \fIARGUMENT\fR
+.SH DESCRIPTION
+.PP
+\fBtpm2_sessionconfig\fR(1) \- Configure session attributes and
+print session info from a session file.
+.PP
+The tool operates in one of two modes: 1.
+Configure/ modify the session attributes.
+2.
+Print the session information.
+This is the default behavior.
+.SH OPTIONS
+.IP \bu 2
+\fB\-\-enable\-continuesession\fR:
+.RS 2
+.PP
+Enable continueSession in the session\-attributes.
+.RE
+.IP \bu 2
+\fB\-\-disable\-continuesession\fR
+.RS 2
+.PP
+Disable continuesession in the session\-attributes.
+.RE
+.IP \bu 2
+\fB\-\-enable\-auditexclusive\fR
+.RS 2
+.PP
+Enable auditexclusive in the session\-attributes.
+.RE
+.IP \bu 2
+\fB\-\-disable\-auditexclusive\fR
+.RS 2
+.PP
+Disable auditexclusive in the session\-attributes.
+.RE
+.IP \bu 2
+\fB\-\-enable\-auditreset\fR
+.RS 2
+.PP
+Enable auditreset in the session\-attributes.
+.RE
+.IP \bu 2
+\fB\-\-disable\-auditreset\fR
+.RS 2
+.PP
+Disable auditreset in the session\-attributes.
+.RE
+.IP \bu 2
+\fB\-\-enable\-decrypt\fR
+.RS 2
+.PP
+Enable decrypt in the session\-attributes.
+.RE
+.IP \bu 2
+\fB\-\-disable\-decrypt\fR
+.RS 2
+.PP
+Disable decrypt in the session\-attributes.
+.RE
+.IP \bu 2
+\fB\-\-enable\-encrypt\fR
+.RS 2
+.PP
+Enable encrypt in the session\-attributes.
+.RE
+.IP \bu 2
+\fB\-\-disable\-encrypt\fR
+.RS 2
+.PP
+Disable encrypt in the session\-attributes.
+.RE
+.IP \bu 2
+\fB\-\-enable\-audit\fR
+.RS 2
+.PP
+Enable audit in the session\-attributes.
+.RE
+.IP \bu 2
+\fB\-\-disable\-audit\fR
+.RS 2
+.PP
+Disable audit in the session\-attributes.
+.RE
+.IP \bu 2
+\fBARGUMENT\fR the session context file.
+.SS References
+.SH COMMON OPTIONS
+.PP
+This collection of options are common to many programs and provide
+information that many users may expect.
+.IP \bu 2
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
+manpage.
+By default, it attempts to invoke the manpager for the tool, however, on
+failure will output a short tool summary.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
+.RS 2
+.PP
+To successfully use the manpages feature requires the manpages to be
+installed or on \fIMANPATH\fR, See man(1) for more details.
+.RE
+.IP \bu 2
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
+.IP \bu 2
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
+tool prints to the console during its execution.
+When using this option the file and line number are printed.
+.IP \bu 2
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
+.IP \bu 2
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
+errata fixups.
+Useful if an errata fixup needs to be applied to commands sent to the
+TPM.
+Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
+information many users may expect.
+.SH TCTI Configuration
+.PP
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
+TCTIs can be changed for communication with TPMs across different
+mediums.
+.PP
+To control the TCTI, the tools respect:
+.IP "1." 3
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
+.IP "2." 3
+The environment variable: \fITPM2TOOLS_TCTI\fR.
+.PP
+\fBNote:\fR The command line option always overrides the environment
+variable.
+.PP
+The current known TCTIs are:
+.IP \bu 2
+tabrmd \- The resource manager, called
+tabrmd (https://github.com/tpm2-software/tpm2-abrmd).
+Note that tabrmd and abrmd as a tcti name are synonymous.
+.IP \bu 2
+mssim \- Typically used for communicating to the TPM software simulator.
+.IP \bu 2
+device \- Used when talking directly to a TPM device file.
+.IP \bu 2
+none \- Do not initalize a connection with the TPM.
+Some tools allow for off\-tpm options and thus support not using a TCTI.
+Tools that do not support it will error when attempted to be used
+without a TCTI connection.
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
+.PP
+The arguments to either the command line option or the environment
+variable are in the form:
+.PP
+\fC<tcti\-name>:<tcti\-option\-config>\fR
+.PP
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
+that portion respectively.
+.SS TCTI Defaults
+.PP
+When a TCTI is not specified, the default TCTI is searched for using
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
+You can query what TCTI will be chosen as the default by using the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
+aforementioned TCTIs is the default.
+.SS Custom TCTIs
+.PP
+Any TCTI that implements the dynamic TCTI interface can be loaded.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
+Thus, this could be a path to the shared library, or a library name as
+understood by \fIdlopen(3)\fR semantics.
+.SH TCTI OPTIONS
+.PP
+This collection of options are used to configure the various known TCTI
+modules available:
+.IP \bu 2
+\fBdevice\fR: For the device TCTI, the TPM character device file for
+use by the device TCTI can be specified.
+The default is \fI/dev/tpm0\fR.
+.RS 2
+.PP
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
+.RE
+.IP \bu 2
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
+port number used by the simulator can be specified.
+The default are 127.0.0.1 and 2321.
+.RS 2
+.PP
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
+.RE
+.IP \bu 2
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
+.RS 2
+.IP \bu 2
+TCTI abrmd supports two keys:
+.RS 2
+.IP "1." 3
+`bus_name' : The name of the tabrmd service on the bus (a string).
+.IP "2." 3
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
+.RE
+.PP
+Specify the tabrmd tcti name and a config string of
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
+.PP
+Specify the default (abrmd) tcti and a config string of
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
+.PP
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
+the various known TCTI modules.
+.RE
+.SH EXAMPLES
+.SS Start a bounded & salted session, disable continuesession and display session
+.IP
+.nf
+\fC
+
+tpm2 createprimary \-c prim.ctx
+tpm2 startauthsession \-S session.ctx \-\-policy\-session \-c prim.ctx
+
+### Session info before changing attributes
+tpm2 sessionconfig session.ctx
+
+### Session info after changing attributes
+tpm2 sessionconfig \-\-disable\-continuesession
+tpm2 sessionconfig session.ctx
+\fR
+.fi
+.SH Returns
+.PP
+Tools can return any of the following codes:
+.IP \bu 2
+0 \- Success.
+.IP \bu 2
+1 \- General non\-specific error.
+.IP \bu 2
+2 \- Options handling error.
+.IP \bu 2
+3 \- Authentication error.
+.IP \bu 2
+4 \- TCTI related error.
+.IP \bu 2
+5 \- Non supported scheme.
+Applicable to tpm2_testparams.
+.SH BUGS
+.PP
+Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
+.SH HELP
+.PP
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_setclock.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_setclock.1 Changed

@@ -1,35 +1,35 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_setclock" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_setclock\f(1) \- Sets the time on the TPM.
+\fBtpm2_setclock\fR(1) \- Sets the time on the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_setclock\f \fIOPTIONS\f \fBTIME\f
+\fBtpm2_setclock\fR \fIOPTIONS\fR \fBTIME\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_setclock\f(1) \- Sets the clock on the TPM to a time in the
-\fBfuture\f.
+\fBtpm2_setclock\fR(1) \- Sets the clock on the TPM to a time in the
+\fBfuture\fR.
 The sole argument is the clock time as a number to set.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 The hierarchy to use for authorization, either platform or owner.
 Defaults to the owner hierarchy if not specified.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy specified by option
-\fB\-c\f.
+\fB\-c\fR.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -41,12 +41,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -59,8 +59,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -69,45 +68,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -115,69 +114,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -186,40 +187,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -227,18 +229,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -255,84 +257,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -342,8 +351,8 @@
 .IP
 .nf
 \fC
-tpm2_setclock\ \-p\ ownerpw\ 13673142
-\f
+tpm2_setclock \-p ownerpw 13673142
+\fR
 .fi
 .SH Returns
 .PP
@@ -366,4 +375,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_setcommandauditstatus.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_setcommandauditstatus.1 Changed

@@ -1,86 +1,88 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_setcommandauditstatus" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_setcommandauditstatus\f(1) \- Add or remove TPM2 commands to
-the audited commands list.
+\fBtpm2_setcommandauditstatus\fR(1) \- Add or remove TPM2 commands
+to the audited commands list.
 .SH SYNOPSIS
 .PP
-\fBtpm2_setcommandauditstatus\f \fIOPTIONS\f
-\fIARGUMENT\f
+\fBtpm2_setcommandauditstatus\fR \fIOPTIONS\fR
+\fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_setcommandauditstatus\f(1) \- Add or remove TPM2 commands to
-the audited commands list.
+\fBtpm2_setcommandauditstatus\fR(1) \- Add or remove TPM2 commands
+to the audited commands list.
 .PP
 As an argument it takes the command as an integer or friendly string
 value.
 Friendly string to COMMAND CODE mapping can be found in section
-\fICOMMAND CODE MAPPINGS\f.
+\fICOMMAND CODE MAPPINGS\fR.
 .SH OPTIONS
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 Specify either owner or platform hierarchy.
-Defaults to \fBTPM_RH_OWNER\f, when no value has been specified.
+Defaults to \fBTPM_RH_OWNER\fR, when no value has been specified.
 Supported options are:
 .IP \bu 2
-\fBo\f for \fBTPM_RH_OWNER\f
+\fBo\fR for \fBTPM_RH_OWNER\fR
 .IP \bu 2
-\fBp\f for \fBTPM_RH_PLATFORM\f
+\fBp\fR for \fBTPM_RH_PLATFORM\fR
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-hierarchy\-auth\f=\fIAUTH\f: Specifies the
-authorization value for the hierarchy.
-Authorization values should follow the "authorization formatting
-standards", see section "Authorization Formatting".
+\fB\-P\fR, \fB\-\-hierarchy\-auth\fR=\fIAUTH\fR: Specifies
+the authorization value for the hierarchy.
+Authorization values should follow the \lqauthorization formatting
+standards\rq, see section \lqAuthorization Formatting\rq.
 .IP \bu 2
-\fB\-c\f, \fB\-\-clear\-list\f: Specifies that the TPM command
+\fB\-c\fR, \fB\-\-clear\-list\fR: Specifies that the TPM command
 specified has to be taken off the audit list.
 When not specified, the default behaviour is to add the TPM command to
 the audit list.
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 Sets up the hashing algorithm for the audit digest.
 When not specified, the default audit digest algorithm is set to SHA256.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies TPM2 command code.
+\fBARGUMENT\fR the command line argument specifies TPM2 command
+code.
 .SS References
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -88,18 +90,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -116,84 +118,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .PP
@@ -267,8 +276,8 @@
 .IP
 .nf
 \fC
-tpm2_setcommandauditstatus\ TPM2_CC_Unseal
-\f
+tpm2_setcommandauditstatus TPM2_CC_Unseal
+\fR
 .fi
 .SH Returns
 .PP
@@ -289,17 +298,18 @@
 .SH Limitations
 .PP
 It expects a session to be already established via
-\fBtpm2_startauthsession\f(1) and requires one of the following:
+\fBtpm2_startauthsession\fR(1) and requires one of the following:
 .IP \bu 2
 direct device access
 .IP \bu 2
-extended session support with \fBtpm2\-abrmd\f.
+extended session support with \fBtpm2\-abrmd\fR.
 .PP
-Without it, most resource managers \fBwill not\f save session state
+Without it, most resource managers \fBwill not\fR save session state
 between command invocations.
 .SH BUGS
 .PP
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_setprimarypolicy.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_setprimarypolicy.1 Changed

@@ -1,19 +1,19 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_setprimarypolicy" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_setprimarypolicy\f(1) \- Sets the authorization policy for
+\fBtpm2_setprimarypolicy\fR(1) \- Sets the authorization policy for
 the lockout (lockoutPolicy), the platform hierarchy (platformPolicy),
 the storage hierarchy (ownerPolicy), and the endorsement hierarchy
 (endorsementPolicy).
 .SH SYNOPSIS
 .PP
-\fBtpm2_setprimarypolicy\f \fIOPTIONS\f
+\fBtpm2_setprimarypolicy\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_setprimarypolicy\f(1) \- Sets the authorization policy for
+\fBtpm2_setprimarypolicy\fR(1) \- Sets the authorization policy for
 the lockout (lockoutPolicy), the platform hierarchy (platformPolicy),
 the storage hierarchy (ownerPolicy), and the endorsement hierarchy
 (endorsementPolicy).
@@ -21,32 +21,32 @@
 .PP
 These options control creating the policy authorization session:
 .IP \bu 2
-\fB\-C\f, \fB\-\-hierarchy\f=\fIOBJECT\f:
+\fB\-C\fR, \fB\-\-hierarchy\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Specifies the hierarchy whose authorization policy is to be setup.
 It can be specified as o|p|e|l
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-P\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 Specifies the authorization value for the hierarchy.
 .RE
 .IP \bu 2
-\fB\-L\f, \fB\-\-policy\f=\fIFILE\f:
+\fB\-L\fR, \fB\-\-policy\fR=\fIFILE\fR:
 .RS 2
 .PP
 The file path of the authorization policy data.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm used in computation of the policy digest.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -58,12 +58,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -76,8 +76,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -86,45 +85,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -132,69 +131,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -203,13 +204,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -220,7 +221,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -231,6 +232,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -264,6 +267,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -291,7 +296,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -300,27 +305,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -328,21 +341,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -355,6 +370,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -367,51 +384,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -419,18 +436,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -447,84 +464,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -532,8 +556,8 @@
 .IP
 .nf
 \fC
-tpm2_setprimarypolicy\ \-C\ e
-\f
+tpm2_setprimarypolicy \-C e
+\fR
 .fi
 .SH Returns
 .PP
@@ -556,4 +580,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_shutdown.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_shutdown.1 Changed

@@ -1,24 +1,24 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_shutdown" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_shutdown\f(1) \- Send a shutdown command to the TPM.
+\fBtpm2_shutdown\fR(1) \- Send a shutdown command to the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_shutdown\f \fIOPTIONS\f
+\fBtpm2_shutdown\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_shutdown\f(1) \- Send a \fBTPM2_Shutdown\f command with
-either \fBTPM_SU_CLEAR\f or \fBTPM_SU_STATE\f.
+\fBtpm2_shutdown\fR(1) \- Send a \fBTPM2_Shutdown\fR command
+with either \fBTPM_SU_CLEAR\fR or \fBTPM_SU_STATE\fR.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-clear\f:
+\fB\-c\fR, \fB\-\-clear\fR:
 .RS 2
 .PP
-Shutdown type sent will be \fBTPM_SU_CLEAR\f instead of
-\fBTPM2_SU_STATE\f.
+Shutdown type sent will be \fBTPM_SU_CLEAR\fR instead of
+\fBTPM2_SU_STATE\fR.
 .RE
 .SS References
 .SH COMMON OPTIONS
@@ -26,31 +26,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -58,18 +59,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -86,84 +87,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -172,14 +180,14 @@
 .nf
 \fC
 tpm2_shutdown
-\f
+\fR
 .fi
 .SS Send a TPM Shutdown Command with flags TPM2_SU_CLEAR
 .IP
 .nf
 \fC
-tpm2_shutdown\ \-c
-\f
+tpm2_shutdown \-c
+\fR
 .fi
 .SH NOTES
 .PP
@@ -207,4 +215,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_sign.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_sign.1 Changed

@@ -1,104 +1,104 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_sign" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_sign\f(1) \- Sign a hash or message using the TPM.
+\fBtpm2_sign\fR(1) \- Sign a hash or message using the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_sign\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_sign\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_sign\f(1) \- Generates signature of specified message or
+\fBtpm2_sign\fR(1) \- Generates signature of specified message or
 message\-digest using the specified symmetric or asymmetric signing key.
 .PP
-When signing a message, \fBtpm2_sign\f utility first calculates the
-digest of the message similar to the \fBtpm2_hash\f command.
+When signing a message, \fBtpm2_sign\fR utility first calculates the
+digest of the message similar to the \fBtpm2_hash\fR command.
 It also generates a validation ticket under TPM2_RH_NULL or
 TPM2_RH_OWNER hierarchies respectively for unrestricted or the
 restricted signing keys.
 .PP
 While signing messages is a provision in this tool it is recommended to
-use the \fBtpm2_hash\f tool first and pass the digest and validation
-ticket.
+use the \fBtpm2_hash\fR tool first and pass the digest and
+validation ticket.
 .PP
 NOTE: If the signing key is a restricted signing key, then validation
-and digest must be provided via the \fB\-t\f input.
+and digest must be provided via the \fB\-t\fR input.
 The ticket indicates that the TPM performed the hash of the message.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Context object pointing to the the key used for signing.
 Either a file or a handle number.
-See section "Context Object Format".
+See section \lqContext Object Format\rq.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR_AUTH_:
 .RS 2
 .PP
-Optional authorization value to use the key specified by \fB\-c\f.
-Authorization values should follow the "authorization formatting
-standards", see section "Authorization Formatting".
+Optional authorization value to use the key specified by \fB\-c\fR.
+Authorization values should follow the \lqauthorization formatting
+standards\rq, see section \lqAuthorization Formatting\rq.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm used to digest the message.
-Algorithms should follow the "formatting standards", see section
-"Algorithm Specifiers".
-Also, see section "Supported Hash Algorithms" for a list of supported
-hash algorithms.
+Algorithms should follow the \lqformatting standards\rq, see section
+\lqAlgorithm Specifiers\rq.
+Also, see section \lqSupported Hash Algorithms\rq for a list of
+supported hash algorithms.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-scheme\f=\fIALGORITHM\f:
+\fB\-s\fR, \fB\-\-scheme\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The signing scheme used to sign the message.
 Optional.
 .PP
-Signing schemes should follow the "formatting standards", see section
-"Algorithm Specifiers".
+Signing schemes should follow the \lqformatting standards\rq, see
+section \lqAlgorithm Specifiers\rq.
 .PP
 If specified, the signature scheme must match the key type.
 If left unspecified, a default signature scheme for the key type will be
 used.
 .RE
 .IP \bu 2
-\fB\-d\f, \fB\-\-digest\f:
+\fB\-d\fR, \fB\-\-digest\fR:
 .RS 2
 .PP
-Indicate that \fIFILE\f is a file containing the digest of the
+Indicate that \fIFILE\fR is a file containing the digest of the
 message.
-When this option and \fB\-t\f is specified, a warning is generated
-and the \fBvalidation ticket (\-t) is ignored\f.
+When this option and \fB\-t\fR is specified, a warning is generated
+and the \fBvalidation ticket (\-t) is ignored\fR.
 You cannot use this option to sign a digest against a restricted signing
 key.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-ticket\f=\fIFILE\f:
+\fB\-t\fR, \fB\-\-ticket\fR=\fIFILE\fR:
 .RS 2
 .PP
 The ticket file, containing the validation structure, optional.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-signature\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-signature\fR=\fIFILE\fR:
 .RS 2
 .PP
 The signature file, records the signature structure.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-format\f=\fIFORMAT\f:
+\fB\-f\fR, \fB\-\-format\fR=\fIFORMAT\fR:
 .RS 2
 .PP
 Format selection for the signature output file.
-See section "Signature Format Specifiers".
+See section \lqSignature Format Specifiers\rq.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
@@ -107,7 +107,7 @@
 the command, it simply returns a cpHash.
 .RE
 .IP \bu 2
-\fB\-\-commit\-index\f=\fINATURALNUMBER\f
+\fB\-\-commit\-index\fR=\fINATURALNUMBER\fR
 .RS 2
 .PP
 The commit counter value to determine the key index to use in an ECDAA
@@ -115,18 +115,18 @@
 The default counter value is 0.
 .RE
 .IP \bu 2
-\fBARGUMENT\f the command line argument specifies the file data for
+\fBARGUMENT\fR the command line argument specifies the file data for
 sign.
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -139,8 +139,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -149,45 +148,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -195,69 +194,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -266,13 +267,13 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -283,7 +284,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -294,6 +295,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -327,6 +330,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -354,7 +359,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -363,27 +368,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -391,21 +404,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -418,6 +433,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -430,51 +447,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -482,18 +499,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -510,135 +527,141 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH Signature Format Specifiers
 .PP
 Format selection for the signature output file.
-\fBtss\f (the default) will output a binary blob according to the
+\fBtss\fR (the default) will output a binary blob according to the
 TPM 2.0 specification and any potential compiler padding.
-The option \fBplain\f will output the plain signature data as
+The option \fBplain\fR will output the plain signature data as
 defined by the used cryptographic algorithm.
 .SH EXAMPLES
-.SS Sign and verify with the TPM using the \fIendorsement\f
-hierarchy
+.SS Sign and verify with the TPM using the \fIendorsement\fR hierarchy
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ e\ \-c\ primary.ctx
+tpm2_createprimary \-C e \-c primary.ctx
 
-tpm2_create\ \-G\ rsa\ \-u\ rsa.pub\ \-r\ rsa.priv\ \-C\ primary.ctx
+tpm2_create \-G rsa \-u rsa.pub \-r rsa.priv \-C primary.ctx
 
-tpm2_load\ \-C\ primary.ctx\ \-u\ rsa.pub\ \-r\ rsa.priv\ \-c\ rsa.ctx
+tpm2_load \-C primary.ctx \-u rsa.pub \-r rsa.priv \-c rsa.ctx
 
-echo\ "my\ message"\ >\ message.dat
+echo \dqmy message\dq > message.dat
 
-tpm2_sign\ \-c\ rsa.ctx\ \-g\ sha256\ \-o\ sig.rssa\ message.dat
+tpm2_sign \-c rsa.ctx \-g sha256 \-o sig.rssa message.dat
 
-tpm2_verifysignature\ \-c\ rsa.ctx\ \-g\ sha256\ \-s\ sig.rssa\ \-m\ message.dat
-\f
+tpm2_verifysignature \-c rsa.ctx \-g sha256 \-s sig.rssa \-m message.dat
+\fR
 .fi
 .SS Sign with the TPM and verify with OSSL
 .IP
 .nf
 \fC
-openssl\ ecparam\ \-name\ prime256v1\ \-genkey\ \-noout\ \-out\ private.ecc.pem
+openssl ecparam \-name prime256v1 \-genkey \-noout \-out private.ecc.pem
 
-openssl\ ec\ \-in\ private.ecc.pem\ \-out\ public.ecc.pem\ \-pubout
+openssl ec \-in private.ecc.pem \-out public.ecc.pem \-pubout
 
-#\ Generate\ a\ hash\ to\ sign
-echo\ "data\ to\ sign"\ >\ data.in.raw
+# Generate a hash to sign
+echo \dqdata to sign\dq > data.in.raw
 
-sha256sum\ data.in.raw\ |\ awk\ \aq{\ print\ "000000\ "\ $1\ }\aq\ |\ \\
-xxd\ \-r\ \-c\ 32\ >\ data.in.digest
+sha256sum data.in.raw | awk \aq{ print \dq000000 \dq $1 }\aq | \rs
+xxd \-r \-c 32 > data.in.digest
 
-#\ Load\ the\ private\ key\ for\ signing
-tpm2_loadexternal\ \-Q\ \-G\ ecc\ \-r\ private.ecc.pem\ \-c\ key.ctx
+# Load the private key for signing
+tpm2_loadexternal \-Q \-G ecc \-r private.ecc.pem \-c key.ctx
 
-#\ Sign\ in\ the\ TPM\ and\ verify\ with\ OSSL
-tpm2_sign\ \-Q\ \-c\ key.ctx\ \-g\ sha256\ \-d\ \-f\ plain\ \-o\ data.out.signed\ data.in.digest
+# Sign in the TPM and verify with OSSL
+tpm2_sign \-Q \-c key.ctx \-g sha256 \-d \-f plain \-o data.out.signed data.in.digest
 
-openssl\ dgst\ \-verify\ public.ecc.pem\ \-keyform\ pem\ \-sha256\ \\
-\-signature\ data.out.signed\ data.in.raw
-\f
+openssl dgst \-verify public.ecc.pem \-keyform pem \-sha256 \rs
+\-signature data.out.signed data.in.raw
+\fR
 .fi
 .SH Returns
 .PP
@@ -661,4 +684,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_startauthsession.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_startauthsession.1 Changed

@@ -1,78 +1,166 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_startauthsession" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_startauthsession\f(1) \- Start a session with the TPM.
+\fBtpm2_startauthsession\fR(1) \- Start a session with the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_startauthsession\f \fIOPTIONS\f
+\fBtpm2_startauthsession\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_startauthsession\f(1) \- Starts a session with the TPM.
-The default is to start a \fItrial\f session unless the \fB\-a\f
-option is specified.
+\fBtpm2_startauthsession\fR(1) \- Starts a session with the TPM.
+The default is to start a \fItrial\fR session unless the
+\fB\-a\fR option is specified.
 Saves the policy session data to a file.
 This file can then be used in subsequent tools that can use a policy
 file for authorization or policy events.
 .PP
 This will not work with resource managers (RMs) outside of
-tpm2\-abrmd (https://%20github.com/tpm2-software/tpm2-abrmd), as most
-RMs will flush session handles when a client disconnects from the IPC
+tpm2\-abrmd (https://github.com/tpm2-software/tpm2-abrmd), as most RMs
+will flush session handles when a client disconnects from the IPC
 channel.
+However, when using a RM without the session gapping feature, one can
+use the command TCTI to keep the connection open.
+.PP
+The first step is to create a socket listener that uses tpm2_send:
+.IP
+.nf
+\fC
+mknod \dq$HOME/backpipe\dq p
+while  1 ; do tpm2_send 0<\dq$HOME/backpipe\dq | nc \-lU \dq$HOME/sock\dq 1>\dq$HOME/backpipe\dq; done;
+\fR
+.fi
+.PP
+The next step is to use the command TCTI and netcat (nc) to send data to
+the socket.
+.IP
+.nf
+\fC
+tpm2_startauthsession \-\-tcti=\dqcmd:nc \-q 0 \-U $HOME/sock\dq <options>
+\fR
+.fi
+.PP
+When finishing ensure to kill the listener.
+For commands executed with the command tcti against the listener, one
+will need to manage transient handles.
+The simplest way is to add a flush after each command:
+\fCtpm2_flushcontext \-\-tcti=\dqcmd:nc \-q 0 \-U $HOME/sock\dq \-t\fR
+.PP
+Note: This example uses UNIX sockets, since the socket is controlled
+with Linux access controls.
+Using a port is not recommended as it\cqs either open to any user on
+the system (localhost) or bound to a network card and exposed to the
+network.
 .PP
 This will work with direct TPM access, but note that internally this
-calls a \fIContextSave\f and a \fIContextLoad\f on the session
-handle, thus the session \fBcannot\f be saved/loaded again.
+calls a \fIContextSave\fR and a \fIContextLoad\fR on the session
+handle, thus the session \fBcannot\fR be saved/loaded again.
 .SH OPTIONS
 .IP \bu 2
-\fB\-\-policy\-session\f:
+\fB\-\-policy\-session\fR:
 .RS 2
 .PP
-Start a policy session of type \fBTPM_SE_POLICY\f.
-Default without this option is \fBTPM_SE_TRIAL\f.
-\fBNOTE\f: A \fItrial\f session is used when building a policy
-and a \fIpolicy\f session is used when authenticating with a policy.
+Start a policy session of type \fBTPM_SE_POLICY\fR.
+Default without this option is \fBTPM_SE_TRIAL\fR.
+.PP
+\fBNOTE\fR: A \fItrial\fR session is used when building a policy
+and a \fIpolicy\fR session is used when authenticating with a
+policy.
 .RE
 .IP \bu 2
-\fB\-\-audit\-session\f:
+\fB\-\-audit\-session\fR:
 .RS 2
 .PP
 Start an HMAC session to be used as an audit session.
-Default without this option is \fBTPM2_SE_TRIAL\f.
+Default without this option is \fBTPM2_SE_TRIAL\fR.
+.RE
+.IP \bu 2
+\fB\-\-hmac\-session\fR:
+.RS 2
+.PP
+Start an HMAC session of type \fBTPM_SE_HMAC\fR.
+Default without this option is \fBTPM2_SE_TRIAL\fR.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm used in computation of the policy digest.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-G\fR, \fB\-\-key\-algorithm\fR=\fIALGORITHM\fR:
+.RS 2
+.PP
+The symmetric algorithm used in parameter encryption/decryption.
+.RE
+.IP \bu 2
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
-Set the session encryption and bind key.
-When using this, sensitive data transmitted to the TPM will be encrypted
-with AES128CFB.
-\fBThis prevents bus snooping attacks.\f
+Set the tpmkey and bind objects to be the same.
+Session parameter encryption is turned on.
+Session parameter decryption is turned on.
+Parameter encryption/decryption symmetric\-key set to AES\-CFB.
 .RE
 .IP \bu 2
-\fB\-S\f, \fB\-\-session\f=\fIFILE\f:
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
 .RS 2
 .PP
 The name of the policy session file, required.
 .RE
+.IP \bu 2
+\fB\-\-bind\-context\fR=\fIFILE\fR:
+.RS 2
+.PP
+Set the bind object.
+Session parameter encryption is off.
+Use \fBtpm2_sessionconfig\fR to turn on.
+Session parameter decryption is off.
+Use \fBtpm2_sessionconfig\fR to turn on.
+Parameter encryption/decryption symmetric\-key set to AES\-CFB.
+.RE
+.IP \bu 2
+\fB\-\-bind\-auth\fR=\fIAUTH\fR:
+.RS 2
+.PP
+Set the authorization value for the bind object.
+.RE
+.IP \bu 2
+\fB\-\-tpmkey\-context\fR=\fIFILE\fR:
+.RS 2
+.PP
+Set the tpmkey object.
+Session parameter encryption is off.
+Use \fBtpm2_sessionconfig\fR to turn on.
+Session parameter decryption is off.
+Use \fBtpm2_sessionconfig\fR to turn on.
+Parameter encryption/decryption symmetric\-key set to AES\-CFB.
+.RE
+.IP \bu 2
+\fB\-n\fR, \fB\-\-name\fR=\fIFILE\fR
+.RS 2
+.PP
+A name file as output from a tool like tpm2_readpublic(1) \fC\-n\fR
+option.
+The name file can be used to \fBverify\fR a persistent handle input
+for the \fC\-\-tpmkey\-context\fR, \fC\-c\fR, and
+\fC\-\-key\-context\fR options.
+Verification that the object referenced by a peristent handle, e.g
+0x81000000, is the key expected prevents attackers from performing a
+man\-in\-the\-middle attack on session traffic.
+.RE
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -85,8 +173,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -95,45 +182,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -141,69 +228,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -212,40 +301,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -253,18 +343,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -281,109 +371,115 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 # EXAMPLES
 .RE
-.SS Start a \fItrial\f session and save the session data to a file
+.SS Start a \fItrial\fR session and save the session data to a file
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-S\ mysession.ctx
-\f
+tpm2_startauthsession \-S mysession.ctx
+\fR
 .fi
-.SS Start a \fIpolicy\f session and save the session data to a file
+.SS Start a \fIpolicy\fR session and save the session data to a file
 .IP
 .nf
 \fC
-tpm2_startauthsession\ \-\-policy\-session\ \-S\ mysession.ctx
-\f
+tpm2_startauthsession \-\-policy\-session \-S mysession.ctx
+\fR
 .fi
-.SS Start an encrypted and bound \fIpolicy\f session and save the
-session data to a file
+.SS Start an encrypted and bound \fIpolicy\fR session and save the session data to a file
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-c\ primary.ctx
-tpm2_startauthsession\ \-\-policy\-session\ \-c\ primary.ctx\ \-S\ mysession.ctx
-\f
+tpm2_createprimary \-c primary.ctx
+tpm2_startauthsession \-\-policy\-session \-c primary.ctx \-S mysession.ctx
+\fR
 .fi
 .SH Returns
 .PP
@@ -406,4 +502,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_startup.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_startup.1 Changed

@@ -1,24 +1,24 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_startup" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_startup\f(1) \- Send a startup command to the TPM.
+\fBtpm2_startup\fR(1) \- Send a startup command to the TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_startup\f \fIOPTIONS\f
+\fBtpm2_startup\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_startup\f(1) \- Send a \fBTPM2_Startup\f command with
-either \fBTPM_SU_CLEAR\f or \fBTPM_SU_STATE\f.
+\fBtpm2_startup\fR(1) \- Send a \fBTPM2_Startup\fR command with
+either \fBTPM_SU_CLEAR\fR or \fBTPM_SU_STATE\fR.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-clear\f:
+\fB\-c\fR, \fB\-\-clear\fR:
 .RS 2
 .PP
-Startup type sent will be \fBTPM_SU_CLEAR\f instead of
-\fBTPM2_SU_STATE\f.
+Startup type sent will be \fBTPM_SU_CLEAR\fR instead of
+\fBTPM2_SU_STATE\fR.
 .RE
 .SS References
 .SH COMMON OPTIONS
@@ -26,31 +26,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -58,18 +59,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -86,84 +87,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
@@ -172,14 +180,14 @@
 .nf
 \fC
 tpm2_startup
-\f
+\fR
 .fi
 .SS Send a TPM Startup Command with flags TPM2_SU_CLEAR
 .IP
 .nf
 \fC
-tpm2_startup\ \-c
-\f
+tpm2_startup \-c
+\fR
 .fi
 .SH NOTES
 .PP
@@ -207,4 +215,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_stirrandom.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_stirrandom.1 Changed

@@ -1,30 +1,31 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_stirrandom" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_stirrandom\f(1) \- Add "additional information" into TPM RNG
-state.
+\fBtpm2_stirrandom\fR(1) \- Add \lqadditional information\rq
+into TPM RNG state.
 .SH SYNOPSIS
 .PP
-\fBtpm2_stirrandom\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_stirrandom\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_stirrandom\f(1) \- Inject "additional information" as bytes
-into TPM entropy Protected Capability pool.
+\fBtpm2_stirrandom\fR(1) \- Inject \lqadditional information\rq
+as bytes into TPM entropy Protected Capability pool.
 .PP
-"Additional information" can be extracted from file specified as
-argument or being read from \fISTDIN\f if argument is not specified.
+\lqAdditional information\rq can be extracted from file specified as
+argument or being read from \fISTDIN\fR if argument is not
+specified.
 .PP
 Up to 128 bytes can be injected at once through standard input to
-\fBtpm2_stirrandom\f(1).
+\fBtpm2_stirrandom\fR(1).
 .PP
-If input file is larger than 128 bytes, \fBtpm2_stirrandom\f(1) will
-fail.
+If input file is larger than 128 bytes, \fBtpm2_stirrandom\fR(1)
+will fail.
 .PP
-Adding data through \fBtpm2_stirrandom\f(1) will trigger a reseeding
-of TPM DRBG Protected Capability.
+Adding data through \fBtpm2_stirrandom\fR(1) will trigger a
+reseeding of TPM DRBG Protected Capability.
 It is used when performing any sensitive action on a shielded location
 such as loading a persistent key or acting on a Protected Capability
 like updating TPM firmware.
@@ -37,31 +38,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -69,18 +71,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -97,84 +99,91 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.)
 .RE
 .SH EXAMPLES
@@ -182,36 +191,37 @@
 .IP
 .nf
 \fC
-echo\ \-n\ "myrandomdata"\ |\ tpm2_stirrandom
-\f
+echo \-n \dqmyrandomdata\dq | tpm2_stirrandom
+\fR
 .fi
 .SS Inject 64 bytes from stdin using a file
 .IP
 .nf
 \fC
-dd\ if=/dev/urandom\ bs=1\ count=64\ >\ myrandom.bin
+dd if=/dev/urandom bs=1 count=64 > myrandom.bin
 
-tpm2_stirrandom\ <\ ./myrandom.bin
-\f
+tpm2_stirrandom < ./myrandom.bin
+\fR
 .fi
 .SS Inject bytes from a file and reading up to 128 bytes
 .IP
 .nf
 \fC
-dd\ if=/dev/urandom\ of=./myrandom.bin\ bs=1\ count=42
+dd if=/dev/urandom of=./myrandom.bin bs=1 count=42
 
-tpm2_stirrandom\ ./myrandom.bin
-\f
+tpm2_stirrandom ./myrandom.bin
+\fR
 .fi
 .SH NOTES
 .PP
-Please be aware that even if the "additional information" added by
-\fBtpm2_stirrandom\f(1) can be entropy gathered from other DRBG
+Please be aware that even if the \lqadditional information\rq added
+by \fBtpm2_stirrandom\fR(1) can be entropy gathered from other DRBG
 sources, the TPM has no way of determining if the value has any entropy
 or not.
-As a consequence, it will just be considered as "additional input".
+As a consequence, it will just be considered as \lqadditional
+input\rq.
 .PP
-The "additional input" is as defined in NIST
+The \lqadditional input\rq is as defined in NIST
 SP800\-90A (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-90.pdf)
 .SH Returns
 .PP
@@ -234,4 +244,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_testparms.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_testparms.1 Changed

@@ -1,24 +1,24 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_testparms" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_testparms\f(1) \- Verify that specified algorithm suite is
+\fBtpm2_testparms\fR(1) \- Verify that specified algorithm suite is
 supported by TPM
 .SH SYNOPSIS
 .PP
-\fBtpm2_testparms\f \fIOPTIONS\f \fIARGUMENT\f
+\fBtpm2_testparms\fR \fIOPTIONS\fR \fIARGUMENT\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_testparms\f(1) \- Checks that the suite specified by
-\fIALG_SPEC\f is available for usage per \fIALGORITHM\f.
+\fBtpm2_testparms\fR(1) \- Checks that the suite specified by
+\fIALG_SPEC\fR is available for usage per \fIALGORITHM\fR.
 .PP
-Algorithms should follow the "formatting standards", see section
-"Algorithm Specifiers".
+Algorithms should follow the \lqformatting standards\rq, see section
+\lqAlgorithm Specifiers\rq.
 .PP
-Also, see section "Supported Signing Schemes" for a list of supported
-hash algorithms.
+Also, see section \lqSupported Signing Schemes\rq for a list of
+supported hash algorithms.
 .SH OPTIONS
 .PP
 This tool accepts no tool specific options.
@@ -28,31 +28,32 @@
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -60,18 +61,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -88,89 +89,96 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -181,7 +189,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -192,6 +200,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -225,6 +235,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -252,7 +264,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -261,27 +273,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -289,21 +309,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -316,6 +338,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -328,42 +352,41 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH Signature Format Specifiers
 .PP
 Format selection for the signature output file.
-\fBtss\f (the default) will output a binary blob according to the
+\fBtss\fR (the default) will output a binary blob according to the
 TPM 2.0 specification and any potential compiler padding.
-The option \fBplain\f will output the plain signature data as
+The option \fBplain\fR will output the plain signature data as
 defined by the used cryptographic algorithm.
 .SH EXAMPLES
-.SS Check whether if "rsa" is supported
+.SS Check whether if \lqrsa\rq is supported
 .IP
 .nf
 \fC
-tpm2_testparms\ rsa
-\f
+tpm2_testparms rsa
+\fR
 .fi
 .SS Check that ECDSA using P\-256 with AES\-128 CTR mode is available
 .IP
 .nf
 \fC
-tpm2_testparms\ ecc256:ecdsa:aes128ctr
-\f
+tpm2_testparms ecc256:ecdsa:aes128ctr
+\fR
 .fi
 .SH Returns
 .PP
@@ -386,4 +409,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_unseal.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_unseal.1 Changed

@@ -1,61 +1,78 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_unseal" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_unseal\f(1) \- Returns a data blob in a loaded TPM object.
+\fBtpm2_unseal\fR(1) \- Returns a data blob in a loaded TPM object.
 The data blob is returned in clear.
 .SH SYNOPSIS
 .PP
-\fBtpm2_unseal\f \fIOPTIONS\f
+\fBtpm2_unseal\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_unseal\f(1) \- Returns a data blob in a loaded TPM object.
+\fBtpm2_unseal\fR(1) \- Returns a data blob in a loaded TPM object.
 The data blob is returned in clear.
 The data is sealed at the time of the object creation using the
-\fBtpm2_create\f tool.
+\fBtpm2_create\fR tool.
 Such an object intended for sealing data has to be of the type
-\fITPM_ALG_KEYEDHASH\f.
+\fITPM_ALG_KEYEDHASH\fR.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-object\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-object\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Object context for the loaded object.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
-Optional auth value to use for the key specified by \fB\-c\f.
+Optional auth value to use for the key specified by \fB\-c\fR.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-output\f=\fIFILE\f:
+\fB\-o\fR, \fB\-\-output\fR=\fIFILE\fR:
 .RS 2
 .PP
 Output file name containing the unsealed data.
-Defaults to \fISTDOUT\f if not specified.
+Defaults to \fISTDOUT\fR if not specified.
 .RE
 .IP \bu 2
-\fB\-\-cphash\f=\fIFILE\f
+\fB\-\-cphash\fR=\fIFILE\fR
 .RS 2
 .PP
 File path to record the hash of the command parameters.
 This is commonly termed as cpHash.
 NOTE: When this option is selected, The tool will not actually execute
-the command, it simply returns a cpHash.
+the command, it simply returns a cpHash, it simply returns a cpHash,
+unless rphash is also required.
+.RE
+.IP \bu 2
+\fB\-\-rphash\fR=\fIFILE\fR
+.RS 2
+.PP
+File path to record the hash of the response parameters.
+This is commonly termed as rpHash.
+.RE
+.IP \bu 2
+\fB\-S\fR, \fB\-\-session\fR=\fIFILE\fR:
+.RS 2
+.PP
+The session created using \fBtpm2_startauthsession\fR.
+Multiple of these can be specified.
+For example, you can have one session for auditing and another for
+encryption/decryption of the parameters.
 .RE
 .SS References
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -68,8 +85,7 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Authorization Formatting
 .PP
 Authorization for use of an object in TPM2.0 can come in 3 different
@@ -78,45 +94,45 @@
 HMAC 3.
 Sessions
 .PP
-\fBNOTE:\f "Authorizations default to the \fBEMPTY PASSWORD\f
-when not specified".
+\fBNOTE:\fR \lqAuthorizations default to the \fBEMPTY
+PASSWORD\fR when not specified\rq.
 .SS Passwords
 .PP
 Passwords are interpreted in the following forms below using prefix
 identifiers.
 .PP
-\fBNote\f: By default passwords are assumed to be in the string form
-when they do not have a prefix.
+\fBNote\fR: By default passwords are assumed to be in the string
+form when they do not have a prefix.
 .SS String
 .PP
-A string password, specified by prefix "str:" or it\aqs absence (raw
-string without prefix) is not interpreted, and is directly used for
-authorization.
+A string password, specified by prefix \lqstr:\rq or it\cqs
+absence (raw string without prefix) is not interpreted, and is directly
+used for authorization.
 .SS Examples
 .IP
 .nf
 \fC
 foobar
 str:foobar
-\f
+\fR
 .fi
 .SS Hex\-string
 .PP
-A hex\-string password, specified by prefix "hex:" is converted from a
-hexidecimal form into a byte array form, thus allowing passwords with
-non\-printable and/or terminal un\-friendly characters.
+A hex\-string password, specified by prefix \lqhex:\rq is converted
+from a hexidecimal form into a byte array form, thus allowing passwords
+with non\-printable and/or terminal un\-friendly characters.
 .SS Example
 .IP
 .nf
 \fC
-hex:0x1122334455667788
-\f
+hex:1122334455667788
+\fR
 .fi
 .SS File
 .PP
-A file based password, specified be prefix "file:" should be the path of
-a file containing the password to be read by the tool or a "\-" to use
-stdin.
+A file based password, specified be prefix \lqfile:\rq should be the
+path of a file containing the password to be read by the tool or a
+\lq\-\rq to use stdin.
 Storing passwords in files prevents information leakage, passwords
 passed as options can be read from the process list or common shell
 history features.
@@ -124,69 +140,71 @@
 .IP
 .nf
 \fC
-#\ to\ use\ stdin\ and\ be\ prompted
+# to use stdin and be prompted
 file:\-
 
-#\ to\ use\ a\ file\ from\ a\ path
+# to use a file from a path
 file:path/to/password/file
 
-#\ to\ echo\ a\ password\ via\ stdin:
-echo\ foobar\ |\ tpm2_tool\ \-p\ file:\-
+# to echo a password via stdin:
+echo foobar | tpm2_tool \-p file:\-
 
-#\ to\ use\ a\ bash\ here\-string\ via\ stdin:
+# to use a bash here\-string via stdin:
 
-tpm2_tool\ \-p\ file:\-\ <<<\ foobar
-\f
+tpm2_tool \-p file:\- <<< foobar
+\fR
 .fi
 .SS Sessions
 .PP
 When using a policy session to authorize the use of an object, prefix
-the option argument with the \fIsession\f keyword.
+the option argument with the \fIsession\fR keyword.
 Then indicate a path to a session file that was created with
 tpm2_startauthsession(1).
 Optionally, if the session requires an auth value to be sent with the
 session handle (eg policy password), then append a + and a string as
-described in the \fBPasswords\f section.
+described in the \fBPasswords\fR section.
 .SS Examples
 .PP
-To use a session context file called \fIsession.ctx\f.
+To use a session context file called \fIsession.ctx\fR.
 .IP
 .nf
 \fC
 session:session.ctx
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
 send the authvalue mypassword.
 .IP
 .nf
 \fC
 session:session.ctx+mypassword
-\f
+\fR
 .fi
 .PP
-To use a session context file called \fIsession.ctx\f \fBAND\f
-send the \fIHEX\f authvalue 0x11223344.
+To use a session context file called \fIsession.ctx\fR \fBAND\fR
+send the \fIHEX\fR authvalue 0x11223344.
 .IP
 .nf
 \fC
 session:session.ctx+hex:11223344
-\f
+\fR
 .fi
 .SS PCR Authorizations
 .PP
-You can satisfy a PCR policy using the "pcr:" prefix and the PCR
+You can satisfy a PCR policy using the \lqpcr:\rq prefix and the PCR
 minilanguage.
 The PCR minilanguage is as follows:
-\fC<pcr\-spec>=<raw\-pcr\-file>\f
+\fC<pcr\-spec>=<raw\-pcr\-file>\fR
 .PP
-The PCR spec is documented in in the section "PCR bank specifiers".
+The PCR spec is documented in in the section \lqPCR bank
+specifiers\rq.
 .PP
-The \fCraw\-pcr\-file\f is an \fBoptional\f the output of the
-raw PCR contents as returned by \fItpm2_pcrread(1)\f.
+The \fCraw\-pcr\-file\fR is an \fBoptional\fR argument that
+contains the output of the raw PCR contents as returned by
+\fItpm2_pcrread(1)\fR.
 .PP
-PCR bank specifiers (common/pcr.md)
+PCR bank specifiers (pcr.md)
 .SS Examples
 .PP
 To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier
@@ -195,40 +213,41 @@
 .nf
 \fC
 pcr:sha256:0,1,2,3
-\f
+\fR
 .fi
 .PP
-specifying \fIAUTH\f.
+specifying \fIAUTH\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -236,18 +255,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -264,101 +283,108 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-c\ primary.ctx\ \-Q
+tpm2_createprimary \-c primary.ctx \-Q
 
-tpm2_pcrread\ \-Q\ \-o\ pcr.bin\ sha256:0,1,2,3
+tpm2_pcrread \-Q \-o pcr.bin sha256:0,1,2,3
 
-tpm2_createpolicy\ \-Q\ \-\-policy\-pcr\ \-l\ sha256:0,1,2,3\ \-f\ pcr.bin\ \-L\ pcr.policy
+tpm2_createpolicy \-Q \-\-policy\-pcr \-l sha256:0,1,2,3 \-f pcr.bin \-L pcr.policy
 
-echo\ \aqsecret\aq\ |\ tpm2_create\ \-C\ primary.ctx\ \-L\ pcr.policy\ \-i\-\\
-\-u\ seal.pub\ \-r\ seal.priv\ \-c\ seal.ctx\ \-Q
+echo \aqsecret\aq | tpm2_create \-C primary.ctx \-L pcr.policy \-i\-\rs
+\-u seal.pub \-r seal.priv \-c seal.ctx \-Q
 
-tpm2_unseal\ \-c\ seal.ctx\ \-p\ pcr:sha256:0,1,2,3
-\f
+tpm2_unseal \-c seal.ctx \-p pcr:sha256:0,1,2,3
+\fR
 .fi
 .SH Returns
 .PP
@@ -381,4 +407,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_verifysignature.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_verifysignature.1 Changed

@@ -1,86 +1,87 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_verifysignature" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_verifysignature\f(1) \- Validates a signature using the TPM.
+\fBtpm2_verifysignature\fR(1) \- Validates a signature using the
+TPM.
 .SH SYNOPSIS
 .PP
-\fBtpm2_verifysignature\f \fIOPTIONS\f
+\fBtpm2_verifysignature\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_verifysignature\f(1) \- Uses loaded keys to validate a
+\fBtpm2_verifysignature\fR(1) \- Uses loaded keys to validate a
 signature on a message with the message digest passed to the TPM.
 If the signature check succeeds, then the TPM will produce a
-\fBTPMT_TK_VERIFIED\f.
-Otherwise, the TPM shall return \fBTPM_RC_SIGNATURE\f.
+\fBTPMT_TK_VERIFIED\fR.
+Otherwise, the TPM shall return \fBTPM_RC_SIGNATURE\fR.
 If object references an asymmetric key, only the public portion of the
 key needs to be loaded.
 If object references a symmetric key, both the public and private
 portions need to be loaded.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIOBJECT\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIOBJECT\fR:
 .RS 2
 .PP
 Context object for the key context used for the operation.
 Either a file or a handle number.
-See section "Context Object Format".
+See section \lqContext Object Format\rq.
 .RE
 .IP \bu 2
-\fB\-g\f, \fB\-\-hash\-algorithm\f=\fIALGORITHM\f:
+\fB\-g\fR, \fB\-\-hash\-algorithm\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The hash algorithm used to digest the message.
-Algorithms should follow the "formatting standards", see section
-"Algorithm Specifiers".
-Also, see section "Supported Hash Algorithms" for a list of supported
-hash algorithms.
+Algorithms should follow the \lqformatting standards\rq, see section
+\lqAlgorithm Specifiers\rq.
+Also, see section \lqSupported Hash Algorithms\rq for a list of
+supported hash algorithms.
 .RE
 .IP \bu 2
-\fB\-m\f, \fB\-\-message\f=\fIFILE\f:
+\fB\-m\fR, \fB\-\-message\fR=\fIFILE\fR:
 .RS 2
 .PP
 The message file, containing the content to be digested.
 .RE
 .IP \bu 2
-\fB\-d\f, \fB\-\-digest\f=\fIFILE\f:
+\fB\-d\fR, \fB\-\-digest\fR=\fIFILE\fR:
 .RS 2
 .PP
 The input hash file, containing the hash of the message.
-If this option is selected, then the message (\fB\-m\f) and
-algorithm (\fB\-g\f) options do not need to be specified.
+If this option is selected, then the message (\fB\-m\fR) and
+algorithm (\fB\-g\fR) options do not need to be specified.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-signature\f=\fIFILE\f:
+\fB\-s\fR, \fB\-\-signature\fR=\fIFILE\fR:
 .RS 2
 .PP
 The input signature file of the signature to be validated.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-scheme\f=\fISCHEME\f:
+\fB\-f\fR, \fB\-\-scheme\fR=\fISCHEME\fR:
 .RS 2
 .PP
 The signing scheme that was used to sign the message.
 This option should only be specified if the signature comes in from a
-non \fItss\f standard, like openssl.
-See "Signature format specifiers" for more details.
-The \fItss\f format contains the signature metadata required to
-understand it\aqs signature scheme.
+non \fItss\fR standard, like openssl.
+See \lqSignature format specifiers\rq for more details.
+The \fItss\fR format contains the signature metadata required to
+understand it\cqs signature scheme.
 .PP
-Signing schemes should follow the "formatting standards", see section
-"Algorithm Specifiers".
+Signing schemes should follow the \lqformatting standards\rq, see
+section \lqAlgorithm Specifiers\rq.
 .RE
 .IP \bu 2
-\fB\-\-format\f=\fISCHEME\f:
+\fB\-\-format\fR=\fISCHEME\fR:
 .RS 2
 .PP
 Deprecated.
-Same as \fB\-\-scheme\f.
+Same as \fB\-\-scheme\fR.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-ticket\f=\fIFILE\f:
+\fB\-t\fR, \fB\-\-ticket\fR=\fIFILE\fR:
 .RS 2
 .PP
 The ticket file to record the validation structure.
@@ -89,12 +90,12 @@
 .SH Context Object Format
 .PP
 The type of a context object, whether it is a handle or file name, is
-determined according to the following logic \fIin\-order\f:
+determined according to the following logic \fIin\-order\fR:
 .IP \bu 2
 If the argument is a file path, then the file is loaded as a restored
 TPM transient object.
 .IP \bu 2
-If the argument is a \fIprefix\f match on one of:
+If the argument is a \fIprefix\fR match on one of:
 .RS 2
 .IP \bu 2
 owner: the owner hierarchy
@@ -107,11 +108,10 @@
 .RE
 .IP \bu 2
 If the argument argument can be loaded as a number it will be treat as a
-handle, e.g.
-0x81010013 and used directly.\fIOBJECT\f.
+handle, e.g.\ 0x81010013 and used directly._OBJECT_.
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -122,7 +122,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -133,6 +133,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -166,6 +168,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -193,7 +197,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -202,27 +206,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
+.IP \bu 2
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+sm4 \- Default SM4: sm4128
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
+.IP \bu 2
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -230,21 +242,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -257,6 +271,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -269,51 +285,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -321,18 +337,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -349,142 +365,148 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH Signature Format Specifiers
 .PP
 Format selection for the signature output file.
-\fBtss\f (the default) will output a binary blob according to the
+\fBtss\fR (the default) will output a binary blob according to the
 TPM 2.0 specification and any potential compiler padding.
-The option \fBplain\f will output the plain signature data as
+The option \fBplain\fR will output the plain signature data as
 defined by the used cryptographic algorithm.
 .SH EXAMPLES
-.SS Sign and verify with the TPM using the \fIendorsement\f
-hierarchy
+.SS Sign and verify with the TPM using the \fIendorsement\fR hierarchy
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ e\ \-c\ primary.ctx
+tpm2_createprimary \-C e \-c primary.ctx
 
-tpm2_create\ \-G\ rsa\ \-u\ rsa.pub\ \-r\ rsa.priv\ \-C\ primary.ctx
+tpm2_create \-G rsa \-u rsa.pub \-r rsa.priv \-C primary.ctx
 
-tpm2_load\ \-C\ primary.ctx\ \-u\ rsa.pub\ \-r\ rsa.priv\ \-c\ rsa.ctx
+tpm2_load \-C primary.ctx \-u rsa.pub \-r rsa.priv \-c rsa.ctx
 
-echo\ "my\ message\ >\ message.dat
+echo \dqmy message > message.dat
 
-tpm2_sign\ \-c\ rsa.ctx\ \-g\ sha256\ \-m\ message.dat\ \-s\ sig.rssa
+tpm2_sign \-c rsa.ctx \-g sha256 \-m message.dat \-s sig.rssa
 
-tpm2_verifysignature\ \-c\ rsa.ctx\ \-g\ sha256\ \-m\ message.dat\ \-s\ sig.rssa
-\f
+tpm2_verifysignature \-c rsa.ctx \-g sha256 \-m message.dat \-s sig.rssa
+\fR
 .fi
 .SS Sign with openssl and verify with the TPM
 .IP
 .nf
 \fC
-#\ Generate\ an\ ECC\ key
-openssl\ ecparam\ \-name\ prime256v1\ \-genkey\ \-noout\ \-out\ private.ecc.pem
+# Generate an ECC key
+openssl ecparam \-name prime256v1 \-genkey \-noout \-out private.ecc.pem
 
-openssl\ ec\ \-in\ private.ecc.pem\ \-out\ public.ecc.pem\ \-pubout
+openssl ec \-in private.ecc.pem \-out public.ecc.pem \-pubout
 
-#\ Generate\ a\ hash\ to\ sign\ (OSSL\ needs\ the\ hash\ of\ the\ message)
-echo\ "data\ to\ sign"\ >\ data.in.raw
+# Generate a hash to sign (OSSL needs the hash of the message)
+echo \dqdata to sign\dq > data.in.raw
 
-sha256sum\ data.in.raw\ |\ awk\ \aq{\ print\ "000000\ "\ $1\ }\aq\ |\ \\
-xxd\ \-r\ \-c\ 32\ >\ data.in.digest
+sha256sum data.in.raw | awk \aq{ print \dq000000 \dq $1 }\aq | \rs
+xxd \-r \-c 32 > data.in.digest
 
-#\ Load\ the\ private\ key\ for\ signing
-tpm2_loadexternal\ \-Q\ \-G\ ecc\ \-r\ private.ecc.pem\ \-c\ key.ctx
+# Load the private key for signing
+tpm2_loadexternal \-Q \-G ecc \-r private.ecc.pem \-c key.ctx
 
-#\ Sign\ in\ the\ TPM\ and\ verify\ with\ OSSL
-tpm2_sign\ \-Q\ \-c\ key.ctx\ \-g\ sha256\ \-d\ data.in.digest\ \-f\ plain\ \-s\ data.out.signed
+# Sign in the TPM and verify with OSSL
+tpm2_sign \-Q \-c key.ctx \-g sha256 \-d data.in.digest \-f plain \-s data.out.signed
 
-openssl\ dgst\ \-verify\ public.ecc.pem\ \-keyform\ pem\ \-sha256\ \\
-\-signature\ data.out.signed\ data.in.raw
+openssl dgst \-verify public.ecc.pem \-keyform pem \-sha256 \rs
+\-signature data.out.signed data.in.raw
 
-#\ Sign\ with\ openssl\ and\ verify\ with\ TPM
-openssl\ dgst\ \-sha256\ \-sign\ private.ecc.pem\ \-out\ data.out.signed\ data.in.raw
+# Sign with openssl and verify with TPM
+openssl dgst \-sha256 \-sign private.ecc.pem \-out data.out.signed data.in.raw
 
-tpm2_verifysignature\ \-Q\ \-c\ key.ctx\ \-g\ sha256\ \-m\ data.in.raw\ \-f\ ecdsa\ \\
-\-s\ data.out.signed
-\f
+tpm2_verifysignature \-Q \-c key.ctx \-g sha256 \-m data.in.raw \-f ecdsa \rs
+\-s data.out.signed
+\fR
 .fi
 .SH Returns
 .PP
@@ -507,4 +529,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tpm2_zgen2phase.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tpm2_zgen2phase.1 Changed

@@ -1,37 +1,37 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tpm2_zgen2phase" "1" "" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtpm2_zgen2phase\f(1) \- Command to enable the TPM to combine data
-from the other party with the ephemeral key generated in the first phase
-of two\-phase key exchange protocols.
+\fBtpm2_zgen2phase\fR(1) \- Command to enable the TPM to combine
+data from the other party with the ephemeral key generated in the first
+phase of two\-phase key exchange protocols.
 .SH SYNOPSIS
 .PP
-\fBtpm2_zgen2phase\f \fIOPTIONS\f
+\fBtpm2_zgen2phase\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtpm2_zgen2phase\f(1) \- Command to enable the TPM to combine data
-from the other party with the ephemeral key generated in the first phase
-of two\-phase key exchange protocols.
+\fBtpm2_zgen2phase\fR(1) \- Command to enable the TPM to combine
+data from the other party with the ephemeral key generated in the first
+phase of two\-phase key exchange protocols.
 .SH OPTIONS
 .IP \bu 2
-\fB\-c\f, \fB\-\-key\-context\f=\fIFILE\f:
+\fB\-c\fR, \fB\-\-key\-context\fR=\fIFILE\fR:
 .RS 2
 .PP
 Context object pointing to ECC key.
 Either a file or a handle number.
-See section "Context Object Format".
+See section \lqContext Object Format\rq.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-key\-auth\f=\fIAUTH\f:
+\fB\-p\fR, \fB\-\-key\-auth\fR=\fIAUTH\fR:
 .RS 2
 .PP
 The authorization value for the ECC key object.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-scheme\f=\fIALGORITHM\f:
+\fB\-s\fR, \fB\-\-scheme\fR=\fIALGORITHM\fR:
 .RS 2
 .PP
 The key exchange scheme.
@@ -39,31 +39,31 @@
 Valid options are ecdh or sm2.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-counter\f=\fINATURALNUMBER\f:
+\fB\-t\fR, \fB\-\-counter\fR=\fINATURALNUMBER\fR:
 .RS 2
 .PP
 The commit count to determine the key index to use.
 .RE
 .IP \bu 2
-\fB\-\-static\-public\f=\fIFILE\f:
+\fB\-\-static\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 The static public key input of the other party.
 .RE
 .IP \bu 2
-\fB\-\-ephemeral\-public\f=\fIFILE\f:
+\fB\-\-ephemeral\-public\fR=\fIFILE\fR:
 .RS 2
 .PP
 The ephemeral public key input of the other party.
 .RE
 .IP \bu 2
-\fB\-\-output\-Z1\f=\fIFILE\f
+\fB\-\-output\-Z1\fR=\fIFILE\fR
 .RS 2
 .PP
 Specify file path to save the calculated ecdh secret Z1 point.
 .RE
 .IP \bu 2
-\fB\-\-output\-Z2\f=\fIFILE\f
+\fB\-\-output\-Z2\fR=\fIFILE\fR
 .RS 2
 .PP
 Specify file path to save the calculated ecdh secret Z2 point.
@@ -71,7 +71,7 @@
 .SS References
 .SH Algorithm Specifiers
 .PP
-Options that take algorithms support "nice\-names".
+Options that take algorithms support \lqnice\-names\rq.
 .PP
 There are two major algorithm specification string classes, simple and
 complex.
@@ -82,7 +82,7 @@
 These are strings with no additional specification data.
 When creating objects, non\-specified portions of an object are assumed
 to defaults.
-You can find the list of known "Simple Specifiers Below".
+You can find the list of known \lqSimple Specifiers\rq below.
 .SS Asymmetric
 .IP \bu 2
 rsa
@@ -93,6 +93,8 @@
 aes
 .IP \bu 2
 camellia
+.IP \bu 2
+sm4
 .SS Hashing Algorithms
 .IP \bu 2
 sha1
@@ -126,6 +128,8 @@
 ecdaa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Asymmetric Encryption Schemes
 .IP \bu 2
 oaep
@@ -153,7 +157,7 @@
 algorithms to populate in the public data.
 Things like type, scheme and asymmetric details, key size, etc.
 Below is the general format for specifying this data:
-\fC<type>:<scheme>:<symmetric\-details>\f
+\fC<type>:<scheme>:<symmetric\-details>\fR
 .SS Type Specifiers
 .PP
 This portion of the complex algorithm specifier is required.
@@ -162,27 +166,35 @@
 .IP \bu 2
 aes \- Default AES: aes128
 .IP \bu 2
-aes128\fC<mode>\f \- 128 bit AES with optional mode
-(\fIctr\f|\fIofb\f|\fIcbc\f|\fIcfb\f|\fIecb\f).
-If mode is not specified, defaults to \fInull\f.
+aes128\fC<mode>\fR \- 128 bit AES with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
+.IP \bu 2
+aes192\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+192 bit key size.
 .IP \bu 2
-aes192\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 192
-bit key size.
+aes256\fC<mode>\fR \- Same as aes128\fC<mode>\fR, except for a
+256 bit key size.
 .IP \bu 2
-aes256\fC<mode>\f \- Same as aes128\fC<mode>\f, except for a 256
-bit key size.
+sm4 \- Default SM4: sm4128
+.IP \bu 2
+sm4128 or sm4_128 \fC<mode>\fR \- 128 bit SM4 with optional mode
+(\fIctr\fR|\fIofb\fR|\fIcbc\fR|\fIcfb\fR|\fIecb\fR).
+If mode is not specified, defaults to \fInull\fR.
 .IP \bu 2
 ecc \- Elliptical Curve, defaults to ecc256.
 .IP \bu 2
-ecc192 \- 192 bit ECC
+ecc192 or ecc_nist_p192 \- 192 bit ECC NIST curve
+.IP \bu 2
+ecc224 or ecc_nist_p224 \- 224 bit ECC NIST curve
 .IP \bu 2
-ecc224 \- 224 bit ECC
+ecc256 or ecc_nist_p256 \- 256 bit ECC NIST curve
 .IP \bu 2
-ecc256 \- 256 bit ECC
+ecc384 or ecc_nist_p384 \- 384 bit ECC NIST curve
 .IP \bu 2
-ecc384 \- 384 bit ECC
+ecc521 or ecc_nist_p521 \- 521 bit ECC NIST curve
 .IP \bu 2
-ecc521 \- 521 bit ECC
+ecc_sm2 or ecc_sm2_p256 \- 256 bit SM2 curve
 .IP \bu 2
 rsa \- Default RSA: rsa2048
 .IP \bu 2
@@ -190,21 +202,23 @@
 .IP \bu 2
 rsa2048 \- RSA with 2048 bit keysize.
 .IP \bu 2
+rsa3072 \- RSA with 3072 bit keysize.
+.IP \bu 2
 rsa4096 \- RSA with 4096 bit keysize.
 .SS Scheme Specifiers
 .PP
 Next, is an optional field, it can be skipped.
 .PP
-Schemes are usually \fBSigning Schemes\f or \fBAsymmetric
-Encryption Schemes\f.
+Schemes are usually \fBSigning Schemes\fR or \fBAsymmetric
+Encryption Schemes\fR.
 Most signing schemes take a hash algorithm directly following the
 signing scheme.
-If the hash algorithm is missing, it defaults to \fIsha256\f.
+If the hash algorithm is missing, it defaults to \fIsha256\fR.
 Some take no arguments, and some take multiple arguments.
 .SS Hash Optional Scheme Specifiers
 .PP
 These scheme specifiers are followed by a dash and a valid hash
-algorithm, For example: \fCoaep\-sha256\f.
+algorithm, For example: \fCoaep\-sha256\fR.
 .IP \bu 2
 oaep
 .IP \bu 2
@@ -217,6 +231,8 @@
 ecdsa
 .IP \bu 2
 ecschnorr
+.IP \bu 2
+sm2
 .SS Multiple Option Scheme Specifiers
 .PP
 This scheme specifier is followed by a count (max size UINT16) then
@@ -229,51 +245,51 @@
 * rsaes
 .SS Symmetric Details Specifiers
 .PP
-This field is optional, and defaults based on the \fItype\f of
-object being created and it\aqs attributes.
-Generally, any valid \fBSymmetric\f specifier from the \fBType
-Specifiers\f list should work.
+This field is optional, and defaults based on the \fItype\fR of
+object being created and it\cqs attributes.
+Generally, any valid \fBSymmetric\fR specifier from the \fBType
+Specifiers\fR list should work.
 If not specified, an asymmetric objects symmetric details defaults to
-\fIaes128cfb\f.
+\fIaes128cfb\fR.
 .SS Examples
 .SS Create an rsa2048 key with an rsaes asymmetric encryption scheme
 .PP
-\fCtpm2_create\ \-C\ parent.ctx\ \-G\ rsa2048:rsaes\ \-u\ key.pub\ \-r\ key.priv\f
-.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4
-and sha384 hash
+\fCtpm2_create \-C parent.ctx \-G rsa2048:rsaes \-u key.pub \-r key.priv\fR
+.SS Create an ecc256 key with an ecdaa signing scheme with a count of 4 and sha384 hash
 .PP
-\fC/tpm2_create\ \-C\ parent.ctx\ \-G\ ecc256:ecdaa4\-sha384\ \-u\ key.pub\ \-r\ key.priv\f
-cryptographic algorithms \fIALGORITHM\f.
+\fC/tpm2_create \-C parent.ctx \-G ecc256:ecdaa4\-sha384 \-u key.pub \-r key.priv\fR
+cryptographic algorithms \fIALGORITHM\fR.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to many programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help=man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help=man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See man(1) for more details.
+installed or on \fIMANPATH\fR, See man(1) for more details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .IP \bu 2
-\fB\-V\f, \fB\-\-verbose\f: Increase the information that the
+\fB\-V\fR, \fB\-\-verbose\fR: Increase the information that the
 tool prints to the console during its execution.
 When using this option the file and line number are printed.
 .IP \bu 2
-\fB\-Q\f, \fB\-\-quiet\f: Silence normal tool output to stdout.
+\fB\-Q\fR, \fB\-\-quiet\fR: Silence normal tool output to
+stdout.
 .IP \bu 2
-\fB\-Z\f, \fB\-\-enable\-errata\f: Enable the application of
+\fB\-Z\fR, \fB\-\-enable\-errata\fR: Enable the application of
 errata fixups.
 Useful if an errata fixup needs to be applied to commands sent to the
 TPM.
@@ -281,18 +297,18 @@
 information many users may expect.
 .SH TCTI Configuration
 .PP
-The TCTI or "Transmission Interface" is the communication mechanism with
-the TPM.
+The TCTI or \lqTransmission Interface\rq is the communication
+mechanism with the TPM.
 TCTIs can be changed for communication with TPMs across different
 mediums.
 .PP
 To control the TCTI, the tools respect:
 .IP "1." 3
-The command line option \fB\-T\f or \fB\-\-tcti\f
+The command line option \fB\-T\fR or \fB\-\-tcti\fR
 .IP "2." 3
-The environment variable: \fITPM2TOOLS_TCTI\f.
+The environment variable: \fITPM2TOOLS_TCTI\fR.
 .PP
-\fBNote:\f The command line option always overrides the environment
+\fBNote:\fR The command line option always overrides the environment
 variable.
 .PP
 The current known TCTIs are:
@@ -309,101 +325,108 @@
 Some tools allow for off\-tpm options and thus support not using a TCTI.
 Tools that do not support it will error when attempted to be used
 without a TCTI connection.
-Does not support \fIANY\f options and \fIMUST BE\f presented as
-the exact text of "none".
+Does not support \fIANY\fR options and \fIMUST BE\fR presented
+as the exact text of \lqnone\rq.
 .PP
 The arguments to either the command line option or the environment
 variable are in the form:
 .PP
-\fC<tcti\-name>:<tcti\-option\-config>\f
+\fC<tcti\-name>:<tcti\-option\-config>\fR
 .PP
-Specifying an empty string for either the \fC<tcti\-name>\f or
-\fC<tcti\-option\-config>\f results in the default being used for
+Specifying an empty string for either the \fC<tcti\-name>\fR or
+\fC<tcti\-option\-config>\fR results in the default being used for
 that portion respectively.
 .SS TCTI Defaults
 .PP
 When a TCTI is not specified, the default TCTI is searched for using
-\fIdlopen(3)\f semantics.
-The tools will search for \fItabrmd\f, \fIdevice\f and
-\fImssim\f TCTIs \fBIN THAT ORDER\f and \fBUSE THE FIRST ONE
-FOUND\f.
+\fIdlopen(3)\fR semantics.
+The tools will search for \fItabrmd\fR, \fIdevice\fR and
+\fImssim\fR TCTIs \fBIN THAT ORDER\fR and \fBUSE THE FIRST ONE
+FOUND\fR.
 You can query what TCTI will be chosen as the default by using the
-\fB\-v\f option to print the version information.
-The "default\-tcti" key\-value pair will indicate which of the
+\fB\-v\fR option to print the version information.
+The \lqdefault\-tcti\rq key\-value pair will indicate which of the
 aforementioned TCTIs is the default.
 .SS Custom TCTIs
 .PP
 Any TCTI that implements the dynamic TCTI interface can be loaded.
-The tools internally use \fIdlopen(3)\f, and the raw
-\fItcti\-name\f value is used for the lookup.
+The tools internally use \fIdlopen(3)\fR, and the raw
+\fItcti\-name\fR value is used for the lookup.
 Thus, this could be a path to the shared library, or a library name as
-understood by \fIdlopen(3)\f semantics.
+understood by \fIdlopen(3)\fR semantics.
 .SH TCTI OPTIONS
 .PP
 This collection of options are used to configure the various known TCTI
 modules available:
 .IP \bu 2
-\fBdevice\f: For the device TCTI, the TPM character device file for
+\fBdevice\fR: For the device TCTI, the TPM character device file for
 use by the device TCTI can be specified.
-The default is \fI/dev/tpm0\f.
+The default is \fI/dev/tpm0\fR.
 .RS 2
 .PP
-Example: \fB\-T device:/dev/tpm0\f or \fBexport
-\fITPM2TOOLS_TCTI\f="device:/dev/tpm0"\f
+Example: \fB\-T device:/dev/tpm0\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqdevice:/dev/tpm0\rq\fR
 .RE
 .IP \bu 2
-\fBmssim\f: For the mssim TCTI, the domain name or IP address and
+\fBmssim\fR: For the mssim TCTI, the domain name or IP address and
 port number used by the simulator can be specified.
 The default are 127.0.0.1 and 2321.
 .RS 2
 .PP
-Example: \fB\-T mssim:host=localhost,port=2321\f or \fBexport
-\fITPM2TOOLS_TCTI\f="mssim:host=localhost,port=2321"\f
+Example: \fB\-T mssim:host=localhost,port=2321\fR or \fBexport
+\fBITPM2TOOLS_TCTI\fB=\lqmssim:host=localhost,port=2321\rq\fR
 .RE
 .IP \bu 2
-\fBabrmd\f: For the abrmd TCTI, the configuration string format is a
-series of simple key value pairs separated by a \aq,\aq character.
-Each key and value string are separated by a \aq=\aq character.
+\fBabrmd\fR: For the abrmd TCTI, the configuration string format is
+a series of simple key value pairs separated by a `,' character.
+Each key and value string are separated by a `=' character.
 .RS 2
 .IP \bu 2
 TCTI abrmd supports two keys:
 .RS 2
 .IP "1." 3
-\aqbus_name\aq : The name of the tabrmd service on the bus (a
-string).
+`bus_name' : The name of the tabrmd service on the bus (a string).
 .IP "2." 3
-\aqbus_type\aq : The type of the dbus instance (a string) limited to
-\aqsession\aq and \aqsystem\aq.
+`bus_type' : The type of the dbus instance (a string) limited to
+`session' and `system'.
 .RE
 .PP
 Specify the tabrmd tcti name and a config string of
-\fCbus_name=com.example.FooBar\f:
-.PP
-\fC\\\-\-tcti=tabrmd:bus_name=com.example.FooBar\f
+\fCbus_name=com.example.FooBar\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti=tabrmd:bus_name=com.example.FooBar
+\fR
+.fi
 .PP
 Specify the default (abrmd) tcti and a config string of
-\fCbus_type=session\f:
-.PP
-\fC\\\-\-tcti:bus_type=session\f
+\fCbus_type=session\fR:
+.IP
+.nf
+\fC
+\rs\-\-tcti:bus_type=session
+\fR
+.fi
 .PP
-\fBNOTE\f: abrmd and tabrmd are synonymous.
+\fBNOTE\fR: abrmd and tabrmd are synonymous.
 the various known TCTI modules.
 .RE
 .SH EXAMPLES
 .IP
 .nf
 \fC
-tpm2_createprimary\ \-C\ o\ \-c\ prim.ctx\ \-Q
+tpm2_createprimary \-C o \-c prim.ctx \-Q
 
-tpm2_create\ \-C\ prim.ctx\ \-c\ key.ctx\ \-u\ key.pub\ \-r\ key.priv\ \-G\ ecc256:ecdh\ \-Q
+tpm2_create \-C prim.ctx \-c key.ctx \-u key.pub \-r key.priv \-G ecc256:ecdh \-Q
 
-tpm2_ecephemeral\ \-u\ ecc.q\ \-t\ ecc.ctr\ ecc256
+tpm2_ecephemeral \-u ecc.q \-t ecc.ctr ecc256
 
-tpm2_ecdhkeygen\ \-u\ ecdh.pub\ \-o\ ecdh.priv\ \-c\ key.ctx
+tpm2_ecdhkeygen \-u ecdh.pub \-o ecdh.priv \-c key.ctx
 
-tpm2_zgen2phase\ \-c\ key.ctx\ \-\-static\-public\ ecdh.pub\ \-\-ephemeral\-public\ ecc.q\ \\
-\-t\ 0\ \-\-output\-Z1\ z1.bin\ \-\-output\-Z2\ z2.bin
-\f
+tpm2_zgen2phase \-c key.ctx \-\-static\-public ecdh.pub \-\-ephemeral\-public ecc.q \rs
+\-t 0 \-\-output\-Z1 z1.bin \-\-output\-Z2 z2.bin
+\fR
 .fi
 .SH Returns
 .PP
@@ -426,4 +449,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_authorizepolicy.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_authorizepolicy.1 Changed

@@ -1,78 +1,79 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_authorizepolicy" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_authorizepolicy\f(1) \-
+\fBtss2_authorizepolicy\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_authorizepolicy\f \fIOPTIONS\f
+\fBtss2_authorizepolicy\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_authorizepolicy\f(1) \- This command signs a given policy
+\fBtss2_authorizepolicy\fR(1) \- This command signs a given policy
 with a given key such that the policy can be referenced from other
 policies that contain a corresponding PolicyAuthorize elements.
 The signature is done using the TPM signing schemes as specified in the
-cryptographic profile (cf., \fBfapi\-profile(5)\f).
+cryptographic profile (cf., \fBfapi\-profile(5)\fR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-P\f, \fB\-\-policyPath\f=\fISTRING\f: Path of the new
-policy.
+\fB\-P\fR, \fB\-\-policyPath\fR=\fISTRING\fR: Path of the
+new policy.
 .RS 2
 .PP
-A policyPath is composed of two elements, separated by "/".
-A policyPath starts with "/policy".
+A policyPath is composed of two elements, separated by \lq/\rq.
+A policyPath starts with \lq/policy\rq.
 The second path element identifies the policy or policy template using a
 meaningful name.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-keyPath\f=\fISTRING\f: Path of the signing
-key.
+\fB\-p\fR, \fB\-\-keyPath\fR=\fISTRING\fR: Path of the
+signing key.
 .IP \bu 2
-\fB\-r\f, \fB\-\-policyRef\f=\fIFILENAME\f or \fI\-\f
-(for stdin): A byte buffer to be included in the signature.
+\fB\-r\fR, \fB\-\-policyRef\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdin): A byte buffer to be included in the signature.
 Optional parameter.
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_authorizepolicy\ \-\-keyPath=HS/SRK/myPolicySignKey\ \-\-policyPath=/policy/pcr\-policy\ \-\-policyRef=policyRef.file
-\f
+tss2_authorizepolicy \-\-keyPath=HS/SRK/myPolicySignKey \-\-policyPath=/policy/pcr\-policy \-\-policyRef=policyRef.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -82,4 +83,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_changeauth.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_changeauth.1 Changed

@@ -1,32 +1,32 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_changeauth" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_changeauth\f(1) \- This command changes the authorization
+\fBtss2_changeauth\fR(1) \- This command changes the authorization
 data of an entity referred to by the path.
 .SH SYNOPSIS
 .PP
-\fBtss2_changeauth\f \fIOPTIONS\f
+\fBtss2_changeauth\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_changeauth\f(1) \-
+\fBtss2_changeauth\fR(1) \-
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-a\f, \fB\-\-authValue\f=\fISTRING\f:
+\fB\-a\fR, \fB\-\-authValue\fR=\fISTRING\fR:
 .RS 2
 .PP
 The new UTF\-8 password.
@@ -34,15 +34,15 @@
 If it is neglected then the user is queried interactively for a
 password.
 To set no password, this option should be used with the empty string
-("").
+(\dq\dq).
 The maximum password size is determined by the digest size of the chosen
 name hash algorithm in the cryptographic profile (cf.,
-\fBfapi\-profile(5)\f).
+\fBfapi\-profile(5)\fR).
 For example, choosing SHA256 as hash algorithm, allows passwords of a
 maximum size of 32 characters.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-entityPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-entityPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path identifying the entity to modify.
@@ -52,38 +52,38 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLES
 .SS Change a password for an entity HS/SRK/myRSACryptKey to M1
 .IP
 .nf
 \fC
-tss2_changeauth\ \-\-entityPath=HS/SRK/myRSACryptKey\ \-\-authValue=M1
-\f
+tss2_changeauth \-\-entityPath=HS/SRK/myRSACryptKey \-\-authValue=M1
+\fR
 .fi
-.SS Change a password for an entity HS/SRK/myRSACryptKey and ask the
-user to enter the password.
+.SS Change a password for an entity HS/SRK/myRSACryptKey and ask the user to enter the password.
 .IP
 .nf
 \fC
-tss2_changeauth\ \-\-entityPath=HS/SRK/myRSACryptKey
-\f
+tss2_changeauth \-\-entityPath=HS/SRK/myRSACryptKey
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -93,4 +93,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_createkey.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_createkey.1 Changed

@@ -1,42 +1,42 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_createkey" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_createkey\f(1) \-
+\fBtss2_createkey\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_createkey\f \fIOPTIONS\f
+\fBtss2_createkey\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_createkey\f(1) \- This commands creates a key inside the TPM
-and stores it in the FAPI metadata store and if requested persistently
-inside the TPM.
+\fBtss2_createkey\fR(1) \- This commands creates a key inside the
+TPM and stores it in the FAPI metadata store and if requested
+persistently inside the TPM.
 Depending on the specified key type, cryptographic algorithms and
 parameters for the created key are determined by the corresponding
-cryptographic profile (cf., \fBfapi\-profile(5)\f).
+cryptographic profile (cf., \fBfapi\-profile(5)\fR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path to the new key.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-type\f=\fISTRING\f:
+\fB\-t\fR, \fB\-\-type\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the intended usage.
@@ -45,36 +45,36 @@
 .IP
 .nf
 \fC
-\-\ "sign":\ Sets\ the\ sign\ attribute\ of\ a\ key.
-\-\ "decrypt":\ Sets\ the\ decrypt\ attribute\ of\ a\ key.
-\-\ Hint:\ If\ neither\ sign\ nor\ decrypt\ are\ provided,\ both\ attributes\ are\ set.
-\-\ "restricted":\ Sets\ the\ restricted\ attribute\ of\ a\ key.
-\-\ Hint:\ If\ restricted\ is\ set,\ sign\ or\ decrypt\ (but\ not\ both)\ need\ to\ be\ set.
-\-\ "exportable":\ Clears\ the\ fixedTPM\ and\ fixedParent\ attributes\ of\ a\ key\ or
-\ \ sealed\ object.
-\-\ "noda":\ Sets\ the\ noda\ attribute\ of\ a\ key\ or\ NV\ index.
-\-\ "system":\ Stores\ the\ data\ blobs\ and\ metadata\ for\ a\ created\ key\ or\ seal
-\ \ in\ the\ system\-wide\ directory\ instead\ of\ user\aqs\ personal\ directory.
-\-\ A\ hexadecimal\ number\ (e.g.\ "0x81000001"):\ Marks\ a\ key\ object\ to\ be
-\ \ made\ persistent\ and\ sets\ the\ persistent\ object\ handle\ to\ this\ value.
-\f
+\- \dqsign\dq: Sets the sign attribute of a key.
+\- \dqdecrypt\dq: Sets the decrypt attribute of a key.
+\- Hint: If neither sign nor decrypt are provided, both attributes are set.
+\- \dqrestricted\dq: Sets the restricted attribute of a key.
+\- Hint: If restricted is set, sign or decrypt (but not both) need to be set.
+\- \dqexportable\dq: Clears the fixedTPM and fixedParent attributes of a key or
+  sealed object.
+\- \dqnoda\dq: Sets the noda attribute of a key or NV index.
+\- \dqsystem\dq: Stores the data blobs and metadata for a created key or seal
+  in the system\-wide directory instead of user\aqs personal directory.
+\- A hexadecimal number (e.g. \dq0x81000001\dq): Marks a key object to be
+  made persistent and sets the persistent object handle to this value.
+\fR
 .fi
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-policyPath\f=\fISTRING\f:
+\fB\-P\fR, \fB\-\-policyPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 The policy to be associated with the new key.
 Optional parameter.
 If omitted then no policy will be associated with the key.
 .PP
-A policyPath is composed of two elements, separated by "/".
-A policyPath starts with "/policy".
+A policyPath is composed of two elements, separated by \lq/\rq.
+A policyPath starts with \lq/policy\rq.
 The second path element identifies the policy or policy template using a
 meaningful name.
 .RE
 .IP \bu 2
-\fB\-a\f, \fB\-\-authValue\f=\fISTRING\f:
+\fB\-a\fR, \fB\-\-authValue\fR=\fISTRING\fR:
 .RS 2
 .PP
 The new UTF\-8 password.
@@ -82,10 +82,10 @@
 If it is neglected then the user is queried interactively for a
 password.
 To set no password, this option should be used with the empty string
-("").
+(\dq\dq).
 The maximum password size is determined by the digest size of the chosen
 name hash algorithm in the cryptographic profile (cf.,
-\fBfapi\-profile(5)\f).
+\fBfapi\-profile(5)\fR).
 For example, choosing SHA256 as hash algorithm, allows passwords of a
 maximum size of 32 characters.
 .RE
@@ -94,44 +94,45 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .SS Create a key without password
 .IP
 .nf
 \fC
-tss2_createkey\ \-\-path=HS/SRK/myRsaCryptKey\ \-\-type="noDa,\ decrypt"\ \-\-authValue=""
-\f
+tss2_createkey \-\-path=HS/SRK/myRsaCryptKey \-\-type=\dqnoDa, decrypt\dq \-\-authValue=\dq\dq
+\fR
 .fi
 .SS Create a key, ask for password on the command line
 .IP
 .nf
 \fC
-tss2_createkey\ \-\-path=HS/SRK/myRsaCryptKey\ \-\-type="noDa,\ decrypt"
-\f
+tss2_createkey \-\-path=HS/SRK/myRsaCryptKey \-\-type=\dqnoDa, decrypt\dq
+\fR
 .fi
-.SS Create a key with password "abc".
+.SS Create a key with password \lqabc\rq.
 .IP
 .nf
 \fC
-tss2_createkey\ \-\-path=HS/SRK/myRsaCryptKey\ \-\-type="noDa,\ decrypt"\ \-\-authValue=abc
-\f
+tss2_createkey \-\-path=HS/SRK/myRsaCryptKey \-\-type=\dqnoDa, decrypt\dq \-\-authValue=abc
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -141,4 +142,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_createnv.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_createnv.1 Changed

@@ -1,38 +1,38 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_createnv" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_createnv\f(1) \-
+\fBtss2_createnv\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_createnv\f \fIOPTIONS\f
+\fBtss2_createnv\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_createnv\f(1) \- This command creates an NV index in the
+\fBtss2_createnv\fR(1) \- This command creates an NV index in the
 TPM.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 Path of the new NV space.
 .PP
-The path is composed of three elements, separated by "/".
-An nvPath starts with "/nv".
+The path is composed of three elements, separated by \lq/\rq.
+An nvPath starts with \lq/nv\rq.
 The second path element identifies the NV handle range for the nv
 object.
 This includes the following values: Owner, TPM, Platform,
@@ -42,7 +42,7 @@
 meaningful name.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-type\f=\fISTRING\f:
+\fB\-t\fR, \fB\-\-type\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the intended usage.
@@ -51,38 +51,38 @@
 .IP
 .nf
 \fC
-\-\ "noda":\ Sets\ the\ noda\ attribute\ of\ a\ key\ or\ NV\ index.
-\-\ "bitfield":\ Sets\ the\ NV\ type\ to\ bitfield.
-\-\ "counter":\ Sets\ the\ NV\ type\ to\ counter.
-\-\ "pcr":\ Sets\ the\ NV\ type\ to\ pcr\-like\ behavior.
-\-\ Hint:\ If\ none\ of\ the\ previous\ three\ keywords\ is\ provided\ a\ regular\ NV
-\ \ index\ is\ created.
-\f
+\- \dqnoda\dq: Sets the noda attribute of a key or NV index.
+\- \dqbitfield\dq: Sets the NV type to bitfield.
+\- \dqcounter\dq: Sets the NV type to counter.
+\- \dqpcr\dq: Sets the NV type to pcr\-like behavior.
+\- Hint: If none of the previous three keywords is provided a regular NV
+  index is created.
+\fR
 .fi
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-size\f=\fIINTEGER\f:
+\fB\-s\fR, \fB\-\-size\fR=\fIINTEGER\fR:
 .RS 2
 .PP
 The size in bytes of the NV index to be created.
-Can be omitted if size can be inferred from the type; e.g.
-an NV index of type counter has a size of 8 bytes.
+Can be omitted if size can be inferred from the type; e.g.\ an NV index
+of type counter has a size of 8 bytes.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-policyPath\f=\fISTRING\f:
+\fB\-P\fR, \fB\-\-policyPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the policy to be associated with the new NV space.
 Optional parameter.
 If omitted then no policy will be associated with the key.
 .PP
-A policyPath is composed of two elements, separated by "/".
-A policyPath starts with "/policy".
+A policyPath is composed of two elements, separated by \lq/\rq.
+A policyPath starts with \lq/policy\rq.
 The second path element identifies the policy or policy template using a
 meaningful name.
 .RE
 .IP \bu 2
-\fB\-a\f, \fB\-\-authValue\f=\fISTRING\f:
+\fB\-a\fR, \fB\-\-authValue\fR=\fISTRING\fR:
 .RS 2
 .PP
 The new UTF\-8 password.
@@ -90,10 +90,10 @@
 If it is neglected then the user is queried interactively for a
 password.
 To set no password, this option should be used with the empty string
-("").
+(\dq\dq).
 The maximum password size is determined by the digest size of the chosen
 name hash algorithm in the cryptographic profile (cf.,
-\fBfapi\-profile(5)\f).
+\fBfapi\-profile(5)\fR).
 For example, choosing SHA256 as hash algorithm, allows passwords of a
 maximum size of 32 characters.
 .RE
@@ -102,29 +102,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_createnv\ \-\-authValue=abc\ \-\-path=/nv/Owner/myNV\ \-\-size=20\ \-\-type="noDa"
-\f
+tss2_createnv \-\-authValue=abc \-\-path=/nv/Owner/myNV \-\-size=20 \-\-type=\dqnoDa\dq
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -134,4 +135,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_createseal.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_createseal.1 Changed

@@ -1,43 +1,42 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_createseal" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_createseal\f(1) \-
+\fBtss2_createseal\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_createseal\f \fIOPTIONS\f
+\fBtss2_createseal\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_createseal\f(1) \- This command creates a sealed object and
+\fBtss2_createseal\fR(1) \- This command creates a sealed object and
 stores it in the FAPI metadata store.
-If no data is provided (i.e.
-a NULL\-pointer) then the TPM generates random data and fills the sealed
-object.
+If no data is provided (i.e.\ a NULL\-pointer) then the TPM generates
+random data and fills the sealed object.
 TPM signing schemes are used as specified in the cryptographic profile
-(cf., \fBfapi\-profile(5)\f).
+(cf., \fBfapi\-profile(5)\fR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path to the new key.
 .RE
 .IP \bu 2
-\fB\-t\f, \fB\-\-type\f=\fISTRING\f:
+\fB\-t\fR, \fB\-\-type\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the intended usage.
@@ -46,31 +45,31 @@
 .IP
 .nf
 \fC
-\-\ "exportable":\ Clears\ the\ fixedTPM\ and\ fixedParent\ attributes\ of\ a\ key\ or
-\ \ sealed\ object.
-\-\ "noda":\ Sets\ the\ noda\ attribute\ of\ a\ key\ or\ NV\ index.
-\-\ "system":\ Stores\ the\ data\ blobs\ and\ metadata\ for\ a\ created\ key\ or\ seal
-\ \ in\ the\ system\-wide\ directory\ instead\ of\ user\aqs\ personal\ directory.
-\-\ A\ hexadecimal\ number\ (e.g.\ "0x81000001"):\ Marks\ a\ key\ object\ to\ be
-\ \ made\ persistent\ and\ sets\ the\ persistent\ object\ handle\ to\ this\ value.
-\f
+\- \dqexportable\dq: Clears the fixedTPM and fixedParent attributes of a key or
+  sealed object.
+\- \dqnoda\dq: Sets the noda attribute of a key or NV index.
+\- \dqsystem\dq: Stores the data blobs and metadata for a created key or seal
+  in the system\-wide directory instead of user\aqs personal directory.
+\- A hexadecimal number (e.g. \dq0x81000001\dq): Marks a key object to be
+  made persistent and sets the persistent object handle to this value.
+\fR
 .fi
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-policyPath\f=\fISTRING\f:
+\fB\-P\fR, \fB\-\-policyPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the policy to be associated with the new key.
 Optional parameter.
 If omitted then no policy will be associated with the key.
 .PP
-A policyPath is composed of two elements, separated by "/".
-A policyPath starts with "/policy".
+A policyPath is composed of two elements, separated by \lq/\rq.
+A policyPath starts with \lq/policy\rq.
 The second path element identifies the policy or policy template using a
 meaningful name.
 .RE
 .IP \bu 2
-\fB\-a\f, \fB\-\-authValue\f=\fISTRING\f:
+\fB\-a\fR, \fB\-\-authValue\fR=\fISTRING\fR:
 .RS 2
 .PP
 The new UTF\-8 password.
@@ -78,16 +77,16 @@
 If it is neglected then the user is queried interactively for a
 password.
 To set no password, this option should be used with the empty string
-("").
+(\dq\dq).
 The maximum password size is determined by the digest size of the chosen
 name hash algorithm in the cryptographic profile (cf.,
-\fBfapi\-profile(5)\f).
+\fBfapi\-profile(5)\fR).
 For example, choosing SHA256 as hash algorithm, allows passwords of a
 maximum size of 32 characters.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-data\f=\fIFILENAME\f or \fI\-\f (for
-stdin):
+\fB\-i\fR, \fB\-\-data\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdin):
 .RS 2
 .PP
 The data to be sealed by the TPM.
@@ -95,12 +94,12 @@
 Must not be used together with \-\-size.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-size\f=\fIINTEGER\f:
+\fB\-s\fR, \fB\-\-size\fR=\fIINTEGER\fR:
 .RS 2
 .PP
 Determines the number of random bytes the TPM should generate and seal.
 Optional parameter.
-Must not be "0".
+Must not be \lq0\rq.
 Must no be used together with \-\-data.
 .RE
 .SH COMMON OPTIONS
@@ -108,30 +107,31 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
-.SS Create a key with password "abc" and read sealing data from file.
+.SS Create a key with password \lqabc\rq and read sealing data from file.
 .IP
 .nf
 \fC
-tss2_createseal\ \-\-path=HS/SRK/mySealKey\ \-\-type="noDa"\ \-\-authValue=abc\ \-\-data=data.file
-\f
+tss2_createseal \-\-path=HS/SRK/mySealKey \-\-type=\dqnoDa\dq \-\-authValue=abc \-\-data=data.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -141,4 +141,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_decrypt.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_decrypt.1 Changed

@@ -1,53 +1,54 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_decrypt" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_decrypt\f(1) \- decrypts data
+\fBtss2_decrypt\fR(1) \- decrypts data
 .SH SYNOPSIS
 .PP
-\fBtss2_decrypt\f \fIOPTIONS\f
+\fBtss2_decrypt\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_decrypt\f(1) \- This command decrypts data that was
+\fBtss2_decrypt\fR(1) \- This command decrypts data that was
 encrypted using tss2_encrypt using the TPM decryption schemes as
-specified in the cryptographic profile (cf., \fBfapi\-profile(5)\f).
+specified in the cryptographic profile (cf.,
+\fBfapi\-profile(5)\fR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-p\f, \fB\-\-keyPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-keyPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the decryption key.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-cipherText\f=\fIFILENAME\f or \fI\-\f
-(for stdin):
+\fB\-i\fR, \fB\-\-cipherText\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdin):
 .RS 2
 .PP
 The JSON\-encoded cipherText.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force Overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-plainText\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-o\fR, \fB\-\-plainText\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 Returns the decrypted data.
@@ -58,29 +59,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-\ \ \ \ tss2_decrypt\ \-\-keyPath=HS/SRK/myRSACrypt\ \-\-cipherText=cipherText.file\ \-\-plainText=plainText.file
-\f
+    tss2_decrypt \-\-keyPath=HS/SRK/myRSACrypt \-\-cipherText=cipherText.file \-\-plainText=plainText.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -90,4 +92,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_delete.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_delete.1 Changed

@@ -1,45 +1,45 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_delete" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_delete\f(1) \-
+\fBtss2_delete\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_delete\f \fIOPTIONS\f
+\fBtss2_delete\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_delete\f(1) \- This command deletes the given key, policy or
-NV from the FAPI metadata store and the TPM.
+\fBtss2_delete\fR(1) \- This command deletes the given key, policy
+or NV from the FAPI metadata store and the TPM.
 Depending on the entity type, one of the following actions are taken:
 .IP
 .nf
 \fC
-\-\ Non\-persistent\ key:\ Flush\ from\ TPM\ (if\ loaded)\ and\ delete\ public\ and\ private\ blobs\ from\ keystore.
-\-\ Persistent\ keys:\ Evict\ from\ TPM\ and\ delete\ public\ and\ private\ blobs\ from\ keystore
-\-\ Primary\ keys:\ Flush\ from\ TPM\ and\ delete\ public\ blob\ from\ keystore
-\-\ NV\ index:\ Undefine\ NV\ index\ from\ TPM\ and\ delete\ public\ blob\ from\ FAPI\ metadata\ store
-\-\ Policies:\ Delete\ entry\ from\ policy\ store
-\-\ Hierarchy,\ PCR:\ These\ are\ not\ deletable
-\-\ Special\ keys\ ek,\ srk:\ These\ are\ not\ deletable
-\f
+\- Non\-persistent key: Flush from TPM (if loaded) and delete public and private blobs from keystore.
+\- Persistent keys: Evict from TPM and delete public and private blobs from keystore
+\- Primary keys: Flush from TPM and delete public blob from keystore
+\- NV index: Undefine NV index from TPM and delete public blob from FAPI metadata store
+\- Policies: Delete entry from policy store
+\- Hierarchy, PCR: These are not deletable
+\- Special keys ek, srk: These are not deletable
+\fR
 .fi
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path to the entity to delete.
@@ -49,30 +49,31 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .SH Deletes storage hierarchy (HS) and everything below it:
 .IP
 .nf
 \fC
-tss2_delete\ \-\-path=/HS
-\f
+tss2_delete \-\-path=/HS
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -82,4 +83,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_encrypt.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_encrypt.1 Changed

@@ -1,53 +1,53 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_encrypt" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_encrypt\f(1) \- encrypts data
+\fBtss2_encrypt\fR(1) \- encrypts data
 .SH SYNOPSIS
 .PP
-\fBtss2_encrypt\f \fIOPTIONS\f
+\fBtss2_encrypt\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_encrypt\f(1) \- This command encrypts the provided data for
+\fBtss2_encrypt\fR(1) \- This command encrypts the provided data for
 a target key using the TPM encryption schemes as specified in the
-cryptographic profile (cf., \fBfapi\-profile(5)\f).
+cryptographic profile (cf., \fBfapi\-profile(5)\fR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-p\f, \fB\-\-keyPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-keyPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the encryption key.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-plainText\f=\fIFILENAME\f or \fI\-\f
-(for stdin):
+\fB\-i\fR, \fB\-\-plainText\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdin):
 .RS 2
 .PP
 The data to be encrypted.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-cipherText\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-o\fR, \fB\-\-cipherText\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 Returns the JSON\-encoded ciphertext.
@@ -57,29 +57,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-\ \ tss2_encrypt\ \-\-keyPath=HS/SRK/myRSACrypt\ \-\-plainText=plainText.file\ \-\-cipherText=cipherText.file
-\f
+  tss2_encrypt \-\-keyPath=HS/SRK/myRSACrypt \-\-plainText=plainText.file \-\-cipherText=cipherText.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -89,4 +90,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_exportkey.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_exportkey.1 Changed

@@ -1,36 +1,36 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_exportkey" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_exportkey\f(1) \-
+\fBtss2_exportkey\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_exportkey\f \fIOPTIONS\f
+\fBtss2_exportkey\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_exportkey\f(1) \- This command will duplicate a key and
+\fBtss2_exportkey\fR(1) \- This command will duplicate a key and
 encrypt it using the public key of a new parent.
 The exported data will contain the re\-wrapped key pointed to by the
 pathOfKeyToDuplicate and then the JSON encoded policy.
 Encryption is done according to TPM encryption schemes specified in the
-cryptographic profile (cf., \fBfapi\-profile(5)\f).
+cryptographic profile (cf., \fBfapi\-profile(5)\fR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-e\f \fB\-\-pathToPublicKeyOfNewParent\f=\fISTRING\f:
+\fB\-e\fR \fB\-\-pathToPublicKeyOfNewParent\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path to the public key of the new parent.
@@ -39,20 +39,20 @@
 If omitted only the public key will exported.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-exportedData\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-o\fR, \fB\-\-exportedData\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 Returns the exported subtree.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-pathOfKeyToDuplicate\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-pathOfKeyToDuplicate\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path to the root of the subtree to export.
@@ -62,29 +62,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_exportkey\ \-\-pathOfKeyToDuplicate=HS/SRK/myRSADecrypt\ \-\-exportedData=exportedData.file
-\f
+tss2_exportkey \-\-pathOfKeyToDuplicate=HS/SRK/myRSADecrypt \-\-exportedData=exportedData.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -94,4 +95,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_exportpolicy.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_exportpolicy.1 Changed

@@ -1,45 +1,45 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_policyexport" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_policyexport\f(1) \-
+\fBtss2_policyexport\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_policyexport\f \fIOPTIONS\f
+\fBtss2_policyexport\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_policyexport\f(1) \- This commands exports a policy
+\fBtss2_policyexport\fR(1) \- This commands exports a policy
 associated with a key in JSON encoding.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-jsonPolicy\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-o\fR, \fB\-\-jsonPolicy\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 Returns the JSON\-encoded policy.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path of the key.
@@ -49,29 +49,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_exportpolicy\ \-\-path=HS/SRK/myRSASign\ \-\-jsonPolicy=jsonPolicy.json
-\f
+tss2_exportpolicy \-\-path=HS/SRK/myRSASign \-\-jsonPolicy=jsonPolicy.json
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -81,4 +82,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_getappdata.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_getappdata.1 Changed

@@ -1,45 +1,45 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_getappdata" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_getappdata\f(1)
+\fBtss2_getappdata\fR(1)
 .SH SYNOPSIS
 .PP
-\fBtss2_getappdata\f \fIOPTIONS\f
+\fBtss2_getappdata\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_getappdata\f(1) \- This command returns the previously
+\fBtss2_getappdata\fR(1) \- This command returns the previously
 stored application data for an object.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 Path of the object for which the application data will be loaded.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-appData\f=\fIFILENAME\f or \fI\-\f (for
-stdout):
+\fB\-o\fR, \fB\-\-appData\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdout):
 .RS 2
 .PP
 Returns a copy of the stored data.
@@ -50,29 +50,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_getappdata\ \-\-path=HS/SRK/myRSACrypt\ \-\-appData=appData.file
-\f
+tss2_getappdata \-\-path=HS/SRK/myRSACrypt \-\-appData=appData.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -82,4 +83,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_getcertificate.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_getcertificate.1 Changed

@@ -1,45 +1,45 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_getcertificate" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_getcertificate\f(1) \-
+\fBtss2_getcertificate\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_getcertificate\f \fIOPTIONS\f
+\fBtss2_getcertificate\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_getcertificate\f(1) \- This command returns the PEM encoded
+\fBtss2_getcertificate\fR(1) \- This command returns the PEM encoded
 X.509 certificate associated with the key at path.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 The entity whose certificate is requested.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-x509certData\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-o\fR, \fB\-\-x509certData\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 Returns the PEM encoded certificate.
@@ -50,29 +50,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_getcertificate\ \-\-path=HS/SRK/myRSACrypt\ \-\-x509certData=x509certData.file
-\f
+tss2_getcertificate \-\-path=HS/SRK/myRSACrypt \-\-x509certData=x509certData.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -82,4 +83,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_getdescription.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_getdescription.1 Changed

@@ -1,46 +1,46 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_getdescription" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_getdescription\f(1)
+\fBtss2_getdescription\fR(1)
 .SH SYNOPSIS
 .PP
-\fBtss2_getdescription\f \fIOPTIONS\f
+\fBtss2_getdescription\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_getdescription\f(1) \- This command returns the previously
+\fBtss2_getdescription\fR(1) \- This command returns the previously
 stored application data for an object.
 If no description is present, an empty string is returned.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path of the object for which the description will be loaded.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-description\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-o\fR, \fB\-\-description\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 Returns the stored description.
@@ -50,29 +50,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_getdescription\ \-\-path=HS/SRK\ \-\-description=description.file
-\f
+tss2_getdescription \-\-path=HS/SRK \-\-description=description.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -82,4 +83,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_getinfo.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_getinfo.1 Changed

@@ -1,40 +1,40 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_getinfo" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_getinfo\f(1) \-
+\fBtss2_getinfo\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_getinfo\f \fIOPTIONS\f
+\fBtss2_getinfo\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_getinfo\f(1) \- This command returns a UTF\-8 string
+\fBtss2_getinfo\fR(1) \- This command returns a UTF\-8 string
 identifying the version of the FAPI, the TPM, configurations and other
 relevant information in a human readable format.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-info\f=\fIFILENAME\f or \fI\-\f (for
-stdout):
+\fB\-o\fR, \fB\-\-info\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdout):
 .RS 2
 .PP
 Returns the FAPI and TPM information.
@@ -44,29 +44,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_getinfo\ \-\-info=info.file
-\f
+tss2_getinfo \-\-info=info.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -76,4 +77,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_getplatformcertificates.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_getplatformcertificates.1 Changed

@@ -1,27 +1,27 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_getplatformcertificates" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_getplatformcertificates\f(1) \-
+\fBtss2_getplatformcertificates\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_getplatformcertificates\f \fIOPTIONS\f
+\fBtss2_getplatformcertificates\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_getplatformcertificates\f(1) \- This command returns the set
-of platform certificates concatenated in a continuous buffer if the
+\fBtss2_getplatformcertificates\fR(1) \- This command returns the
+set of platform certificates concatenated in a continuous buffer if the
 platform provides platform certificates.
 Platform certificates for TPM 2.0 can consist not only of a single
 certificate but also a series of so\-called delta certificates.
@@ -29,14 +29,14 @@
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-certificates\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-o\fR, \fB\-\-certificates\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 Returns a continuous buffer containing the concatenated platform
@@ -47,29 +47,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_getplatformcertificates\ \-\-certificates=certificates.file
-\f
+tss2_getplatformcertificates \-\-certificates=certificates.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -79,4 +80,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_getrandom.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_getrandom.1 Changed

@@ -1,82 +1,83 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_getrandom" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_getrandom\f(1) \- # SYNOPSIS
+\fBtss2_getrandom\fR(1) \- # SYNOPSIS
 .PP
-\fBtss2_getrandom\f \fIOPTIONS\f
+\fBtss2_getrandom\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_getrandom\f(1) \- This command uses the TPM to create an
+\fBtss2_getrandom\fR(1) \- This command uses the TPM to create an
 array of random bytes.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-n\f, \fB\-\-numBytes\f=\fIINTEGER\f:
+\fB\-n\fR, \fB\-\-numBytes\fR=\fIINTEGER\fR:
 .RS 2
 .PP
 The number of bytes requested by the caller.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-data\f=\fIFILENAME\f or \fI\-\f (for
-stdout):
+\fB\-o\fR, \fB\-\-data\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdout):
 .RS 2
 .PP
 The returned random bytes.
 .RE
 .IP \bu 2
-\fB\-\-hex\f
+\fB\-\-hex\fR
 .RS 2
 .PP
-Convert the output data to hex format without a leading "0x".
+Convert the output data to hex format without a leading \lq0x\rq.
 .RE
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-\ \ \ \ tss2_getrandom\ \-\-numBytes=20\ \-data=\-\ |\ hexdump\ \-C
-\f
+    tss2_getrandom \-\-numBytes=20 \-\-data=\- | hexdump \-C
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -86,4 +87,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_gettpm2object.1 Added

@@ -0,0 +1,104 @@
+.\" Automatically generated by Pandoc 2.5
+.\"
+.TH "tss2_gettpm2object" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
+.hy
+.SH NAME
+.PP
+\fBtss2_gettpm2object\fR(1)
+.SH SYNOPSIS
+.PP
+\fBtss2_gettpm2object\fR \fIOPTIONS\fR
+.SH SEE ALSO
+.PP
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
+cryptographic profile and TCTI or directories for the Fapi metadata
+storages.
+.PP
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
+parameters for all keys and operations of a specific TPM interaction
+like the name hash algorithm, the asymmetric signature algorithm, scheme
+and parameters and PCR bank selection.
+.SH DESCRIPTION
+.PP
+\fBtss2_gettpm2object\fR(1) \- With this command for FAPI objects
+context files which can be used by tpm2 tool commands can be created.
+For persistent object only the textual representation of the handle
+number as hex number will be written and for keys a tpm2 tool context
+file will be written.
+If the default TCTI differs from the FAPI profile the default the tcti
+can be defined with the \-T (\entcti) option.
+\fBNote\fR To avoid wrong nv_written state in keystore before
+writing data to the NV ram with tpm2_nvwrite, at least an empty string
+should be written with tss2_nvwrite.
+.SH OPTIONS
+.PP
+These are the available options:
+.IP \bu 2
+\fB\-f\fR, \fB\-\-force\fR:
+.RS 2
+.PP
+Force overwriting the output file.
+.RE
+.IP \bu 2
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
+.RS 2
+.PP
+Path of the object for which the application data will be loaded.
+.RE
+.IP \bu 2
+\fB\-c\fR, \fB\-\-context\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdout):
+.RS 2
+.PP
+The returned key context or handle.
+.RE
+.SH COMMON OPTIONS
+.PP
+This collection of options are common to all tss2 programs and provide
+information that many users may expect.
+.IP \bu 2
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
+manpage.
+By default, it attempts to invoke the manpager for the tool, however, on
+failure will output a short tool summary.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
+.RS 2
+.PP
+To successfully use the manpages feature requires the manpages to be
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
+.RE
+.IP \bu 2
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
+.SH EXAMPLES
+.IP
+.nf
+\fC
+tss2_gettpm2object \-\-path=/HS/SRK/myRSACrypt \-\-key\-context=mykey.ctx
+tss2_gettpm2object \-\-path=/nv/Owner/mynv \-c\-
+\fR
+.fi
+.PP
+The command can be used in options of tpm2 commands:
+.IP
+.nf
+\fC
+handle=$(tss2_gettpm2object \-\-path=/nv/Owner/mynv \-c\-)
+tpm2_nvread $handle
+\fR
+.fi
+.SH RETURNS
+.PP
+0 on success or 1 on failure.
+.SH BUGS
+.PP
+Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
+.SH HELP
+.PP
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_gettpmblobs.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_gettpmblobs.1 Changed

@@ -1,64 +1,63 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_gettpmblobs" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_gettpmblobs\f(1) \-
+\fBtss2_gettpmblobs\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_gettpmblobs\f \fIOPTIONS\f
+\fBtss2_gettpmblobs\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_gettpmblobs\f(1) \- This command returns the public and
+\fBtss2_gettpmblobs\fR(1) \- This command returns the public and
 private blobs of an object, such that they could be loaded by a
-low\-level API (e.g.
-ESAPI).
+low\-level API (e.g.\ ESAPI).
 It also returns the policy associated with these blobs in JSON format.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path of the object for which the blobs will be returned.
 .RE
 .IP \bu 2
-\fB\-u\f, \fB\-\-tpm2bPublic\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-u\fR, \fB\-\-tpm2bPublic\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 The returned public area of the object as a marshalled TPM2B_PUBLIC.
 Optional parameter.
 .RE
 .IP \bu 2
-\fB\-r\f, \fB\-\-tpm2bPrivate\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-r\fR, \fB\-\-tpm2bPrivate\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 The returned private area of the object as a marshalled TPM2B_PRIVATE.
 Optional parameter.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-policy\f=\fIFILENAME\f or \fI\-\f (for
-stdout):
+\fB\-l\fR, \fB\-\-policy\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdout):
 .RS 2
 .PP
 The returned policy associated with the object, encoded in JSON.
@@ -69,29 +68,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_gettpmblobs\ \-\-path=HS/SRK/myRSACrypt\ \-\-tpm2bPublic=tpm2bPublic.file\ \-\-tpm2bPrivate=tpm2bPrivate.file\ \-\-policy=policy.file
-\f
+tss2_gettpmblobs \-\-path=HS/SRK/myRSACrypt \-\-tpm2bPublic=tpm2bPublic.file \-\-tpm2bPrivate=tpm2bPrivate.file \-\-policy=policy.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -101,4 +101,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_import.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_import.1 Changed

@@ -1,40 +1,39 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_import" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_import\f(1) \-
+\fBtss2_import\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_import\f \fIOPTIONS\f
+\fBtss2_import\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_import\f(1) \- This command imports a JSON encoded policy or
-policy template and stores it under the provided path or it imports a
-JSON encoded key under the provided path.
+\fBtss2_import\fR(1) \- This command imports a JSON encoded key,
+policy or policy template and stores it under the provided path.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path of the new object.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-importData\f=\fIFILENAME\f or \fI\-\f
-(for stdin):
+\fB\-i\fR, \fB\-\-importData\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdin):
 .RS 2
 .PP
 The data to be imported.
@@ -44,35 +43,36 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_import\ \-\-path=/policy/duplicate\-policy\ \-\-importData=importData.json
-\f
+tss2_import \-\-path=/policy/duplicate\-policy \-\-importData=importData.json
+\fR
 .fi
 .IP
 .nf
 \fC
-tss2_import\ \-\-path=/ext/key\ \-\-importData=importData.file
-\f
+tss2_import \-\-path=/ext/key \-\-importData=importData.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -82,4 +82,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_list.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_list.1 Changed

@@ -1,38 +1,38 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_list" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_list\f(1) \-
+\fBtss2_list\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_list\f \fIOPTIONS\f
+\fBtss2_list\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_list\f(1) \- This command enumerates all objects in the FAPI
-metadata store in a given a path.
+\fBtss2_list\fR(1) \- This command enumerates all objects in the
+FAPI metadata store in a given a path.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-searchPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-searchPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path identifying the root of the search.
@@ -40,50 +40,51 @@
 If omitted, all entities will be searched.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-pathList\f=\fIFILENAME\f or \fI\-\f
+\fB\-o\fR, \fB\-\-pathList\fR=\fIFILENAME\fR or \fI\-\fR
 (for stdout):
 .RS 2
 .PP
 Returns the colon\-separated list of paths.
 Optional parameter.
-If omitted, results will be printed to \fI\-\f (stdout).
+If omitted, results will be printed to \fI\-\fR (stdout).
 .RE
 .SH COMMON OPTIONS
 .PP
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLES
 .SS List all entities and print results to stdout
 .IP
 .nf
 \fC
 tss2_list
-\f
+\fR
 .fi
 .SS List all entities under the HS path and print results to file
 .IP
 .nf
 \fC
-tss2_list\ \-\-searchPath=HS\ \-\-pathList=output.file
-\f
+tss2_list \-\-searchPath=HS \-\-pathList=output.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -93,4 +94,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_nvextend.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_nvextend.1 Changed

@@ -1,50 +1,49 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_nvextend" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_nvextend\f(1) \-
+\fBtss2_nvextend\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_nvextend\f \fIOPTIONS\f
+\fBtss2_nvextend\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_nvextend\f(1) \- This command performs an extend operation
-on an NV index (i.e.
-an NV index that behaves similar to a PCR).
+\fBtss2_nvextend\fR(1) \- This command performs an extend operation
+on an NV index (i.e.\ an NV index that behaves similar to a PCR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-i\f, \fB\-\-data\f=\fIFILENAME\f or \fI\-\f (for
-stdin):
+\fB\-i\fR, \fB\-\-data\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdin):
 .RS 2
 .PP
 The data to be extended into the NV space.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-nvPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-nvPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the NV space to write.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-logData\f=\fIFILENAME\f or \fI\-\f (for
-stdin):
+\fB\-l\fR, \fB\-\-logData\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdin):
 .RS 2
 .PP
-A JSON representation of data to be written to the PCR\aqs event log.
+A JSON representation of data to be written to the PCR\cqs event log.
 Optional parameter.
 .RE
 .SH COMMON OPTIONS
@@ -52,29 +51,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_nvextend\ \-\-nvPath=/nv/Owner/NvExtend\ \-\-data=data.file\ \-\-logData=logData.file
-\f
+tss2_nvextend \-\-nvPath=/nv/Owner/NvExtend \-\-data=data.file \-\-logData=logData.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -84,4 +84,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_nvincrement.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_nvincrement.1 Changed

@@ -1,32 +1,32 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_nvincrement" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_nvincrement\f(1) \-
+\fBtss2_nvincrement\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_nvincrement\f \fIOPTIONS\f
+\fBtss2_nvincrement\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_nvincrement\f(1) \- This command increments by 1 an NV index
-that is of type counter.
+\fBtss2_nvincrement\fR(1) \- This command increments by 1 an NV
+index that is of type counter.
 .SH OPTIONS
 .PP
 These are the availabe options:
 .IP \bu 2
-\fB\-p\f, \fB\-\-nvPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-nvPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the NV space to increment.
@@ -36,29 +36,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_nvincrement\ \-\-nvPath=/nv/Owner/myNVcounter
-\f
+tss2_nvincrement \-\-nvPath=/nv/Owner/myNVcounter
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -68,4 +69,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_nvread.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_nvread.1 Changed

@@ -1,56 +1,56 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_nvread" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_nvread\f(1) \-
+\fBtss2_nvread\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_nvread\f \fIOPTIONS\f
+\fBtss2_nvread\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_nvread\f(1) \- This command reads the entire data from an NV
-index of the TPM.
+\fBtss2_nvread\fR(1) \- This command reads the entire data from an
+NV index of the TPM.
 .SH OPTIONS
 .PP
 These are the availabe options:
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-data\f=\fIFILENAME\f or \fI\-\f (for
-stdout):
+\fB\-o\fR, \fB\-\-data\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdout):
 .RS 2
 .PP
 Returns the value read from the NV space.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-nvPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-nvPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the NV space to read.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-logData\f=\fIFILENAME\f or \fI\-\f (for
-stdout):
+\fB\-l\fR, \fB\-\-logData\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdout):
 .RS 2
 .PP
-Returns the JSON encoded log, if the NV index is of type "extend" and an
-empty string otherwise.
+Returns the JSON encoded log, if the NV index is of type
+\lqextend\rq and an empty string otherwise.
 Optional parameter.
 .RE
 .SH COMMON OPTIONS
@@ -58,29 +58,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_nvread\ \-\-nvPath=/nv/Owner/myNV\ \-\-data=data.file
-\f
+tss2_nvread \-\-nvPath=/nv/Owner/myNV \-\-data=data.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -90,4 +91,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_nvsetbits.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_nvsetbits.1 Changed

@@ -1,27 +1,27 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_nvsetbits" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_nvsetbits\f(1) \-
+\fBtss2_nvsetbits\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_nvsetbits\f \fIOPTIONS\f
+\fBtss2_nvsetbits\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_nvsetbits\f(1) \- This command sets bits in an NV Index that
-was created as a bit field.
+\fBtss2_nvsetbits\fR(1) \- This command sets bits in an NV Index
+that was created as a bit field.
 Any number of bits from 0 to 64 may be set.
 The contents of bitmap are ORed with the current contents of the NV
 Index.
@@ -29,13 +29,13 @@
 .PP
 These are the availabe options:
 .IP \bu 2
-\fB\-i\f, \fB\-\-bitmap\f=\fIBITS\f:
+\fB\-i\fR, \fB\-\-bitmap\fR=\fIBITS\fR:
 .RS 2
 .PP
 A mask indicating which bits to set in the NV space.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-nvPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-nvPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the NV space to write.
@@ -45,29 +45,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_nvsetbits\ \-\-nvPath=/nv/Owner/NvBitmap\ \-\-bitmap=0x0102030405060608
-\f
+tss2_nvsetbits \-\-nvPath=/nv/Owner/NvBitmap \-\-bitmap=0x0102030405060608
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -77,4 +78,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_nvwrite.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_nvwrite.1 Changed

@@ -1,42 +1,42 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_nvwrite" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_nvwrite\f(1) \-
+\fBtss2_nvwrite\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_nvwrite\f \fIOPTIONS\f
+\fBtss2_nvwrite\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_nvwrite\f(1) \- This command writes data to a "regular" (not
-pin, extend or counter) NV index.
+\fBtss2_nvwrite\fR(1) \- This command writes data to a
+\lqregular\rq (not pin, extend or counter) NV index.
 Only the full index can be written, partial writes are not allowed.
-If the provided data is smaller than the NV index\aqs size, then it is
+If the provided data is smaller than the NV index\cqs size, then it is
 padded up with zero bytes at the end.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-i\f, \fB\-\-data\f=\fIFILENAME\f or \fI\-\f (for
-stdin):
+\fB\-i\fR, \fB\-\-data\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdin):
 .RS 2
 .PP
 The data to write to the NV space.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-nvPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-nvPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the NV space to write to.
@@ -46,29 +46,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_nvwrite\ \-\-nvPath=/nv/Owner/myNV\ \-\-data=data.file
-\f
+tss2_nvwrite \-\-nvPath=/nv/Owner/myNV \-\-data=data.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -78,4 +79,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_pcrextend.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_pcrextend.1 Changed

@@ -1,27 +1,27 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_pcrextend" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_pcrextend\f(1) \-
+\fBtss2_pcrextend\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_pcrextend\f \fIOPTIONS\f
+\fBtss2_pcrextend\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_pcrextend\f(1) \- This command extends the data into the PCR
-listed.
+\fBtss2_pcrextend\fR(1) \- This command extends the data into the
+PCR listed.
 The parameter logData is extended into the PCR log.
 If the logData is NULL, only the PCR extend takes place.
 All PCRs currently active in the TPM are extended.
@@ -29,22 +29,22 @@
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-x\f, \fB\-\-pcr\f=\fIINTEGER\f:
+\fB\-x\fR, \fB\-\-pcr\fR=\fIINTEGER\fR:
 .PP
 The PCR to extend.
 .IP \bu 2
-\fB\-i\f, \fB\-\-data\f=\fIFILENAME\f or \fI\-\f (for
-stdin):
+\fB\-i\fR, \fB\-\-data\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdin):
 .RS 2
 .PP
 The event data to be extended.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-logData\f=\fIFILENAME\f or \fI\-\f (for
-stdin):
+\fB\-l\fR, \fB\-\-logData\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdin):
 .RS 2
 .PP
-Contains a JSON representation of data to be written to the PCR\aqs
+Contains a JSON representation of data to be written to the PCR\cqs
 event log.
 Optional parameter.
 .RE
@@ -53,29 +53,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_pcrextend\ \-\-pcr=16\ \-\-data=data.file\ \-\-logData=logData.file
-\f
+tss2_pcrextend \-\-pcr=16 \-\-data=data.file \-\-logData=logData.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -85,4 +86,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_pcrread.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_pcrread.1 Changed

@@ -1,34 +1,34 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_pcrread" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_pcrread\f(1) \-
+\fBtss2_pcrread\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_pcrread\f \fIOPTIONS\f
+\fBtss2_pcrread\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_pcrread\f(1) \- This command provides a PCRs value and
+\fBtss2_pcrread\fR(1) \- This command provides a PCRs value and
 corresponding event log.
 The PCR bank to be used per PCR is defined in the cryptographic profile
-(cf., \fBfapi\-profile(5)\f).
+(cf., \fBfapi\-profile(5)\fR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-o\f, \fB\-\-pcrValue\f=\fIFILENAME\f or \fI\-\f
+\fB\-o\fR, \fB\-\-pcrValue\fR=\fIFILENAME\fR or \fI\-\fR
 (for stdout):
 .RS 2
 .PP
@@ -36,20 +36,20 @@
 Optional parameter.
 .RE
 .IP \bu 2
-\fB\-x\f, \fB\-\-pcrIndex\f=\fIINTEGER\f:
+\fB\-x\fR, \fB\-\-pcrIndex\fR=\fIINTEGER\fR:
 .RS 2
 .PP
 Identifies the PCR to read.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output files.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-pcrLog\f=\fIFILENAME\f or \fI\-\f (for
-stdout):
+\fB\-l\fR, \fB\-\-pcrLog\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdout):
 .RS 2
 .PP
 Returns the PCR log for that PCR.
@@ -60,13 +60,13 @@
 .IP
 .nf
 \fC
-\-\ recnum:\ Unique\ record\ number
-\-\ pcr:\ PCR\ index
-\-\ digest:\ The\ digests
-\-\ type:\ The\ type\ of\ event.\ At\ the\ moment\ the\ only\ possible\ value\ is:\ "LINUX_IMA"\ (legacy\ IMA)
-\-\ eventDigest:\ Digest\ of\ the\ event;\ e.g.\ the\ digest\ of\ the\ measured\ file
-\-\ eventName:\ Name\ of\ the\ event;\ e.g.\ the\ name\ of\ the\ measured\ file.
-\f
+\- recnum: Unique record number
+\- pcr: PCR index
+\- digest: The digests
+\- type: The type of event. At the moment the only possible value is: \dqLINUX_IMA\dq (legacy IMA)
+\- eventDigest: Digest of the event; e.g. the digest of the measured file
+\- eventName: Name of the event; e.g. the name of the measured file.
+\fR
 .fi
 .RE
 .SH COMMON OPTIONS
@@ -74,29 +74,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_pcrread\ \-\-pcrIndex=16\ \-\-pcrValue=pcrValue.file\ \-\-pcrLog=pcrLog.file
-\f
+tss2_pcrread \-\-pcrIndex=16 \-\-pcrValue=pcrValue.file \-\-pcrLog=pcrLog.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -106,4 +107,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_provision.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_provision.1 Changed

@@ -1,43 +1,43 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_provision" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_provision\f(1) \-
+\fBtss2_provision\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_provision\f \fIOPTIONS\f
+\fBtss2_provision\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_provision\f(1) \- This command provisions a FAPI instance
+\fBtss2_provision\fR(1) \- This command provisions a FAPI instance
 and its associated TPM.
 The steps taken are:
 .IP \bu 2
 Retrieve the EK template, nonce and certificate, verify that they match
-the TPM\aqs EK and store them in the key store.
+the TPM\cqs EK and store them in the key store.
 .IP \bu 2
 Set the authValues and policies for the Owner (Storage Hierarchy), the
 Privacy Administrator (Endorsement Hierarchy) and the lockout authority.
 .IP \bu 2
-Scan the TPM\aqs nv indices and create entries in the FAPI metadata
+Scan the TPM\cqs nv indices and create entries in the FAPI metadata
 store.
 This operation MAY use a heuristic to guess the originating programs for
 nv indices found and name the entries accordingly.
 .IP \bu 2
 Create the SRK (storage primary key) inside the TPM and make it
 persistent if required by the cryptographic profile (cf.,
-\fBfapi\-profile(5)\f) and store its metadata in the system\-wide
+\fBfapi\-profile(5)\fR) and store its metadata in the system\-wide
 FAPI metadata store.
 Note that the SRK will not have an authorization value associated.
 .PP
@@ -47,22 +47,21 @@
 .PP
 The paths of the different metadata storages for keys and nv indices are
 configured in the FAPI configuration file (cf.,
-\fBfapi\-config(5)\f).
+\fBfapi\-config(5)\fR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-E\f, \fB\-\-authValueEh\f=\fISTRING\f: The
-authorization value for the privacy admin, i.e.
-the endorsement hierarchy.
+\fB\-E\fR, \fB\-\-authValueEh\fR=\fISTRING\fR: The
+authorization value for the privacy admin, i.e.\ the endorsement
+hierarchy.
 Optional parameter.
 .IP \bu 2
-\fB\-S\f, \fB\-\-authValueSh\f=\fISTRING\f: The
-authorization value for the owner, i.e.
-the storage hierarchy.
+\fB\-S\fR, \fB\-\-authValueSh\fR=\fISTRING\fR: The
+authorization value for the owner, i.e.\ the storage hierarchy.
 Optional parameter.
 .IP \bu 2
-\fB\-L\f, \fB\-\-authValueLockout\f=\fISTRING\f: The
+\fB\-L\fR, \fB\-\-authValueLockout\fR=\fISTRING\fR: The
 authorization value for the lockout authorization.
 Optional parameter.
 .SH COMMON OPTIONS
@@ -70,29 +69,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
 tss2_provision
-\f
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -102,4 +102,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_quote.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_quote.1 Changed

@@ -1,49 +1,49 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_quote" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_quote\f(1) \-
+\fBtss2_quote\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_quote\f \fIOPTIONS\f
+\fBtss2_quote\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_quote\f(1) \- This command performs an attestation using the
-TPM.
+\fBtss2_quote\fR(1) \- This command performs an attestation using
+the TPM.
 The PCR bank for each provided PCR index and signing scheme are set in
-the cryptographic profile (cf., \fBfapi\-profile(5)\f).
+the cryptographic profile (cf., \fBfapi\-profile(5)\fR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-x\f, \fB\-\-pcrList\f=\fISTRING\f:
+\fB\-x\fR, \fB\-\-pcrList\fR=\fISTRING\fR:
 .RS 2
 .PP
 An array holding the PCR indices to quote against.
 .RE
 .IP \bu 2
-\fB\-Q\f, \fB\-\-qualifyingData\f=\fIFILENAME\f or
-\fI\-\f (for stdin):
+\fB\-Q\fR, \fB\-\-qualifyingData\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdin):
 .RS 2
 .PP
 A nonce provided by the caller to ensure freshness of the signature.
 Optional parameter.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-pcrLog\f=\fIFILENAME\f or \fI\-\f (for
-stdout):
+\fB\-l\fR, \fB\-\-pcrLog\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdout):
 .RS 2
 .PP
 Returns the PCR log for the chosen PCR.
@@ -54,30 +54,30 @@
 .IP
 .nf
 \fC
-\-\ recnum:\ Unique\ record\ number
-\-\ pcr:\ PCR\ index
-\-\ digest:\ The\ digests
-\-\ type:\ The\ type\ of\ event.\ At\ the\ moment\ the\ only\ possible\ value\ is:\ "LINUX_IMA"\ (legacy\ IMA)
-\-\ eventDigest:\ Digest\ of\ the\ event;\ e.g.\ the\ digest\ of\ the\ measured\ file
-\-\ eventName:\ Name\ of\ the\ event;\ e.g.\ the\ name\ of\ the\ measured\ file.
-\f
+\- recnum: Unique record number
+\- pcr: PCR index
+\- digest: The digests
+\- type: The type of event. At the moment the only possible value is: \dqLINUX_IMA\dq (legacy IMA)
+\- eventDigest: Digest of the event; e.g. the digest of the measured file
+\- eventName: Name of the event; e.g. the name of the measured file.
+\fR
 .fi
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-keyPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-keyPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the signing key.
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-quoteInfo\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-q\fR, \fB\-\-quoteInfo\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 Returns a JSON\-encoded structure holding the inputs to the quote
@@ -85,15 +85,15 @@
 This includes the digest value and PCR values.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-signature\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-o\fR, \fB\-\-signature\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 Returns the signature over the quoted material.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-certificate\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-c\fR, \fB\-\-certificate\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 The certificate associated with keyPath in PEM format.
@@ -104,29 +104,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_quote\ \-\-keyPath=HS/SRK/quotekey\ \-\-pcrList="10,16"\ \-\-qualifyingData=qualifyingData.file\ \-\-signature=signature.file\ \-\-pcrLog=pcrLog.file\ \-\-certificate=certificate.file\ \-\-quoteInfo=quoteInfo.info
-\f
+tss2_quote \-\-keyPath=HS/SRK/quotekey \-\-pcrList=\dq10,16\dq \-\-qualifyingData=qualifyingData.file \-\-signature=signature.file \-\-pcrLog=pcrLog.file \-\-certificate=certificate.file \-\-quoteInfo=quoteInfo.info
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -136,4 +137,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_setappdata.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_setappdata.1 Changed

@@ -1,26 +1,26 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_setappdata" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_setappdata\f(1)
+\fBtss2_setappdata\fR(1)
 .SH SYNOPSIS
 .PP
-\fBtss2_setappdata\f \fIOPTIONS\f
+\fBtss2_setappdata\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_setappdata\f(1) \- This command allows an application to
+\fBtss2_setappdata\fR(1) \- This command allows an application to
 associate an arbitrary data blob with a given object.
 The data is stored and can be returned with tss2_getappdata.
 Previously stored data is overwritten by this function.
@@ -29,14 +29,14 @@
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 Path of the object for which the appData will be stored.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-appData\f=\fIFILENAME\f or \fI\-\f (for
-stdin):
+\fB\-i\fR, \fB\-\-appData\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdin):
 .RS 2
 .PP
 The data to be stored.
@@ -48,29 +48,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_setappdata\ \-\-path=HS/SRK/myRSACrypt\ \-\-appData=appData.file
-\f
+tss2_setappdata \-\-path=HS/SRK/myRSACrypt \-\-appData=appData.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -80,4 +81,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_setcertificate.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_setcertificate.1 Changed

@@ -1,39 +1,39 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_setcertificate" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_setcertificate\f(1) \-
+\fBtss2_setcertificate\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_setcertificate\f \fIOPTIONS\f
+\fBtss2_setcertificate\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_setcertificate\f(1) \- This command associates an x509
+\fBtss2_setcertificate\fR(1) \- This command associates an x509
 certificate in PEM encoding into the path of a key.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the entity to be associated with the certificate.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-x509certData\f=\fIFILENAME\f or \fI\-\f
-(for stdin):
+\fB\-i\fR, \fB\-\-x509certData\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdin):
 .RS 2
 .PP
 The PEM encoded certificate.
@@ -45,29 +45,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_setcertificate\ \-\-path=HS/SRK/myRSACrypt\ \-\-x509certData=x509certData.file
-\f
+tss2_setcertificate \-\-path=HS/SRK/myRSACrypt \-\-x509certData=x509certData.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -77,4 +78,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_setdescription.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_setdescription.1 Changed

@@ -1,27 +1,27 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_setdescription" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_setdescription\f(1)
+\fBtss2_setdescription\fR(1)
 .SH SYNOPSIS
 .PP
-\fBtss2_setdescription\f \fIOPTIONS\f
+\fBtss2_setdescription\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_setdescription\f(1) \- This command allows an application to
-assign a human readable description to an object in the FAPI metadata
+\fBtss2_setdescription\fR(1) \- This command allows an application
+to assign a human readable description to an object in the FAPI metadata
 store.
 The stored data can be returned with tss2_getdescription.
 Previously stored data is overwritten by this function.
@@ -30,7 +30,7 @@
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-i\f, \fB\-\-description\f=\fISTRING\f:
+\fB\-i\fR, \fB\-\-description\fR=\fISTRING\fR:
 .RS 2
 .PP
 The data to be stored as description for the object.
@@ -39,7 +39,7 @@
 If omitted any stored description is deleted.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path of the object for which the description will be stored.
@@ -49,29 +49,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_setdescription\ \-\-path=HS/SRK\ \-\-description=description
-\f
+tss2_setdescription \-\-path=HS/SRK \-\-description=description
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -81,4 +82,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_sign.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_sign.1 Changed

@@ -1,79 +1,80 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_sign" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_sign\f(1) \-
+\fBtss2_sign\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_sign\f \fIOPTIONS\f
+\fBtss2_sign\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_sign\f(1) \- This command uses a key inside the TPM to sign
+\fBtss2_sign\fR(1) \- This command uses a key inside the TPM to sign
 a digest value using the TPM signing schemes as specified in the
-cryptographic profile (cf., \fBfapi\-profile(5)\f).
+cryptographic profile (cf., \fBfapi\-profile(5)\fR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-p\f, \fB\-\-keyPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-keyPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path to the signing key.
 .RE
 .IP \bu 2
-\fB\-s\f, \fB\-\-padding\f=\fISTRING\f:
+\fB\-s\fR, \fB\-\-padding\fR=\fISTRING\fR:
 .RS 2
 .PP
 The padding scheme used.
-Possible values are "RSA_SSA", "RSA_PSS" (case insensitive).
+Possible values are \lqRSA_SSA\rq, \lqRSA_PSS\rq (case
+insensitive).
 Optional parameter.
 If omitted, the default padding specified in the cryptographic profile
-(cf., \fBfapi\-profile(5)\f) is used.
+(cf., \fBfapi\-profile(5)\fR) is used.
 .RE
 .IP \bu 2
-\fB\-c\f, \fB\-\-certificate\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-c\fR, \fB\-\-certificate\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 The certificate associated with keyPath in PEM format.
 Optional parameter.
 .RE
 .IP \bu 2
-\fB\-d\f, \fB\-\-digest\f=\fIFILENAME\f or \fI\-\f (for
-stdin):
+\fB\-d\fR, \fB\-\-digest\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdin):
 .RS 2
 .PP
 The data to be signed, already hashed.
 .RE
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-k\f, \fB\-\-publicKey\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-k\fR, \fB\-\-publicKey\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 The public key associated with keyPath in PEM format.
 Optional parameter.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-signature\f=\fIFILENAME\f or \fI\-\f
-(for stdout):
+\fB\-o\fR, \fB\-\-signature\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdout):
 .RS 2
 .PP
 Returns the signature in binary form.
@@ -83,29 +84,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_sign\ \-\-keyPath=HS/SRK/myRSASign\ \-\-padding="RSA_PSS"\ \-\-digest=digest.file\ \-\-signature=signature.file\ \-\-publicKey=publicKey.file
-\f
+tss2_sign \-\-keyPath=HS/SRK/myRSASign \-\-padding=\dqRSA_PSS\dq \-\-digest=digest.file \-\-signature=signature.file \-\-publicKey=publicKey.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -115,4 +117,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_unseal.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_unseal.1 Changed

@@ -1,47 +1,47 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_unseal" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_unseal\f(1) \-
+\fBtss2_unseal\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_unseal\f \fIOPTIONS\f
+\fBtss2_unseal\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_unseal\f(1) \- This command unseals data from a seal in the
+\fBtss2_unseal\fR(1) \- This command unseals data from a seal in the
 FAPI metadata store.
 The used decryption scheme is specified in the cryptographic profile
-(cf., \fBfapi\-profile(5)\f).
+(cf., \fBfapi\-profile(5)\fR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-f\f, \fB\-\-force\f:
+\fB\-f\fR, \fB\-\-force\fR:
 .RS 2
 .PP
 Force overwriting the output file.
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-path\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-path\fR=\fISTRING\fR:
 .RS 2
 .PP
 Path of the object for which the blobs will be returned.
 .RE
 .IP \bu 2
-\fB\-o\f, \fB\-\-data\f=\fIFILENAME\f or \fI\-\f (for
-stdout):
+\fB\-o\fR, \fB\-\-data\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdout):
 .RS 2
 .PP
 The decrypted data after unsealing.
@@ -52,29 +52,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_unseal\ \-\-path=HS/SRK/myRSACrypt\ \-\-data=data.file
-\f
+tss2_unseal \-\-path=HS/SRK/myRSACrypt \-\-data=data.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -84,4 +85,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_verifyquote.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_verifyquote.1 Changed

@@ -1,56 +1,56 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_verifyquote" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_verifyquote\f(1) \-
+\fBtss2_verifyquote\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_verifyquote\f \fIOPTIONS\f
+\fBtss2_verifyquote\fR \fIOPTIONS\fR
 .SH SEE ALSO
 .PP
-\fBfapi\-config(5)\f to adjust Fapi parameters like the used
+\fBfapi\-config(5)\fR to adjust Fapi parameters like the used
 cryptographic profile and TCTI or directories for the Fapi metadata
 storages.
 .PP
-\fBfapi\-profile(5)\f to determine the cryptographic algorithms and
+\fBfapi\-profile(5)\fR to determine the cryptographic algorithms and
 parameters for all keys and operations of a specific TPM interaction
 like the name hash algorithm, the asymmetric signature algorithm, scheme
 and parameters and PCR bank selection.
 .SH DESCRIPTION
 .PP
-\fBtss2_verifyquote\f(1) \- This command verifies that the data
+\fBtss2_verifyquote\fR(1) \- This command verifies that the data
 returned by a quote is valid.
 This includes
 .IP \bu 2
-Reconstructing the quoteInfo\aqs PCR values from the eventLog (if an
+Reconstructing the quoteInfo\cqs PCR values from the eventLog (if an
 eventLog was provided)
 .IP \bu 2
 Verifying the quoteInfo using the signature and the publicKeyPath
 .PP
 The used signature verification scheme is specified in the cryptographic
-profile (cf., \fBfapi\-profile(5)\f).
+profile (cf., \fBfapi\-profile(5)\fR).
 .PP
 An application using tss2_verifyquote() will further have to
 .IP \bu 2
-Assess the publicKey\aqs trustworthiness
+Assess the publicKey\cqs trustworthiness
 .IP \bu 2
-Assess the eventLog entries\aq trustworthiness
+Assess the eventLog entries\cq trustworthiness
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-Q\f, \fB\-\-qualifyingData\f=\fIFILENAME\f or
-\fI\-\f (for stdin):
+\fB\-Q\fR, \fB\-\-qualifyingData\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdin):
 .RS 2
 .PP
 A nonce provided by the caller to ensure freshness of the signature.
 Optional parameter.
 .RE
 .IP \bu 2
-\fB\-l\f, \fB\-\-pcrLog\f=\fIFILENAME\f or \fI\-\f (for
-stdin):
+\fB\-l\fR, \fB\-\-pcrLog\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdin):
 .RS 2
 .PP
 Returns the PCR event log for the chosen PCR.
@@ -61,33 +61,33 @@
 .IP
 .nf
 \fC
-\-\ recnum:\ Unique\ record\ number
-\-\ pcr:\ PCR\ index
-\-\ digest:\ The\ digests
-\-\ type:\ The\ type\ of\ event.\ At\ the\ moment\ the\ only\ possible\ value\ is:\ "LINUX_IMA"\ (legacy\ IMA)
-\-\ eventDigest:\ Digest\ of\ the\ event;\ e.g.\ the\ digest\ of\ the\ measured\ file
-\-\ eventName:\ Name\ of\ the\ event;\ e.g.\ the\ name\ of\ the\ measured\ file.
-\f
+\- recnum: Unique record number
+\- pcr: PCR index
+\- digest: The digests
+\- type: The type of event. At the moment the only possible value is: \dqLINUX_IMA\dq (legacy IMA)
+\- eventDigest: Digest of the event; e.g. the digest of the measured file
+\- eventName: Name of the event; e.g. the name of the measured file.
+\fR
 .fi
 .RE
 .IP \bu 2
-\fB\-q\f, \fB\-\-quoteInfo\f=\fIFILENAME\f or \fI\-\f
-(for stdin):
+\fB\-q\fR, \fB\-\-quoteInfo\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdin):
 .RS 2
 .PP
 The JSON\-encoded structure holding the inputs to the quote operation.
 This includes the digest value and PCR values.
 .RE
 .IP \bu 2
-\fB\-k\f, \fB\-\-publicKeyPath\f=\fISTRING\f:
+\fB\-k\fR, \fB\-\-publicKeyPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 Identifies the signing key.
 MAY be a path to the public key hierarchy /ext.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-signature\f=\fIFILENAME\f or \fI\-\f
-(for stdin):
+\fB\-i\fR, \fB\-\-signature\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdin):
 .RS 2
 .PP
 The signature over the quoted material.
@@ -97,29 +97,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-\ \ \ \ tss2_verifyquote\ \-\-publicKeyPath="ext/myNewParent"\ \-\-qualifyingData=qualifyingData.file\ \-\-quoteInfo=quoteInfo.file\ \-\-signature=signature.file\ \-\-pcrLog=pcrLog.file
-\f
+    tss2_verifyquote \-\-publicKeyPath=\dqext/myNewParent\dq \-\-qualifyingData=qualifyingData.file \-\-quoteInfo=quoteInfo.file \-\-signature=signature.file \-\-pcrLog=pcrLog.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -129,4 +130,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_verifysignature.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_verifysignature.1 Changed

@@ -1,39 +1,39 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_verifysignature" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_verifysignature\f(1) \-
+\fBtss2_verifysignature\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_verifysignature\f \fIOPTIONS\f
+\fBtss2_verifysignature\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtss2_verifysignature\f(1) \- This command verifies a signature
+\fBtss2_verifysignature\fR(1) \- This command verifies a signature
 using a public key found in the passed key path.
 The used signature verification scheme is specified in the cryptographic
-profile (cf., \fBfapi\-profile(5)\f).
+profile (cf., \fBfapi\-profile(5)\fR).
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-d\f, \fB\-\-digest\f=\fIFILENAME\f or \fI\-\f (for
-stdin):
+\fB\-d\fR, \fB\-\-digest\fR=\fIFILENAME\fR or \fI\-\fR
+(for stdin):
 .RS 2
 .PP
 The data that was signed, already hashed according to the cryptographic
-profile (cf., \fBfapi\-profile(5)\f).
+profile (cf., \fBfapi\-profile(5)\fR).
 .RE
 .IP \bu 2
-\fB\-p\f, \fB\-\-keyPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-keyPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 Path to the verification public key.
 .RE
 .IP \bu 2
-\fB\-i\f, \fB\-\-signature\f=\fIFILENAME\f or \fI\-\f
-(for stdin):
+\fB\-i\fR, \fB\-\-signature\fR=\fIFILENAME\fR or
+\fI\-\fR (for stdin):
 .RS 2
 .PP
 The signature to be verified.
@@ -43,29 +43,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_verifysignature\ \-\-keyPath=ext/myRSASign\ \-\-digest=digest.file\ \-\-signature=signature.file
-\f
+tss2_verifysignature \-\-keyPath=ext/myRSASign \-\-digest=digest.file \-\-signature=signature.file
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -75,4 +76,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/man1/tss2_writeauthorizenv.1 -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/man1/tss2_writeauthorizenv.1 Changed

@@ -1,29 +1,29 @@
-.\" Automatically generated by Pandoc 1.19.2.4
+.\" Automatically generated by Pandoc 2.5
 .\"
 .TH "tss2_writeauthorizenv" "1" "APRIL 2019" "tpm2\-tools" "General Commands Manual"
 .hy
 .SH NAME
 .PP
-\fBtss2_writeauthorizenv\f(1) \-
+\fBtss2_writeauthorizenv\fR(1) \-
 .SH SYNOPSIS
 .PP
-\fBtss2_writeauthorizenv\f \fIOPTIONS\f
+\fBtss2_writeauthorizenv\fR \fIOPTIONS\fR
 .SH DESCRIPTION
 .PP
-\fBtss2_writeauthorizenv\f(1) \- This command writes the digest
+\fBtss2_writeauthorizenv\fR(1) \- This command writes the digest
 value of a policy to an NV index such that this policy can be used in
 other policies containing a corresponding PolicyAuthorizeNv element.
 .SH OPTIONS
 .PP
 These are the available options:
 .IP \bu 2
-\fB\-p\f, \fB\-\-nvPath\f=\fISTRING\f:
+\fB\-p\fR, \fB\-\-nvPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path of the NV index.
 .RE
 .IP \bu 2
-\fB\-P\f, \fB\-\-policyPath\f=\fISTRING\f:
+\fB\-P\fR, \fB\-\-policyPath\fR=\fISTRING\fR:
 .RS 2
 .PP
 The path of the new policy.
@@ -33,29 +33,30 @@
 This collection of options are common to all tss2 programs and provide
 information that many users may expect.
 .IP \bu 2
-\fB\-h\f, \fB\-\-help man|no\-man\f: Display the tools
+\fB\-h\fR, \fB\-\-help man|no\-man\fR: Display the tools
 manpage.
 By default, it attempts to invoke the manpager for the tool, however, on
 failure will output a short tool summary.
-This is the same behavior if the "man" option argument is specified,
-however if explicit "man" is requested, the tool will provide errors
-from man on stderr.
-If the "no\-man" option if specified, or the manpager fails, the short
-options will be output to stdout.
+This is the same behavior if the \lqman\rq option argument is
+specified, however if explicit \lqman\rq is requested, the tool will
+provide errors from man on stderr.
+If the \lqno\-man\rq option if specified, or the manpager fails, the
+short options will be output to stdout.
 .RS 2
 .PP
 To successfully use the manpages feature requires the manpages to be
-installed or on \fIMANPATH\f, See \fBman\f(1) for more details.
+installed or on \fIMANPATH\fR, See \fBman\fR(1) for more
+details.
 .RE
 .IP \bu 2
-\fB\-v\f, \fB\-\-version\f: Display version information for this
-tool, supported tctis and exit.
+\fB\-v\fR, \fB\-\-version\fR: Display version information for
+this tool, supported tctis and exit.
 .SH EXAMPLE
 .IP
 .nf
 \fC
-tss2_writeauthorizenv\ \-\-nvPath=/nv/Owner/myNV\ \-\-policyPath=/policy/pcr\-policy
-\f
+tss2_writeauthorizenv \-\-nvPath=/nv/Owner/myNV \-\-policyPath=/policy/pcr\-policy
+\fR
 .fi
 .SH RETURNS
 .PP
@@ -65,4 +66,5 @@
 Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
 .SH HELP
 .PP
-See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
+See the Mailing
+List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_activatecredential.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_activatecredential.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_certify.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_certify.1.md Changed

@@ -31,7 +31,7 @@
 
     The key used to sign the attestation structure.
 
-  * **-p**, **\--certifiedkey-auth**=_AUTH_:
+  * **-P**, **\--certifiedkey-auth**=_AUTH_:
 
     The authorization value provided for the object specified with -c.
 
@@ -39,7 +39,18 @@
 
     The hash algorithm to use in signature generation.
 
-  * **-P**, **\--signingkey-auth**=_AUTH_:
+  * **\--scheme**=_ALGORITHM_:
+
+    The signing scheme used to sign the message. Optional.
+    Signing schemes should follow the "formatting standards", see section
+     "Algorithm Specifiers".
+    Also, see section "Supported Signing Schemes" for a list of supported
+     signature schemes.
+    If specified, the signature scheme must match the key type.
+    If left unspecified, a default signature scheme for the key type will
+     be used.
+
+  * **-p**, **\--signingkey-auth**=_AUTH_:
 
     The authorization value for the signing key specified with -C.
 
@@ -59,7 +70,19 @@
 
     File path to record the hash of the command parameters. This is commonly
     termed as cpHash. NOTE: When this option is selected, The tool will not
-    actually execute the command, it simply returns a cpHash.
+    actually execute the command, it simply returns a cpHash, unless rphash is
+    also required.
+
+  * **\--rphash**=_FILE_
+
+    File path to record the hash of the response parameters. This is commonly
+    termed as rpHash.
+
+  * **-S**, **\--session**=_FILE_:
+
+    The session created using **tpm2_startauthsession**. This can be used to
+    specify an auxiliary session for auditing and or encryption/decryption of
+    the parameters.
 
 ## References

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_certifycreation.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_certifycreation.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_changeauth.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_changeauth.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_changeeps.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_changeeps.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_changepps.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_changepps.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_commit.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_commit.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_create.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_create.1.md Changed

@@ -58,8 +58,8 @@
     When **-L** is specified for adding policy based authorization information
     AND no string password is specified, the  attribute `TPMA_OBJECT_USERWITHAUTH`
     is cleared unless an explicit choice is made by setting of the attribute
-    with **-a** option. This prevents creation of objects with inadvertant auth
-    model where in user intended to enforce a policy but inadvertantly created
+    with **-a** option. This prevents creation of objects with inadvertent auth
+    model where in user intended to enforce a policy but inadvertently created
     an object with empty auth which can be used instead of policy authorization.
 
   * **-i**, **\--sealing-input**=_FILE_ or _STDIN_:
@@ -68,9 +68,9 @@
     When sealing data only the _TPM\_ALG\_KEYEDHASH_ algorithm with a NULL
     scheme is allowed. Thus, **-G** cannot be specified.
 
-  * **-L**, **\--policy**=_FILE_:
+  * **-L**, **\--policy**=_FILE_ or _HEX\_STRING_:
 
-    The input policy file, optional.
+    The input policy file or a hex string, optional.
 
   * **-u**, **\--public**=_FILE_:
 
@@ -125,6 +125,25 @@
     termed as cpHash. NOTE: When this option is selected, The tool will not
     actually execute the command, it simply returns a cpHash.
 
+* **\--rphash**=_FILE_
+
+     File path to record the hash of the response parameters. This is commonly
+     termed as rpHash.
+
+  * **-S**, **\--session**=_FILE_:
+
+    The session created using **tpm2_startauthsession**. Multiple of these can
+    be specified. For example, you can have one session for auditing and another
+    for encryption/decryption of the parameters.
+
+pubkey options(common/pubkey.md)
+
+    Public key format.
+
+  * **-o**, **\--output**=_FILE_:
+
+    The output file path, recording the public portion of the object.
+
 ## References
 
 context object format(common/ctxobj.md) details the methods for specifying
@@ -177,14 +196,29 @@
 ## Create an EC Key Object and Load it to the TPM
 
 Normally, when creating an object, only the public and private portions of the
-object are returned and the caller needs to use tpm2_load(1) to load those
+object are returned and the caller needs to use tpm2\_load(1) to load those
 public and private portions to the TPM before being able to use the object.
-However, this can be accomplished within this command as well.
+However, this can be accomplished within this command as well, when supported
+by the TPM. You can verify your TPM supports this feature by checking
+that tpm2\_getcap(1) commands returns TPM2\_CC\_CreateLoaded in the command set.
+If your TPM does not support TPM2\_CC\_CreateLoaded an unsuported command code
+error will be returned. If it's not supported one must use tpm2\_load(1). See
+that manpage for details on its usage.
 
 ```bash
 tpm2_create -C primary.ctx -G ecc -u obj.pub -r obj.priv -c ecc.ctx
 ```
 
+## Create an Object and get the public key as a PEM file
+
+This will create an object using all the default values but also output the
+public key as a PEM file compatible with tools like OpenSSL and whatever supports
+PEM files.
+
+```bash
+tpm2_create -C primary.ctx -u obj.pub -r obj.priv -f pem -o obj.pem
+```
+
 returns(common/returns.md)
 
 footer(common/footer.md)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_createak.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_createak.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_createek.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_createek.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_createprimary.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_createprimary.1.md Changed

@@ -52,9 +52,9 @@
 
     The file path to save the object context of the generated primary object.
 
-  * **-L**, **\--policy**=_FILE_:
+  * **-L**, **\--policy**=_FILE_ or _HEX\_STRING_:
 
-    An optional file input that contains the policy digest for policy based
+    An optional file input or hex string that contains the policy digest for policy based
     authorization of the object.
 
   * **-a**, **\--attributes**=_ATTRIBUTES_:
@@ -122,6 +122,15 @@
     termed as cpHash. NOTE: When this option is selected, The tool will not
     actually execute the command, it simply returns a cpHash.
 
+pubkey options(common/pubkey.md)
+
+    Public key format.
+
+  * **-o**, **\--output**=_FILE_:
+
+    The output file path, recording the public portion of the object.
+
+
 ## References
 
 context object format(common/ctxobj.md) details the methods for specifying
@@ -160,6 +169,9 @@
 tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c prim.ctx \
 -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|\
 noda' -u unique.dat
+
+## Create a primary object and output the public key in pem format
+tpm2_createprimary -c primary.ctx --format=pem --output=public.pem
 ```
 
 returns(common/returns.md)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_duplicate.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_duplicate.1.md Changed

@@ -41,11 +41,26 @@
 
     The parent key object.
 
+  * **-U**, **\--parent-public**=_FILE_:
+
+    Specifies the file path to the public key of the parent object on the
+    destination TPM.  This should be a `TPM2B_PUBLIC` formatted file.
+
+  * **-k**, **\--private-key**=_FILE_:
+
+    Specifies the file path to the external private key be encrypted for
+    the remote TPM.  This should be a PEM format private key.
+
   * **-r**, **\--private**=_FILE_:
 
     Specifies the file path to save the private portion of the duplicated object.
     protection details(common/protection-details.md)
 
+  * **-u**, **\--public**=_FILE_:
+
+    Specifies the file path to save the public portion of the duplicated object,
+    if an external key is being duplicated.
+
   * **-s**, **\--encrypted-seed**=_FILE_:
 
     The file to save the encrypted seed of the duplicated object.
@@ -54,6 +69,10 @@
 
     The authorization value for the key, optional.
 
+  * **-L**, **\--policy**=_FILE_:
+
+    The input policy file, optional.
+
   * **-c**, **\--key-context**=_OBJECT_:
 
     The object to be duplicated.
@@ -83,18 +102,18 @@
 
 # EXAMPLES
 
-To duplicate a key, one needs the key to duplicate, created with a policy that \
-allows duplication and a new parent:
+#### Example-1: Duplicate a key created with a policy that allows for duplication:
+
 ```bash
 tpm2_startauthsession -S session.dat
 tpm2_policycommandcode -S session.dat -L policy.dat TPM2_CC_Duplicate
 tpm2_flushcontext session.dat
 
 tpm2_createprimary -C o -g sha256 -G rsa -c primary.ctxt
-tpm2_create -C primary.ctxt -g sha256 -G rsa -r key.prv -u key.pub \
--L policy.dat -a "sensitivedataorigin"
+tpm2_create -C primary.ctxt -g sha256 -G rsa -r key.prv -u key.pub  -c key.ctxt \
+-L policy.dat -a "sensitivedataorigin|userwithauth|decrypt|sign"
 
-tpm2_loadexternal -C o -u new_parent.pub -c new_parent.ctxt
+tpm2_createprimary -C o -g sha256 -G ecc -c new_parent.ctxt
 
 tpm2_startauthsession \--policy-session -S session.dat
 tpm2_policycommandcode -S session.dat -L policy.dat TPM2_CC_Duplicate
@@ -103,10 +122,9 @@
 tpm2_flushcontext session.dat
 ```
 
-As an end-to-end example, the following will transfer an RSA key generated on 
-`TPM-A` to `TPM-B`
+#### Example-2: As an end-to-end example, the following will transfer an RSA key generated on `TPM-A` to `TPM-B`
 
-## On TPM-B
+##### On TPM-B
 
 Create a parent object that will be used to wrap/transfer the key.
 ```
@@ -119,7 +137,7 @@
 
 Copy `new_parent.pub` to `TPM-A`.
 
-## On TPM-A
+##### On TPM-A
 
 Create root object and auth policy allows duplication only
 
@@ -145,7 +163,7 @@
 tpm2_load -C primary.ctx -r key.prv -u key.pub -c key.ctx
 
 tpm2_readpublic -c key.ctx -o dup.pub
-````
+```
 
 Test sign and encryption locally (so we can compare later that the same key 
 was transferred).
@@ -189,7 +207,7 @@
 * dup.seed
 * (optionally data.encrypted just to test decryption)
 
-## On TPM-B
+##### On TPM-B
 
 Start an auth,policy session
 ```
@@ -249,6 +267,38 @@
 meet me at..
 ```
 
+#### Example-3: Exporting an OpenSSL RSA key for a remote TPM
+
+To securely send an OpenSSL generated RSA key to a remote TPM such that
+only that remote TPM will be able to load it, and without exposing the
+private key to the host operating system on the remote machine:
+
+* On the destination TPM-B, create a primary context and read its public key,
+then send `primary.pub` to the source machine:
+
+```bash
+tpm2_createprimary -c primary.ctx
+tpm2_readpublic -c primary.ctx -o primary.pub
+```
+
+* On the source machine create the RSA private key and wrap it for the destination
+TPM's public key.  Similar to `tpm2_makecredential`, this step should not require
+a TPM.
+
+```bash
+openssl genrsa -out rsa.pem
+tpm2_duplicate -U primary.pub -G rsa -k rsa.pem -u rsa.pub -r rsa.dpriv -s rsa.seed
+```
+
+* Send the `rsa.pub`, `rsa.dpriv` and `rsa.seed` to the destination TPM-B
+and import the files, which will decrypt them using the `primary.ctx` to
+produce `rsa.priv`, which can then be loaded and used as a TPM key:
+
+```bash
+tpm2_import -C primary.ctx -G rsa -i rsa.dpriv -s rsa.seed -u rsa.pub -r rsa.priv
+tpm2_load -C primary.ctx -c rsa.ctx -u rsa.pub -r rsa.priv
+```
+
 
 returns(common/returns.md)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_ecdhkeygen.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_ecdhkeygen.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_ecdhzgen.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_ecdhzgen.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_ecephemeral.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_ecephemeral.1.md Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_encodeobject.1.md Added

@@ -0,0 +1,97 @@
+% tpm2_encodeobject(1) tpm2-tools | General Commands Manual
+
+# NAME
+
+**tpm2_encodeobject**(1) - Encode an object into a combined PEM format.
+
+# SYNOPSIS
+
+**tpm2_encodeobject** *OPTIONS*
+
+# DESCRIPTION
+
+**tpm2_encodeobject**(1) - Encode both the private and public portions of an
+object into a combined PEM format used by tpm2-tss-engine.
+
+The tool reads private and public portions of an object and encodes it
+into a combined PEM format used by tpm2-tss-engine and other
+applications.
+
+**NOTE**: Both private and public portions of the tpm key must be specified.
+
+# OPTIONS
+
+  * **-C**, **\--parent-context**=_OBJECT_:
+
+    The parent object.
+
+  * **-P**, **\--auth**=_AUTH_:
+
+    The authorization value of the parent object specified by **-C**.
+
+  * **-u**, **\--public**=_FILE_:
+
+    A file containing the public portion of the object.
+
+  * **-r**, **\--private**=_FILE_:
+
+    A file containing the sensitive portion of the object.
+
+  * **-p**, **\--key-auth**:
+
+    Indicates if an authorization value is needed for the object specified by
+    **-r** and **-u**.
+
+  * **-o**, **\--output**=_FILE_:
+
+    The output file path, recording the public portion of the object.
+
+## References
+
+context object format(common/ctxobj.md) details the methods for specifying
+_OBJECT_.
+
+authorization formatting(common/authorizations.md) details the methods for
+specifying _AUTH_.
+
+common options(common/options.md) collection of common options that provide
+information many users may expect.
+
+common tcti options(common/tcti.md) collection of options used to configure
+the various known TCTI modules.
+
+# EXAMPLES
+
+## Setup
+To load an object you first must create an object under a primary object. So the
+first step is to create the primary object.
+
+```bash
+tpm2_createprimary -c primary.ctx
+```
+
+Step 2 is to create an object under the primary object.
+
+```bash
+tpm2_create -C primary.ctx -u key.pub -r key.priv -f pem -o pub.pem
+```
+
+This creates the private and public portions of the TPM object. With these
+object portions, it is now possible to load that object into the TPM for
+subsequent use.
+
+## Encoding an Object into a combined PEM format
+
+The final step, is encoding the public and private portions of the object into a
+PEM format.
+
+```bash
+tpm2_encodeobject -C primary.ctx -u key.pub -r key.priv -c priv.pem
+```
+
+The generated `priv.pem` can be used together with `pub.pem` created in the
+step 2 of Setup section.
+
+returns(common/returns.md)
+
+footer(common/footer.md)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_eventlog.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_eventlog.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_flushcontext.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_flushcontext.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_getcap.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_getcap.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_getcommandauditdigest.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_getcommandauditdigest.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_geteccparameters.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_geteccparameters.1.md Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_getpolicydigest.1.md Added

@@ -0,0 +1,54 @@
+% tpm2_getpolicydigest(1) tpm2-tools | General Commands Manual
+
+# NAME
+
+**tpm2_getpolicydigest**(1) - Retrieves the policy digest from session.
+
+# SYNOPSIS
+
+**tpm2_getpolicydigest** *OPTIONS* *ARGUMENT*
+
+# DESCRIPTION
+
+**tpm2_getpolicydigest**(1) - Returns the policydigest of a session.
+
+Output defaults to *stdout* and binary format unless otherwise specified with
+**-o** and **--hex** options respectively.
+
+# OPTIONS
+
+  * **-o**, **\--output**=_FILE_
+
+    Specifies the filename to output the raw bytes to. Defaults to stdout as a
+    hex string.
+
+  * **\--hex**
+
+	Convert the output data to hex format without a leading "0x".
+
+  * **-S**, **\--session**=_FILE_:
+
+    The session created using **tpm2_startauthsession**.
+
+## References
+
+common options(common/options.md) collection of common options that provide
+information many users may expect.
+
+common tcti options(common/tcti.md) collection of options used to configure
+the various known TCTI modules.
+
+# EXAMPLES
+
+## Create a session and retrieve policydigest
+```bash
+tpm2 startauthsession -S session.ctx
+tpm2 policypassword -S session.ctx -L test.policy
+tpm2 getpolicydigest -S session.ctx -o policy.out
+tpm2 flushcontext session.ctx
+```
+
+
+returns(common/returns.md)
+
+footer(common/footer.md)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_getrandom.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_getrandom.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_getsessionauditdigest.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_getsessionauditdigest.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_import.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_import.1.md Changed

@@ -25,6 +25,7 @@
     * **aes** - AES 128, 192 or 256 key.
     * **rsa** - RSA 1024 or 2048 key.
     * **ecc** - ECC NIST P192, P224, P256, P384 or P521 public and private key.
+	* **hmac** - HMAC key.
 
   * **-g**, **\--hash-algorithm**=_ALGORITHM_:
 
@@ -85,14 +86,17 @@
 
     The authorization value for the imported key, optional.
 
-  * **-L**, **\--policy**=_POLICY\_FILE_:
+  * **-L**, **\--policy**=_POLICY_ or _HEX\_STRING_:
 
-    The policy file.
+    The policy file or policy hex string used for authorization to the object.
 
   * **-s**, **\--seed**=_FILE_:
 
     Specifies the file containing the encrypted seed of the duplicated object.
 
+    In order to perform an "unencrypted import" a seed file with the content
+    0x0000 needs to be provided (e.g. printf "0000" | xxd -r -p >seed.file).
+
   * **\--passin**=_OSSL\_PEM\_FILE\_PASSWORD_
 
     An optional password for an Open SSL (OSSL) provided input file. It mirrors
@@ -139,7 +143,7 @@
 ```bash
 dd if=/dev/urandom of=sym.key bs=1 count=16
 
-tpm2_import -C parent.ctx -i sym.key -u key.pub -r key.priv
+tpm2_import -C parent.ctx -G aes -i sym.key -u key.pub -r key.priv
 ```
 
 ## Import an RSA key

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_load.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_load.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_loadexternal.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_loadexternal.1.md Changed

@@ -12,8 +12,10 @@
 
 **tpm2_loadexternal**(1) - This command loads an external object into the TPM,
 forgoing TPM protections. Ie, the key material is not protected by the parent
-object's seed. The command allows loading of just the public portion of an
-object or both the public and private portions of an object.
+object's seed. It can also be used to load TSS2 Private Keys in pem format.
+The command allows loading of just the public portion of an object or both the
+public and private portions of an object. For TSS2 Private Keys, only the public
+portion of the key is loaded.
 
 The tool outputs the name of the loaded object in a YAML dictionary format
 with the key *name* where the value for that key is the name of the object
@@ -62,6 +64,7 @@
         `openssl genrsa -out private.pem 2048`
         Since an RSA public key can be derived from the private PEM file, their
         is no need to specify -u for the public portion.
+      * TSS2 PrivateKey PEM formats.
 
     *Note*: The private portion does not respect TSS formats as it's impossible
     to get a **TPM2B_SENSITIVE** output from a previous command. They are always
@@ -71,10 +74,11 @@
 
     The authorization value for the key, optional.
 
-  * **-L**, **\--policy**=_POLICY\_FILE_:
+  * **-L**, **\--policy**=_FILE_ or _HEX\_STRING_:
 
-    The input policy file, optional. A file containing the hash of a policy
-    derived from `tpm2_createpolicy`.
+    The input policy file or hex string, optional. A file or hex string
+    containing the hash of a policy derived from `tpm2_createpolicy` or
+    another policy digest generating source.
 
   * **-g**, **\--hash-algorithm**=_ALGORITHM_:
 
@@ -181,6 +185,13 @@
 name: 000bfc4d8dd7e4f921bcc9dca4b04f49564243cd9def129a3740002bfd4b9e966d34
 ```
 
+## Load TSS2 Private Key into the *null* hierarchy
+
+```bash
+tpm2_loadexternal -r tss_privkey.pem -c tss_privkey.ctx
+name: 000bc5a216702aca9ba226af1214c50dc4dc33ce6269677aa581ea6d9eec7f27000d
+```
+
 returns(common/returns.md)
 
 footer(common/footer.md)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_nvcertify.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_nvcertify.1.md Changed

@@ -74,7 +74,29 @@
 
     File path to record the hash of the command parameters. This is commonly
     termed as cpHash. NOTE: When this option is selected, The tool will not
-    actually execute the command, it simply returns a cpHash.
+    actually execute the command, it simply returns a cpHash unless rphash is
+    also required.
+
+  * **\--rphash**=_FILE_
+
+    File path to record the hash of the response parameters. This is commonly
+    termed as rpHash.
+
+  * **-S**, **\--session**=_FILE_:
+
+    The session created using **tpm2_startauthsession**. This can be used to
+    specify an auxiliary session for auditing and or encryption/decryption of
+    the parameters.
+
+  * **-n**, **\--name**=_FILE_:
+
+    The name of the NV index that must be provided when only calculating the
+    cpHash without actually dispatching the command to the TPM.
+
+  * **\-signer-name**=_FILE_:
+
+    The name of the signing key that must be provided when only calculating the
+    cpHash without actually dispatching the command to the TPM.
 
   * **ARGUMENT** the command line argument specifies the NV index or offset
     number.

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_nvdefine.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_nvdefine.1.md Changed

@@ -31,6 +31,12 @@
     Specifies the size of data area in bytes. Defaults to **MAX_NV_INDEX_SIZE**
     which is typically 2048.
 
+  * **-g**, **\--hash-algorithm**=_ALGORITHM_:
+
+    The hash algorithm used to compute the name of the Index and used for the
+    authorization policy. If the index is an extend index, the hash algorithm is
+    used for the extend.
+
   * **-a**, **\--attributes**=_ATTRIBUTES_
 
     Specifies the attribute values for the nv region used when creating the
@@ -74,7 +80,18 @@
 
     File path to record the hash of the command parameters. This is commonly
     termed as cpHash. NOTE: When this option is selected, The tool will not
-    actually execute the command, it simply returns a cpHash.
+    actually execute the command, it simply returns a cpHash, unless rphash is also required.
+
+  * **\--rphash**=_FILE_
+
+    File path to record the hash of the response parameters. This is commonly
+    termed as rpHash.
+
+  * **-S**, **\--session**=_FILE_:
+
+    The session created using **tpm2_startauthsession**. Multiple of these can
+    be specified. For example, you can have one session for auditing and another
+    for encryption/decryption of the parameters.
 
   * **ARGUMENT** the command line argument specifies the NV index or offset
     number.

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_nvextend.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_nvextend.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_nvincrement.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_nvincrement.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_nvread.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_nvread.1.md Changed

@@ -50,7 +50,30 @@
 
     File path to record the hash of the command parameters. This is commonly
     termed as cpHash. NOTE: When this option is selected, The tool will not
-    actually execute the command, it simply returns a cpHash.
+    actually execute the command, it simply returns a cpHash, unless rphash is
+    also required.
+
+  * **\--rphash**=_FILE_
+
+    File path to record the hash of the response parameters. This is commonly
+    termed as rpHash.
+
+  * **-n**, **\--name**=_FILE_:
+
+    The name of the NV index that must be provided when only calculating the
+    cpHash without actually dispatching the command to the TPM.
+
+  * **-S**, **\--session**=_FILE_:
+
+    The session created using **tpm2_startauthsession**. This can be used to
+    specify an auxiliary session for auditing and or encryption/decryption of
+    the parameters.
+
+  * **\--print-yaml**:
+
+	Output the content of the NV index in a human readable format, useful
+	for displaying the content of counter, bits and extend and pin indices.
+	When this argument is provided size and offset is ignored.
 
   * **ARGUMENT** the command line argument specifies the NV index or offset
     number.

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_nvreadlock.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_nvreadlock.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_nvreadpublic.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_nvreadpublic.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_nvsetbits.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_nvsetbits.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_nvundefine.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_nvundefine.1.md Changed

@@ -37,13 +37,40 @@
   * **-S**, **\--session**=_POLICY_SESSION_:
 
     Specify a policy session to use when the NV index has attribute
-    `TPMA_NV_POLICY_DELETE` set.
+    `TPMA_NV_POLICY_DELETE` set. This can also be used to specify an auxiliary
+    session for auditing and or encryption/decryption of the parameters.
+    Note:
+    1. If TPM2_CC_NV_UndefineSpaceSpecial is invoked then only one additional
+       aux session can be specified. The order of how sessions are specified
+       also matters. First specification of `-S` is interpreted as the session
+       for satisfying the ADMIN role required for
+       TPM2_CC_NV_UndefineSpaceSpecial.
+
+    2. If TPM2_CC_NV_Undefine is invoked then only two additional aux sessions
+       can be specified.
 
   * **\--cphash**=_FILE_
 
     File path to record the hash of the command parameters. This is commonly
     termed as cpHash. NOTE: When this option is selected, The tool will not
-    actually execute the command, it simply returns a cpHash.
+    actually execute the command, it simply returns a cpHash, it simply returns
+    a cpHash unless rphash is also required.
+
+  * **\--rphash**=_FILE_
+
+    File path to record the hash of the response parameters. This is commonly
+    termed as rpHash.
+
+  * **\--with-policydelete**=_NONE_
+
+    This must be specified when calculating cpHash with **\--tcti=none**. This
+    is a requirement because there is no way to know if the attribute
+    TPMA_NV_POLICYDELETE has been set from the NV index name alone.
+
+  * **-n**, **\--name**=_FILE_:
+
+    The name of the NV index that must be provided when only calculating the
+    cpHash without actually dispatching the command to the TPM.
 
   * **ARGUMENT** the command line argument specifies the NV index or offset
     number.

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_nvwrite.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_nvwrite.1.md Changed

@@ -25,7 +25,8 @@
 
   * **-i**, **\--input**=_FILE_:
 
-    Specifies the input file with data to write to NV.
+    This is a mandatory input to specify the input file with data to write to
+    NV. The input can also be specified from stdin with **-i-** option.
 
   * **-C**, **\--hierarchy**=_OBJECT_:
 
@@ -51,7 +52,24 @@
 
     File path to record the hash of the command parameters. This is commonly
     termed as cpHash. NOTE: When this option is selected, The tool will not
-    actually execute the command, it simply returns a cpHash.
+    actually execute the command, it simply returns a cpHash unless rphash is
+    also required.
+
+  * **\--rphash**=_FILE_
+
+    File path to record the hash of the response parameters. This is commonly
+    termed as rpHash.
+
+  * **-S**, **\--session**=_FILE_:
+
+    The session created using **tpm2_startauthsession**. This can be used to
+    specify an auxiliary session for auditing and or encryption/decryption of
+    the parameters.
+
+  * **-n**, **\--name**=_FILE_:
+
+    The name of the NV index that must be provided when only calculating the
+    cpHash without actually dispatching the command to the TPM.
 
 ## References

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_nvwritelock.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_nvwritelock.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_pcrallocate.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_pcrallocate.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_pcrevent.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_pcrevent.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_pcrextend.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_pcrextend.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_pcrread.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_pcrread.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_pcrreset.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_pcrreset.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_policyauthorize.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_policyauthorize.1.md Changed

@@ -55,6 +55,12 @@
     The ticket file to record the validation structure. This is generated with
     **tpm2_verifysignature**(1).
 
+  * **\--cphash**=_FILE_
+
+    File path to record the hash of the command parameters. This is commonly
+    termed as cpHash. NOTE: When this option is selected, The tool will not
+    actually execute the command, it simply returns a cpHash.
+
 ## References
 
 common options(common/options.md) collection of common options that provide
@@ -83,31 +89,31 @@
 tpm2_loadexternal -G rsa -C o -u signing_key_public.pem -c signing_key.ctx -n signing_key.name
 ```
 
-## Create a policy to be authorized like a PCR policy
+## Create the authorize policy digest
 ```bash
-tpm2_pcrread -opcr0.sha256 sha256:0
-
 tpm2_startauthsession -S session.ctx
 
-tpm2_policypcr -S session.ctx -l sha256:0 -f pcr0.sha256 -L pcr.policy
+tpm2_policyauthorize -S session.ctx -L authorized.policy -n signing_key.name
 
 tpm2_flushcontext session.ctx
 ```
 
-## Sign the policy
+## Create a policy to be authorized like a PCR policy
 ```bash
-openssl dgst -sha256 -sign signing_key_private.pem -out pcr.signature pcr.policy
-```
+tpm2_pcrread -opcr0.sha256 sha256:0
 
-## Authorize the policy in the policy digest
-```bash
 tpm2_startauthsession -S session.ctx
 
-tpm2_policyauthorize -S session.ctx -L authorized.policy -i pcr.policy -n signing_key.name
+tpm2_policypcr -S session.ctx -l sha256:0 -f pcr0.sha256 -L pcr.policy_desired
 
 tpm2_flushcontext session.ctx
 ```
 
+## Sign the policy
+```bash
+openssl dgst -sha256 -sign signing_key_private.pem -out pcr.signature pcr.policy_desired
+```
+
 ## Create a TPM object like a sealing object with the authorized policy based authentication
 ```bash
 tpm2_createprimary -C o -g sha256 -G rsa -c prim.ctx
@@ -115,15 +121,15 @@
 tpm2_create -g sha256 -u sealing_pubkey.pub -r sealing_prikey.pub -i- -C prim.ctx -L authorized.policy <<< "secret to seal"
 ```
 
-## Satisfy policy and unseal the secret
+## Verify the desired policy digest comes from the signing authority, read the actual value of PCR and check that read policy and desired policy are equal. 
 ```bash
-tpm2_verifysignature -c signing_key.ctx -g sha256 -m pcr.policy -s pcr.signature -t verification.tkt -f rsassa
+tpm2_verifysignature -c signing_key.ctx -g sha256 -m  pcr.policy_desired -s pcr.signature -t verification.tkt -f rsassa
 
 tpm2_startauthsession \--policy-session -S session.ctx
 
-tpm2_policypcr -S session.ctx -l sha256:0 -L pcr.policy
+tpm2_policypcr -S session.ctx -l sha256:0 -L pcr.policy_read
 
-tpm2_policyauthorize -S session.ctx -L authorized.policy -i pcr.policy -n signing_key.name -t verification.tkt
+tpm2_policyauthorize -S session.ctx -L authorized.policy -i pcr.policy_desired -n signing_key.name -t verification.tkt
 
 tpm2_load -C prim.ctx -u sealing_pubkey.pub -r sealing_prikey.pub -c sealing_key.ctx

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_policyauthvalue.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_policyauthvalue.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_policycommandcode.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_policycommandcode.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_policycountertimer.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_policycountertimer.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_policycphash.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_policycphash.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_policylocality.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_policylocality.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_policynvwritten.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_policynvwritten.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_policyor.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_policyor.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_policypassword.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_policypassword.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_policyrestart.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_policyrestart.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_print.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_print.1.md Changed

@@ -10,9 +10,10 @@
 
 # DESCRIPTION
 
-**tpm2_print**(1) - Decodes a TPM data structure and prints enclosed elements to
-stdout as YAML. A file path containing a TPM object may be specified as the
-path argument. Reads from stdin if unspecified.
+**tpm2_print**(1) - Decodes a TPM data structure and prints enclosed elements
+to stdout as YAML. A file path containing a TPM object or a TSS2 Private Key
+in the PEM format may be specified as the path argument. Reads from stdin if
+unspecified.
 
 # OPTIONS
 
@@ -23,8 +24,15 @@
       * **TPMS_CONTEXT**
       * **TPM2B_PUBLIC**
       * **TPMT_PUBLIC**
+      * **TSSPRIVKEY_OBJ**
+      * **ESYS_TR**
   * **ARGUMENT** the command line argument specifies the path of the TPM data.
 
+pubkey options(common/pubkey.md)
+
+    Public key format. This only works if option `--type/-t` is set to
+    TPM2B_PUBLIC or TPMT_PUBLIC.
+
 ## References
 
 context object format(common/ctxobj.md) details the methods for specifying
@@ -77,6 +85,30 @@
 tpm2_print -t TPMT_PUBLIC key.tpmt
 ```
 
+### Print a TPM2B_PUBLIC file and convert to PEM format
+
+```bash
+tpm2 print -t TPM2B_PUBLIC -f pem key.pub
+```
+
+### Print public portion of TSSPRIVKEY PEM file and convert to PEM format
+
+```bash
+tpm2 print -t TSSPRIVKEY_OBJ tssprivkey.pem
+tpm2 print -t TSSPRIVKEY_OBJ tssprivkey.pem -f pem > publickey.pem
+```
+
+### Print the name of a serialized ESYS\_TR handle.
+
+Serialized ESYS\_TR handles are returned from tools like `tpm2_evictcontrol`'s
+`-o` and `tpm2_readpublic`'s `-t` options.
+
+```bash
+tpm2_createprimary -c primary.ctx
+tpm2_evictcontrol -c primary.ctx -o primary.tr
+tpm2 print -t ESYS_TR primary.tr
+```
+
 returns(common/returns.md)
 
 footer(common/footer.md)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_quote.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_quote.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_readclock.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_readclock.1.md Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_sessionconfig.1.md Added

@@ -0,0 +1,101 @@
+% tpm2_sessionconfig(1) tpm2-tools | General Commands Manual
+
+# NAME
+
+**tpm2_sessionconfig**(1) - Configure session attributes and print session info
+from a session file.
+
+# SYNOPSIS
+
+**tpm2_sessionconfig** *OPTIONS* *ARGUMENT*
+
+# DESCRIPTION
+
+**tpm2_sessionconfig**(1) - Configure session attributes and print session info
+from a session file.
+
+The tool operates in one of two modes:
+1. Configure/ modify the session attributes.
+2. Print the session information. This is the default behavior.
+
+# OPTIONS
+
+  * **\--enable-continuesession**:
+
+    Enable continueSession in the session-attributes.
+
+  * **\--disable-continuesession**
+
+    Disable continuesession in the session-attributes.
+
+  * **\--enable-auditexclusive**
+
+    Enable auditexclusive in the session-attributes.
+
+  * **\--disable-auditexclusive**
+
+    Disable auditexclusive in the session-attributes.
+
+  * **\--enable-auditreset**
+
+    Enable  auditreset in the session-attributes.
+
+  * **\--disable-auditreset**
+
+    Disable auditreset in the session-attributes.
+
+  * **\--enable-decrypt**
+
+    Enable  decrypt in the session-attributes.
+
+  * **\--disable-decrypt**
+
+    Disable decrypt in the session-attributes.
+
+  * **\--enable-encrypt**
+
+    Enable  encrypt in the session-attributes.
+
+  * **\--disable-encrypt**
+
+    Disable encrypt in the session-attributes.
+
+  * **\--enable-audit**
+
+    Enable  audit in the session-attributes.
+
+  * **\--disable-audit**
+
+    Disable audit in the session-attributes.
+
+* **ARGUMENT** the session context file.
+
+## References
+
+common options(common/options.md) collection of common options that provide
+information many users may expect.
+
+common tcti options(common/tcti.md) collection of options used to configure
+the various known TCTI modules.
+
+# EXAMPLES
+
+## Start a bounded & salted session, disable continuesession and display session
+
+```bash
+
+tpm2 createprimary -c prim.ctx
+tpm2 startauthsession -S session.ctx --policy-session -c prim.ctx
+
+### Session info before changing attributes
+tpm2 sessionconfig session.ctx
+
+### Session info after changing attributes
+tpm2 sessionconfig --disable-continuesession
+tpm2 sessionconfig session.ctx
+
+```
+
+returns(common/returns.md)
+
+footer(common/footer.md)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_startauthsession.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_startauthsession.1.md Changed

@@ -10,14 +10,35 @@
 
 # DESCRIPTION
 
-**tpm2_startauthsession**(1) - Starts a session with the TPM. The default is
-to start a *trial* session unless the **-a** option is specified.
-Saves the policy session data to a file. This file can then be used in subsequent
-tools that can use a policy file for authorization or policy events.
+**tpm2_startauthsession**(1) - Starts a session with the TPM. The default is to
+start a *trial* session unless the **-a** option is specified. Saves the policy
+session data to a file. This file can then be used in subsequent tools that can
+use a policy file for authorization or policy events.
+
+This will not work with resource managers (RMs) outside of
+tpm2-abrmd(https://github.com/tpm2-software/tpm2-abrmd), as most RMs will flush
+session handles when a client disconnects from the IPC channel. However, when using
+a RM without the session gapping feature, one can use the command TCTI to keep the
+connection open.
+
+The first step is to create a socket listener that uses tpm2\_send:
+```bash
+mknod "$HOME/backpipe" p
+while  1 ; do tpm2_send 0<"$HOME/backpipe" | nc -lU "$HOME/sock" 1>"$HOME/backpipe"; done;
+```
+
+The next step is to use the command TCTI and netcat (nc) to send data to the socket.
+```bash
+tpm2_startauthsession --tcti="cmd:nc -q 0 -U $HOME/sock" <options>
+```
 
-This will not work with resource managers (RMs) outside of tpm2-abrmd(https://
-github.com/tpm2-software/tpm2-abrmd), as most RMs will flush session handles
-when a client disconnects from the IPC channel.
+When finishing ensure to kill the listener. For commands executed with the command tcti against
+the listener, one will need to manage transient handles. The simplest way is to add a flush
+after each command: `tpm2_flushcontext --tcti="cmd:nc -q 0 -U $HOME/sock" -t`
+
+Note: This example uses UNIX sockets, since the socket is controlled with Linux
+access controls. Using a port is not recommended as it's either open to any user
+on the system (localhost) or bound to a network card and exposed to the network.
 
 This will work with direct TPM access, but note that internally this calls a
 *ContextSave* and a *ContextLoad* on the session handle, thus the session
@@ -27,8 +48,9 @@
 
   * **\--policy-session**:
 
-    Start a policy session of type **TPM_SE_POLICY**. Default without this option
-    is **TPM_SE_TRIAL**.
+    Start a policy session of type **TPM_SE_POLICY**. Default without this
+    option is **TPM_SE_TRIAL**.
+
     **NOTE**: A *trial* session is used when building a policy and a *policy*
     session is used when authenticating with a policy.
 
@@ -37,20 +59,57 @@
     Start an HMAC session to be used as an audit session. Default without
     this option is **TPM2_SE_TRIAL**.
 
+  * **\--hmac-session**:
+
+    Start an HMAC session of type **TPM_SE_HMAC**. Default without this option
+    is **TPM2_SE_TRIAL**.
+
   * **-g**, **\--hash-algorithm**=_ALGORITHM_:
 
     The hash algorithm used in computation of the policy digest.
 
+  * **-G**, **\--key-algorithm**=_ALGORITHM_:
+
+    The symmetric algorithm used in parameter encryption/decryption.
+
   * **-c**, **\--key-context**=_OBJECT_:
 
-    Set the session encryption and bind key. When using this, sensitive data
-    transmitted to the TPM will be encrypted with AES128CFB. **This prevents bus
-    snooping attacks.**
+    Set the tpmkey and bind objects to be the same.
+    Session parameter encryption is turned on.
+    Session parameter decryption is turned on.
+    Parameter encryption/decryption symmetric-key set to AES-CFB.
 
   * **-S**, **\--session**=_FILE_:
 
     The name of the policy session file, required.
 
+  * **\--bind-context**=_FILE_:
+
+    Set the bind object.
+    Session parameter encryption is off. Use **tpm2_sessionconfig** to turn on.
+    Session parameter decryption is off. Use **tpm2_sessionconfig** to turn on.
+    Parameter encryption/decryption symmetric-key set to AES-CFB.
+
+  * **\--bind-auth**=_AUTH_:
+
+    Set the authorization value for the bind object.
+
+  * **\--tpmkey-context**=_FILE_:
+
+    Set the tpmkey object.
+    Session parameter encryption is off. Use **tpm2_sessionconfig** to turn on.
+    Session parameter decryption is off. Use **tpm2_sessionconfig** to turn on.
+    Parameter encryption/decryption symmetric-key set to AES-CFB.
+
+  * **-n**, **\--name**=_FILE_
+
+    A name file as output from a tool like tpm2\_readpublic(1) `-n` option.
+    The name file can be used to **verify** a persistent handle input for
+    the `--tpmkey-context`, `-c`, and `--key-context` options. Verification
+    that the object referenced by a peristent handle, e.g 0x81000000, is
+    the key expected prevents attackers from performing a man-in-the-middle
+    attack on session traffic.
+
 ## References
 
 context object format(common/ctxobj.md) details the methods for specifying

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tpm2_unseal.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tpm2_unseal.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tss2_getrandom.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tss2_getrandom.1.md Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/man/tss2_gettpm2object.1.md Added

@@ -0,0 +1,63 @@
+% tss2_gettpm2object(1) tpm2-tools | General Commands Manual
+%
+% APRIL 2019
+
+# NAME
+
+**tss2_gettpm2object**(1)
+
+# SYNOPSIS
+
+**tss2_gettpm2object** *OPTIONS*
+
+common fapi references(common/tss2-fapi-references.md)
+
+# DESCRIPTION
+
+**tss2_gettpm2object**(1) -  With this command for FAPI objects context
+files which can be used by tpm2 tool commands can be created.
+For persistent object only the textual representation of the handle number as
+hex number will be written and for keys a tpm2 tool context file will
+be written.
+If the default TCTI differs from the FAPI profile the default the tcti can
+be defined with the -T (--tcti) option.
+**Note** To avoid wrong nv_written state in keystore before writing data
+to the NV ram with tpm2_nvwrite, at least an empty string should be
+written with tss2_nvwrite.
+
+# OPTIONS
+
+These are the available options:
+
+  * **-f**, **\--force**:
+
+    Force overwriting the output file.
+
+  * **-p**, **\--path**=_STRING_:
+
+    Path of the object for which the application data will be loaded.
+
+  * **-c**, **\--context**=_FILENAME_ or _-_ (for stdout):
+
+     The returned key context or handle.
+
+common tss2 options(common/tss2-options.md)
+
+# EXAMPLES
+```
+tss2_gettpm2object --path=/HS/SRK/myRSACrypt --key-context=mykey.ctx
+tss2_gettpm2object --path=/nv/Owner/mynv -c-
+```
+The command can be used in options of tpm2 commands:
+
+```
+handle=$(tss2_gettpm2object --path=/nv/Owner/mynv -c-)
+tpm2_nvread $handle
+
+```
+
+# RETURNS
+
+0 on success or 1 on failure.
+
+footer(common/footer.md)

_service:tar_scm:tpm2-tools-5.0.tar.gz/man/tss2_import.1.md -> _service:tar_scm:tpm2-tools-5.4.tar.gz/man/tss2_import.1.md Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/missing -> _service:tar_scm:tpm2-tools-5.4.tar.gz/missing Changed

@@ -1,9 +1,9 @@
 #! /bin/sh
 # Common wrapper for a few potentially missing GNU programs.
 
-scriptversion=2013-10-28.13; # UTC
+scriptversion=2018-03-07.03; # UTC
 
-# Copyright (C) 1996-2014 Free Software Foundation, Inc.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.
 # Originally written by Fran,cois Pinard <pinard@iro.umontreal.ca>, 1996.
 
 # This program is free software; you can redistribute it and/or modify
@@ -17,7 +17,7 @@
 # GNU General Public License for more details.
 
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -101,9 +101,9 @@
   exit $st
 fi
 
-perl_URL=http://www.perl.org/
-flex_URL=http://flex.sourceforge.net/
-gnu_software_URL=http://www.gnu.org/software
+perl_URL=https://www.perl.org/
+flex_URL=https://github.com/westes/flex
+gnu_software_URL=https://www.gnu.org/software
 
 program_details ()
 {
@@ -207,9 +207,9 @@
 exit $st
 
 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
+# time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

_service:tar_scm:tpm2-tools-5.4.tar.gz/scripts/utils/check_endorsement_cert.sh Added

@@ -0,0 +1,130 @@
+#!/bin/sh
+# SPDX-License-Identifier: BSD-3-Clause
+
+TESTDIR=$(mktemp -d || exit 1)
+cleanup() {
+    rm -rf $TESTDIR
+}
+trap cleanup EXIT
+
+EKPUB=$1
+EKCERT=$2
+
+usage() {
+cat <<EOF
+
+This utility checks the endorsement key and it's certificate for the following:
+1. Downloads intermediate and root certificate using authority information
+   access from the endorsement-key-certificate.
+2. Endorsement-key-public match with the endorsement-key-certificate.
+3. Subject and issuer hashes of certficates in the chain.
+4. Validation of the certificate chain.
+
+This utility assumes a typical cert chain: Root->Intermediate->Entity.
+
+Requirements:
+1. The ek-public and ek-certificate specified - in that order
+2. The ekpublic be specified in TPM2B_PUBLIC format and the endorsement
+   certificate in PEM format.
+
+Usage: $0 options FILE FILE
+Options:
+  -h    print this help text.
+EOF
+  exit 0
+}
+
+while getopts ":h" opt; do
+  case $opt in
+    h)
+      usage
+      ;;
+    \?)
+      echo "Invalid option: -$OPTARG" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if  "$#" -ne 2 ; then
+    (>&2 echo "Error: expected ek-public and ek-certificate - in that order")
+    exit 1
+fi
+
+# echo "Extracting public key from ek certificate"
+openssl x509 -pubkey -in $EKCERT -nocert > $TESTDIR/pub_in_cert.pem
+if  $? != 0 ;then
+    echo "Invalid endorsement certificate - Expected in PEM format"
+    exit 1
+fi
+# echo "Coverting ekpub from TPM2B_PUBLIC to pem"
+tpm2_print -t TPM2B_PUBLIC -f pem $EKPUB > $TESTDIR/ekpub.pem -Q 
+if  $? != 0 ;then
+    echo "Invalid endorsement key public - Expected EK in TPM2B_PUBLIC format"
+    exit 1
+fi
+# echo "Checking if the EKpublic matches the one in the certificate"
+cmp -s $TESTDIR/pub_in_cert.pem $TESTDIR/ekpub.pem
+if  $? != 0 ;then
+    echo "Mismatch - The endorsement key doesn't match the one in the cert"
+    exit 1
+fi
+
+# echo "Retrieving intermediate certificate"
+intermediate_cert_link=$(openssl x509 -in $EKCERT -noout -text | \
+                         grep -A1 "Authority Information Access" | \
+                         awk -F URI: '{print $2}')
+if  $? != 0 ;then
+    echo "Could not parse intermediate certificate information"
+    exit 1
+fi
+wget -q $intermediate_cert_link -O $TESTDIR/intermediate.crt
+if  $? != 0 ;then
+    echo "Could not retrieve intermediate certificate"
+    exit 1
+fi
+openssl x509 -in $TESTDIR/intermediate.crt -inform DER -outform PEM \
+    -out $TESTDIR/intermediate.pem
+
+# echo "Retrieving root certificate"
+root_cert_link=$(openssl x509 -in $TESTDIR/intermediate.pem -noout -text | \
+                         grep -A1 "Authority Information Access" | \
+                         awk -F URI: '{print $2}')
+if  $? != 0 ;then
+    echo "Could not parse root certificate information"
+    exit 1
+fi
+wget -q $root_cert_link -O $TESTDIR/root.crt
+if  $? != 0 ;then
+    echo "Could not retrieve root certificate"
+    exit 1
+fi
+openssl x509 -in $TESTDIR/root.crt -inform DER -outform PEM \
+    -out $TESTDIR/root.pem
+
+# echo "Test subject and issuers"
+EKCERT_HASH=$(openssl x509 -in $EKCERT -issuer_hash -noout)
+INTERMEDIATE_EKCERT_HASH=$(openssl x509 -in $TESTDIR/intermediate.pem -hash -noout)
+if  $EKCERT_HASH != $INTERMEDIATE_EKCERT_HASH ;then
+    echo "EKcert issuer-hash does not match Intermediate subject-hash"
+    exit 1
+fi
+
+INTERMEDIATE_HASH=$(openssl x509 -in $TESTDIR/intermediate.pem -issuer_hash -noout)
+ROOT_INTERMEDIATE_HASH=$(openssl x509 -in $TESTDIR/root.pem -hash -noout)
+if  $INTERMEDIATE_HASH != $ROOT_INTERMEDIATE_HASH ;then
+    echo "Intermediate issuer-hash does not match Root subject-hash"
+    exit 1
+fi
+
+# echo "Testing the certificate chain"
+openssl verify \
+    -CAfile $TESTDIR/root.pem \
+    -untrusted $TESTDIR/intermediate.pem \
+    $EKCERT
+if  $? != 0 ;then
+    echo "Failed $EKCERT certificate validation"
+    exit 1
+fi
+
+exit 0

_service:tar_scm:tpm2-tools-5.4.tar.gz/scripts/utils/icert_ondie_ca.sh Added

@@ -0,0 +1,58 @@
+#!/bin/sh
+# SPDX-License-Identifier: BSD-3-Clause
+
+usage() {
+cat <<EOF
+Splices ondie-CA intermediate certificate from DER encoding to PEM.
+
+Usage: $0 options FILE
+
+Options:
+  -h    print this help text.
+EOF
+  exit 0
+}
+
+while getopts ":h" opt; do
+  case $opt in
+    h)
+      usage
+      ;;
+    \?)
+      echo "Invalid option: -$OPTARG" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if  "$#" -ne 1 ; then
+    (>&2 echo "Error: expected 1 certificate file parameter, got: $#")
+    exit 1
+fi
+
+hlen=4
+rlen=0
+i=0
+offset=0
+offset_str=""
+flen=$(stat --printf="%s" $1)
+
+while  $offset -lt $flen ;do
+  len=$(openssl asn1parse -in $1 -inform DER $offset_str | grep SEQUENCE | \
+  head -1 | grep -o 'l= 0-9\{1,\}' | grep -o '0-9\{1,\}')
+
+  rlen=$(expr $hlen + $len)
+
+  openssl asn1parse -in $1 -inform DER -length $rlen $offset_str -out $i.der \
+  -noout
+
+  openssl x509 -in $i.der -out $i.pem -inform DER -outform PEM
+  rm $i.der
+
+  offset=$(expr $offset + $rlen)
+  offset_str="-offset $offset"
+
+  i=$(expr $i + 1)
+done
+
+echo "Found $i intermediate certificates"

_service:tar_scm:tpm2-tools-5.4.tar.gz/scripts/utils/sm_algorithm_test.sh Added

_service:tar_scm:tpm2-tools-5.0.tar.gz/src_vars.mk -> _service:tar_scm:tpm2-tools-5.4.tar.gz/src_vars.mk Changed

@@ -1,7 +1,7 @@
 LIB_C = lib/files.c lib/log.c lib/object.c lib/pcr.c lib/tool_rc.c lib/tpm2.c lib/tpm2_alg_util.c lib/tpm2_attr_util.c lib/tpm2_auth_util.c lib/tpm2_capability.c lib/tpm2_cc_util.c lib/tpm2_convert.c lib/tpm2_ctx_mgmt.c lib/tpm2_errata.c lib/tpm2_eventlog.c lib/tpm2_eventlog_yaml.c lib/tpm2_hash.c lib/tpm2_hierarchy.c lib/tpm2_identity_util.c lib/tpm2_kdfa.c lib/tpm2_kdfe.c lib/tpm2_openssl.c lib/tpm2_options.c lib/tpm2_policy.c lib/tpm2_session.c lib/tpm2_tool_output.c lib/tpm2_util.c 
 LIB_H = lib/efi_event.h lib/files.h lib/log.h lib/object.h lib/pcr.h lib/tool_rc.h lib/tpm2.h lib/tpm2_alg_util.h lib/tpm2_attr_util.h lib/tpm2_auth_util.h lib/tpm2_capability.h lib/tpm2_cc_util.h lib/tpm2_convert.h lib/tpm2_ctx_mgmt.h lib/tpm2_errata.h lib/tpm2_eventlog.h lib/tpm2_eventlog_yaml.h lib/tpm2_hash.h lib/tpm2_header.h lib/tpm2_hierarchy.h lib/tpm2_identity_util.h lib/tpm2_kdfa.h lib/tpm2_kdfe.h lib/tpm2_nv_util.h lib/tpm2_openssl.h lib/tpm2_options.h lib/tpm2_policy.h lib/tpm2_session.h lib/tpm2_systemdeps.h lib/tpm2_tool_output.h lib/tpm2_util.h 
 LIB_SRC = $(LIB_C) $(LIB_H)
-SYSTEM_TESTS = test/integration/tests/X509certutil.sh test/integration/tests/abrmd_extended-sessions.sh test/integration/tests/abrmd_nvundefinespecial.sh test/integration/tests/abrmd_policyauthorize.sh test/integration/tests/abrmd_policyauthorizenv.sh test/integration/tests/abrmd_policyauthvalue.sh test/integration/tests/abrmd_policycommandcode.sh test/integration/tests/abrmd_policycountertimer.sh test/integration/tests/abrmd_policycphash.sh test/integration/tests/abrmd_policyduplicationselect.sh test/integration/tests/abrmd_policynamehash.sh test/integration/tests/abrmd_policynv.sh test/integration/tests/abrmd_policynvwritten.sh test/integration/tests/abrmd_policyor.sh test/integration/tests/abrmd_policypassword.sh test/integration/tests/abrmd_policypcr.sh test/integration/tests/abrmd_policysecret.sh test/integration/tests/abrmd_policysigned.sh test/integration/tests/abrmd_policytemplate.sh test/integration/tests/abrmd_policyticket.sh test/integration/tests/activecredential.sh test/integration/tests/attestation.sh test/integration/tests/certify.sh test/integration/tests/certifycreation.sh test/integration/tests/changeauth.sh test/integration/tests/changeeps.sh test/integration/tests/changepps.sh test/integration/tests/checkquote.sh test/integration/tests/clear.sh test/integration/tests/clearcontrol.sh test/integration/tests/clockrateadjust.sh test/integration/tests/commandaudit.sh test/integration/tests/create.sh test/integration/tests/createak.sh test/integration/tests/createek.sh test/integration/tests/createpolicy.sh test/integration/tests/createprimary.sh test/integration/tests/dictionarylockout.sh test/integration/tests/duplicate.sh test/integration/tests/ecc.sh test/integration/tests/encryptdecrypt.sh test/integration/tests/eventlog.sh test/integration/tests/evictcontrol.sh test/integration/tests/flushcontext.sh test/integration/tests/getcap.sh test/integration/tests/getekcertificate.sh test/integration/tests/getrandom.sh test/integration/tests/gettestresult.sh test/integration/tests/gettime.sh test/integration/tests/hash.sh test/integration/tests/hierarchycontrol.sh test/integration/tests/hmac.sh test/integration/tests/import.sh test/integration/tests/import_tpm.sh test/integration/tests/incrementalselftest.sh test/integration/tests/load.sh test/integration/tests/loadexternal.sh test/integration/tests/makecredential.sh test/integration/tests/nv.sh test/integration/tests/nvcertify.sh test/integration/tests/nvinc.sh test/integration/tests/output_formats.sh test/integration/tests/pcrallocate.sh test/integration/tests/pcrevent.sh test/integration/tests/pcrextend.sh test/integration/tests/pcrlist.sh test/integration/tests/pcrreset.sh test/integration/tests/print.sh test/integration/tests/quote.sh test/integration/tests/rc_decode.sh test/integration/tests/readclock.sh test/integration/tests/readpublic.sh test/integration/tests/rsadecrypt.sh test/integration/tests/rsaencrypt.sh test/integration/tests/selftest.sh test/integration/tests/send-tcti-cmd.sh test/integration/tests/send.sh test/integration/tests/sessionaudit.sh test/integration/tests/setclock.sh test/integration/tests/setprimarypolicy.sh test/integration/tests/sign.sh test/integration/tests/startup.sh test/integration/tests/stirrandom.sh test/integration/tests/symlink.sh test/integration/tests/testparms.sh test/integration/tests/toggle_options.sh test/integration/tests/unseal.sh test/integration/tests/verifysignature.sh 
+SYSTEM_TESTS = test/integration/tests/X509certutil.sh test/integration/tests/abrmd_extended-sessions.sh test/integration/tests/abrmd_nvundefinespecial.sh test/integration/tests/abrmd_policyauthorize.sh test/integration/tests/abrmd_policyauthorizenv.sh test/integration/tests/abrmd_policyauthvalue.sh test/integration/tests/abrmd_policycommandcode.sh test/integration/tests/abrmd_policycountertimer.sh test/integration/tests/abrmd_policycphash.sh test/integration/tests/abrmd_policyduplicationselect.sh test/integration/tests/abrmd_policynamehash.sh test/integration/tests/abrmd_policynv.sh test/integration/tests/abrmd_policynvwritten.sh test/integration/tests/abrmd_policyor.sh test/integration/tests/abrmd_policypassword.sh test/integration/tests/abrmd_policypcr.sh test/integration/tests/abrmd_policysecret.sh test/integration/tests/abrmd_policysigned.sh test/integration/tests/abrmd_policytemplate.sh test/integration/tests/abrmd_policyticket.sh test/integration/tests/activecredential.sh test/integration/tests/attestation.sh test/integration/tests/certify.sh test/integration/tests/certifycreation.sh test/integration/tests/changeauth.sh test/integration/tests/changeeps.sh test/integration/tests/changepps.sh test/integration/tests/checkquote.sh test/integration/tests/clear.sh test/integration/tests/clearcontrol.sh test/integration/tests/clockrateadjust.sh test/integration/tests/commandaudit.sh test/integration/tests/create.sh test/integration/tests/createak.sh test/integration/tests/createek.sh test/integration/tests/createpolicy.sh test/integration/tests/createprimary.sh test/integration/tests/dictionarylockout.sh test/integration/tests/duplicate.sh test/integration/tests/ecc.sh test/integration/tests/encodeobject.sh test/integration/tests/encryptdecrypt.sh test/integration/tests/eventlog.sh test/integration/tests/evictcontrol.sh test/integration/tests/flushcontext.sh test/integration/tests/getcap.sh test/integration/tests/getekcertificate.sh test/integration/tests/getpolicydigest.sh test/integration/tests/getrandom.sh test/integration/tests/gettestresult.sh test/integration/tests/gettime.sh test/integration/tests/hash.sh test/integration/tests/hierarchycontrol.sh test/integration/tests/hmac.sh test/integration/tests/import.sh test/integration/tests/import_tpm.sh test/integration/tests/incrementalselftest.sh test/integration/tests/load.sh test/integration/tests/loadexternal.sh test/integration/tests/makecredential.sh test/integration/tests/nv.sh test/integration/tests/nvcertify.sh test/integration/tests/nvinc.sh test/integration/tests/output_formats.sh test/integration/tests/pcrallocate.sh test/integration/tests/pcrevent.sh test/integration/tests/pcrextend.sh test/integration/tests/pcrlist.sh test/integration/tests/pcrreset.sh test/integration/tests/pcrs_format.sh test/integration/tests/print.sh test/integration/tests/quote.sh test/integration/tests/rc_decode.sh test/integration/tests/readclock.sh test/integration/tests/readpublic.sh test/integration/tests/rsadecrypt.sh test/integration/tests/rsaencrypt.sh test/integration/tests/selftest.sh test/integration/tests/send-tcti-cmd.sh test/integration/tests/send.sh test/integration/tests/sessionaudit.sh test/integration/tests/sessionconfig.sh test/integration/tests/setclock.sh test/integration/tests/setprimarypolicy.sh test/integration/tests/sign.sh test/integration/tests/startup.sh test/integration/tests/stirrandom.sh test/integration/tests/symlink.sh test/integration/tests/testparms.sh test/integration/tests/toggle_options.sh test/integration/tests/unseal.sh test/integration/tests/verifysignature.sh 
 ALL_SYSTEM_TESTS = $(SYSTEM_TESTS)
-FAPI_TESTS = test/integration/fapi/fapi-authorize-policy.sh test/integration/fapi/fapi-authorize-policy_ecc.sh test/integration/fapi/fapi-branch-select.sh test/integration/fapi/fapi-branch-select_ecc.sh test/integration/fapi/fapi-encrypt-decrypt.sh test/integration/fapi/fapi-encrypt-decrypt_ecc.sh test/integration/fapi/fapi-export-key.sh test/integration/fapi/fapi-export-key_ecc.sh test/integration/fapi/fapi-export-policy.sh test/integration/fapi/fapi-export-policy_ecc.sh test/integration/fapi/fapi-get-info.sh test/integration/fapi/fapi-get-info_ecc.sh test/integration/fapi/fapi-get-platform-certificates.sh test/integration/fapi/fapi-get-platform-certificates_ecc.sh test/integration/fapi/fapi-get-random.sh test/integration/fapi/fapi-get-random_ecc.sh test/integration/fapi/fapi-get-tpm-blobs.sh test/integration/fapi/fapi-get-tpm-blobs_ecc.sh test/integration/fapi/fapi-key-change-auth.sh test/integration/fapi/fapi-key-change-auth_ecc.sh test/integration/fapi/fapi-list.sh test/integration/fapi/fapi-list_ecc.sh test/integration/fapi/fapi-nv-extend.sh test/integration/fapi/fapi-nv-extend_ecc.sh test/integration/fapi/fapi-nv-increment.sh test/integration/fapi/fapi-nv-increment_ecc.sh test/integration/fapi/fapi-nv-set-bits.sh test/integration/fapi/fapi-nv-set-bits_ecc.sh test/integration/fapi/fapi-nv-write-authorize.sh test/integration/fapi/fapi-nv-write-authorize_ecc.sh test/integration/fapi/fapi-nv-write-read-policy-or.sh test/integration/fapi/fapi-nv-write-read-policy-or2.sh test/integration/fapi/fapi-nv-write-read-policy-or2_ecc.sh test/integration/fapi/fapi-nv-write-read-policy-or_ecc.sh test/integration/fapi/fapi-nv-write-read.sh test/integration/fapi/fapi-nv-write-read_ecc.sh test/integration/fapi/fapi-pcr-extend-read.sh test/integration/fapi/fapi-pcr-extend-read_ecc.sh test/integration/fapi/fapi-provision.sh test/integration/fapi/fapi-provision_ecc.sh test/integration/fapi/fapi-quote-verify.sh test/integration/fapi/fapi-quote-verify_ecc.sh test/integration/fapi/fapi-seal-unseal.sh test/integration/fapi/fapi-seal-unseal_ecc.sh test/integration/fapi/fapi-set-get-app-data.sh test/integration/fapi/fapi-set-get-app-data_ecc.sh test/integration/fapi/fapi-set-get-certificate.sh test/integration/fapi/fapi-set-get-certificate_ecc.sh test/integration/fapi/fapi-set-get-description.sh test/integration/fapi/fapi-set-get-description_ecc.sh test/integration/fapi/fapi-sign-verify.sh test/integration/fapi/fapi-sign-verify_ecc.sh test/integration/fapi/fapi-testing-template.sh test/integration/fapi/fapi-testing-template_ecc.sh 
+FAPI_TESTS = test/integration/fapi/fapi-authorize-policy.sh test/integration/fapi/fapi-authorize-policy_ecc.sh test/integration/fapi/fapi-branch-select.sh test/integration/fapi/fapi-branch-select_ecc.sh test/integration/fapi/fapi-encrypt-decrypt.sh test/integration/fapi/fapi-encrypt-decrypt_ecc.sh test/integration/fapi/fapi-export-key.sh test/integration/fapi/fapi-export-key_ecc.sh test/integration/fapi/fapi-export-policy.sh test/integration/fapi/fapi-export-policy_ecc.sh test/integration/fapi/fapi-get-info.sh test/integration/fapi/fapi-get-info_ecc.sh test/integration/fapi/fapi-get-platform-certificates.sh test/integration/fapi/fapi-get-platform-certificates_ecc.sh test/integration/fapi/fapi-get-random.sh test/integration/fapi/fapi-get-random_ecc.sh test/integration/fapi/fapi-get-tpm-blobs.sh test/integration/fapi/fapi-get-tpm-blobs_ecc.sh test/integration/fapi/fapi-gettpm2object.sh test/integration/fapi/fapi-gettpm2object_ecc.sh test/integration/fapi/fapi-key-change-auth.sh test/integration/fapi/fapi-key-change-auth_ecc.sh test/integration/fapi/fapi-list.sh test/integration/fapi/fapi-list_ecc.sh test/integration/fapi/fapi-nv-extend.sh test/integration/fapi/fapi-nv-extend_ecc.sh test/integration/fapi/fapi-nv-increment.sh test/integration/fapi/fapi-nv-increment_ecc.sh test/integration/fapi/fapi-nv-set-bits.sh test/integration/fapi/fapi-nv-set-bits_ecc.sh test/integration/fapi/fapi-nv-write-authorize.sh test/integration/fapi/fapi-nv-write-authorize_ecc.sh test/integration/fapi/fapi-nv-write-read-policy-or.sh test/integration/fapi/fapi-nv-write-read-policy-or2.sh test/integration/fapi/fapi-nv-write-read-policy-or2_ecc.sh test/integration/fapi/fapi-nv-write-read-policy-or_ecc.sh test/integration/fapi/fapi-nv-write-read.sh test/integration/fapi/fapi-nv-write-read_ecc.sh test/integration/fapi/fapi-pcr-extend-read.sh test/integration/fapi/fapi-pcr-extend-read_ecc.sh test/integration/fapi/fapi-policy_signed.sh test/integration/fapi/fapi-policy_signed_delegation.sh test/integration/fapi/fapi-policy_signed_delegation_ecc.sh test/integration/fapi/fapi-policy_signed_ecc.sh test/integration/fapi/fapi-provision.sh test/integration/fapi/fapi-provision_ecc.sh test/integration/fapi/fapi-quote-verify.sh test/integration/fapi/fapi-quote-verify_ecc.sh test/integration/fapi/fapi-seal-unseal.sh test/integration/fapi/fapi-seal-unseal_ecc.sh test/integration/fapi/fapi-set-get-app-data.sh test/integration/fapi/fapi-set-get-app-data_ecc.sh test/integration/fapi/fapi-set-get-certificate.sh test/integration/fapi/fapi-set-get-certificate_ecc.sh test/integration/fapi/fapi-set-get-description.sh test/integration/fapi/fapi-set-get-description_ecc.sh test/integration/fapi/fapi-sign-verify.sh test/integration/fapi/fapi-sign-verify_ecc.sh test/integration/fapi/fapi-testing-template.sh test/integration/fapi/fapi-testing-template_ecc.sh 
 ALL_FAPI_TESTS = $(FAPI_TESTS)

_service:tar_scm:tpm2-tools-5.0.tar.gz/test-driver -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test-driver Changed

@@ -1,9 +1,9 @@
 #! /bin/sh
 # test-driver - basic testsuite driver script.
 
-scriptversion=2013-07-13.22; # UTC
+scriptversion=2018-03-07.03; # UTC
 
-# Copyright (C) 2011-2014 Free Software Foundation, Inc.
+# Copyright (C) 2011-2018 Free Software Foundation, Inc.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,7 +16,7 @@
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -140,9 +140,9 @@
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
+# time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/fapi/fapi-branch-select.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-branch-select.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/fapi/fapi-branch-select_ecc.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-branch-select_ecc.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/fapi/fapi-get-platform-certificates.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-get-platform-certificates.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/fapi/fapi-get-platform-certificates_ecc.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-get-platform-certificates_ecc.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/fapi/fapi-get-random.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-get-random.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/fapi/fapi-get-random_ecc.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-get-random_ecc.sh Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-gettpm2object.sh Added

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-gettpm2object_ecc.sh Added

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-policy_signed.sh Added

@@ -0,0 +1,204 @@
+
+# set -e
+source helpers.sh
+
+start_up
+
+CRYPTO_PROFILE="RSA"
+setup_fapi $CRYPTO_PROFILE
+
+function cleanup {
+    tss2 delete --path=/
+    shut_down
+}
+
+trap cleanup EXIT
+
+# openssl ecparam -name secp256r1 -genkey -noout -out key_priv.pem
+# openssl ec -in key_priv.pem -pubout -out key_pub.pem
+
+# -----BEGIN PUBLIC KEY-----
+# MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAw+PKFksCw+ikD76l6BMeXfebcZx
+# Gf8QGWT2MOy8tOfpe6m+6MUUm2GUijGPkvCTjtJPOJz//XMom+k+7OaWmA==
+# -----END PUBLIC KEY-----
+
+# -----BEGIN EC PRIVATE KEY-----
+# MHcCAQEEICf0OXKKsPkEVR1jsPOKSQQJnJVimamLYwLDZwJDj7etoAoGCCqGSM49
+# AwEHoUQDQgAEAw+PKFksCw+ikD76l6BMeXfebcZxGf8QGWT2MOy8tOfpe6m+6MUU
+# m2GUijGPkvCTjtJPOJz//XMom+k+7OaWmA==
+# -----END EC PRIVATE KEY-----
+
+
+KEY_PATH_1=HS/SRK/mySignKey1
+KEY_PATH_2=HS/SRK/mySignKey2
+SIGN_POLICY_DATA=pol_signed.json
+SIGN_POLICY_DATA_KEY_HINT=pol_signed_key_hint.json
+POLICY_SIGNED=policy/policy-signed
+POLICY_SIGNED_KEY_HINT=policy/policy-signed_key_hint
+TEST_SIGNATURE_FILE=test_signature.file
+SIGNATURE_FILE=signature.file
+DIGEST_FILE=digest.file
+PRIV_KEY_FILE=priv_key.file
+
+LOG_FILE=$TEMP_DIR/log.file
+touch $LOG_FILE
+
+EMPTY_FILE=$TEMP_DIR/empty.file
+BIG_FILE=$TEMP_DIR/big_file.file
+
+# Setup Policy Signed
+cat > $SIGN_POLICY_DATA_KEY_HINT <<EOF
+{
+    "description":"Description pol_signed",
+    "policy":
+        {
+            "type": "POLICYSIGNED",
+            "keyPEM": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAw+PKFksCw+ikD76l6BMeXfebcZx\nGf8QGWT2MOy8tOfpe6m+6MUUm2GUijGPkvCTjtJPOJz//XMom+k+7OaWmA==\n-----END PUBLIC KEY-----",
+            "keyPEMhashAlg": "SHA1",
+            "publicKeyHint": "My Signature Key"
+        }
+    
+}
+EOF
+
+cat > $SIGN_POLICY_DATA <<EOF
+{
+    "description":"Description pol_signed",
+    "policy":
+        {
+            "type": "POLICYSIGNED",
+            "keyPEM": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAw+PKFksCw+ikD76l6BMeXfebcZx\nGf8QGWT2MOy8tOfpe6m+6MUUm2GUijGPkvCTjtJPOJz//XMom+k+7OaWmA==\n-----END PUBLIC KEY-----",
+            "keyPEMhashAlg": "SHA1",
+        }
+    
+}
+EOF
+
+# Write private pem key to file
+cat > $PRIV_KEY_FILE <<EOF
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEICf0OXKKsPkEVR1jsPOKSQQJnJVimamLYwLDZwJDj7etoAoGCCqGSM49
+AwEHoUQDQgAEAw+PKFksCw+ikD76l6BMeXfebcZxGf8QGWT2MOy8tOfpe6m+6MUU
+m2GUijGPkvCTjtJPOJz//XMom+k+7OaWmA==
+-----END EC PRIVATE KEY-----
+EOF
+
+echo -n 01234567890123456789 > $DIGEST_FILE
+
+tss2 provision
+
+tss2 import --path=$POLICY_SIGNED --importData=$SIGN_POLICY_DATA
+
+tss2 import --path=$POLICY_SIGNED_KEY_HINT --importData=$SIGN_POLICY_DATA_KEY_HINT
+
+tss2 createkey --path $KEY_PATH_1 --type="sign, noda" \
+  --policyPath $POLICY_SIGNED --authValue ""
+
+tss2 createkey --path $KEY_PATH_2 --type="sign, noda" \
+  --policyPath $POLICY_SIGNED_KEY_HINT --authValue ""
+
+OUTPUT_FILE=$TEMP_DIR/data2sign.file
+
+expect <<EOF
+    spawn sh -c "tss2 sign --keyPath=$KEY_PATH_1 --digest=$DIGEST_FILE --signature=$TEST_SIGNATURE_FILE --force 2> $LOG_FILE"
+    expect "Filename for nonce output: " {
+        send "$OUTPUT_FILE\r"
+        expect "Filename for signature input: " {
+            exec openssl dgst -sha1 -sign $PRIV_KEY_FILE -out $SIGNATURE_FILE $OUTPUT_FILE
+            send "$SIGNATURE_FILE\r"
+            exp_continue
+        }
+    }
+EOF
+
+if grep "ERROR" $LOG_FILE > /dev/null
+then
+  cat $LOG_FILE
+  exit 1
+fi
+
+expect <<EOF
+    spawn sh -c "tss2 sign --keyPath=$KEY_PATH_2 --digest=$DIGEST_FILE --signature=$TEST_SIGNATURE_FILE --force 2> $LOG_FILE"
+    expect "Filename for nonce output: " {
+        send "$OUTPUT_FILE\r"
+        expect "Filename for signature input: " {
+            exec openssl dgst -sha1 -sign $PRIV_KEY_FILE -out $SIGNATURE_FILE $OUTPUT_FILE
+            send "$SIGNATURE_FILE\r"
+            exp_continue
+        }
+    }
+EOF
+
+if grep "ERROR" $LOG_FILE > /dev/null
+then
+  cat $LOG_FILE
+  exit 1
+fi
+
+echo "sign callback with BIG_FILE" # Expected to fail
+expect <<EOF
+    spawn sh -c "tss2 sign --keyPath=$KEY_PATH_1 --digest=$DIGEST_FILE --signature=$TEST_SIGNATURE_FILE --force 2> $LOG_FILE"
+    expect "Filename for nonce output: " {
+        send "$OUTPUT_FILE\r"
+        expect "Filename for signature input: " {
+            exec openssl dgst -sha1 -sign $PRIV_KEY_FILE -out $SIGNATURE_FILE $OUTPUT_FILE
+            send "$BIG_FILE\r"
+            set ret wait
+            if {lindex \$ret 2 || lindex \$ret 3 == 0} {
+                send_user "\nlindex \$ret\n"
+                send_user "Command not failed as expected\n"
+                exit 1
+            }
+        }
+        set ret wait
+        if {lindex \$ret 2 || lindex \$ret 3 == 0} {
+            set file open $LOG_FILE r
+            set log read \$file
+            close $file
+            send_user "\nlindex \$ret\n"
+            send_user "Command has not failed as expected\n"
+            exit 1
+        }
+    }          
+EOF
+
+if  "`cat $LOG_FILE`" == $SANITIZER_FILTER ; then
+  echo "Error: AddressSanitizer triggered."
+  cat $LOG_FILE
+  exit 1
+fi
+
+echo "sign callback with EMPTY_FILE" # Expected to fail
+expect <<EOF  
+    spawn sh -c "tss2 sign --keyPath=$KEY_PATH_1 --digest=$DIGEST_FILE --signature=$TEST_SIGNATURE_FILE --force 2> $LOG_FILE"
+    expect "Filename for nonce output: " {
+        send "$OUTPUT_FILE\r"
+        expect "Filename for signature input: " {
+            exec openssl dgst -sha1 -sign $PRIV_KEY_FILE -out $SIGNATURE_FILE $OUTPUT_FILE
+            send "$EMPTY_FILE\r"
+            set ret wait
+            if {lindex \$ret 2 || lindex \$ret 3 == 0} {
+                send_user "\nlindex \$ret\n"
+                send_user "Command has not failed as expected\n"
+                exit 1
+            }
+        }
+        set ret wait
+        if {lindex \$ret 2 || lindex \$ret 3 == 0} {
+            set file open $LOG_FILE r
+            set log read \$file
+            close $file
+            send_user "\nlindex \$ret\n"
+            send_user "Command has not failed as expected\n"
+            exit 1
+        }
+    }          
+EOF
+
+if  "`cat $LOG_FILE`" == $SANITIZER_FILTER ; then
+  echo "Error: AddressSanitizer triggered."
+  cat $LOG_FILE
+  exit 1
+fi
+
+exit 0
\ No newline at end of file

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-policy_signed_delegation.sh Added

@@ -0,0 +1,394 @@
+# In this test a backend issues two policies to a user "A":
+#   1. A user policy that allows "A" to authorize key usage
+#   2. An offline delegation policy that allows "A" to delegate his access rights
+#      two user "B" without further interaction with the backend. 
+
+# set -e
+source helpers.sh
+
+start_up
+
+CRYPTO_PROFILE="RSA"
+setup_fapi $CRYPTO_PROFILE
+
+# Extract value from JSON file
+function jsonValue {
+    KEY=$1
+    num=$2
+    awk -F",:}" '{for(i=1;i<=NF;i++){if($i~/'$KEY'\042/){print $(i+1)}}}' | tr -d '"' | sed -n ${num}p
+}
+
+function cleanup {
+    # In case the test is skipped, no key is created and a
+    # failure is expected here. Therefore, we need to pass a successful
+    # execution in any case
+    tss2 delete --path=/ && true
+    shut_down
+}
+
+trap cleanup EXIT
+
+# The delegation test needs at least the commit
+# b843960b6e601a786b469832392dc0a12e13cf34 of TSS to be executed successfully.
+# This commit will be introduced in version > 3.0.3. Will skip the test if
+# version is below.
+if  "$(echo $TSS_VERSION | sed 's/^0-9*//g')" -le "303" && "$TSS_VERSION" != "master" ; then
+    echo "TSS version does not support test"
+    exit 077
+fi
+
+PATH_REVOCATION="/nv/Owner/ctr"
+PATH_FEATURE_KEY_SIGN="HS/SRK/signkey"
+
+# Backend Policies
+POLICY_AUTH_BACKEND_PEM="pol_authorize_backend_pem.json"
+PATH_POL_AUTHORIZE="/policy/pol_authorize"
+
+# User Policies
+POLICY_USER="pol_user.json"
+PATH_POL_USER="/policy/pol_user"
+POLICY_TO_BE_SIGNED_USER="pol_to_be_signed_user.json"
+POLICY_AUTHORIZED_USER="pol_authorized_user.json"
+PATH_POL_AUTHORIZED_USER="/policy/pol_authorized_user"
+
+# Offline Delegation Policy
+POLICY_OFFLINE_DELEGATION="pol_offline_delegation.json"
+PATH_POL_OFFLINE_DELEGATION="/policy/pol_offline_delegation"
+POLICY_TO_BE_SIGNED_OFFLINE_DELEGATION="pol_to_be_signed_offline_delegation.json"
+POLICY_AUTHORIZED_OFFLINE_DELEGATION="pol_authorized_offline_delegation.json"
+PATH_POL_AUTHORIZED_OFFLINE_DELEGATION="/policy/pol_authorized_offline_delegation"
+
+# Sub Policy
+POLICY_SUB_POLICY="pol_sub_policy.json"
+PATH_POL_SUB_POLICY="/policy/pol_sub_policy"
+POLICY_TO_BE_SIGNED_SUB_POLICY="pol_to_be_signed_sub_policy.json"
+POLICY_AUTHORIZED_SUB_POLICY="pol_authorized_sub_policy.json"
+PATH_POL_AUTHORIZED_SUB_POLICY="/policy/pol_authorized_sub_policy"
+
+# Data for Authorization
+TEST_SIGNATURE_FILE=$TEMP_DIR/test_signature.file
+OUTPUT_FILE=$TEMP_DIR/data2sign.file
+SIGNATURE_FILE=$TEMP_DIR/signature.file
+
+search_string="\"policy\":"
+
+LOG_FILE=$TEMP_DIR/log.file
+touch $LOG_FILE
+
+EMPTY_FILE=$TEMP_DIR/empty.file
+BIG_FILE=$TEMP_DIR/big_file.file
+
+# 0. Create Keys
+
+openssl ecparam -name secp256r1 -genkey -noout -out $TEMP_DIR/key_backend_priv.pem
+openssl ec -in $TEMP_DIR/key_backend_priv.pem -pubout -out $TEMP_DIR/key_backend_pub.pem
+
+openssl ecparam -name secp256r1 -genkey -noout -out $TEMP_DIR/key_user_priv.pem
+openssl ec -in $TEMP_DIR/key_user_priv.pem -pubout -out $TEMP_DIR/key_user_pub.pem
+
+openssl ecparam -name secp256r1 -genkey -noout -out $TEMP_DIR/key_delegated_priv.pem
+openssl ec -in $TEMP_DIR/key_delegated_priv.pem -pubout -out $TEMP_DIR/key_delegated_pub.pem
+
+# 1. Create necessary policy templates
+
+## Backend Authorization Policy
+cat <<EOF > $TEMP_DIR/$POLICY_AUTH_BACKEND_PEM
+{
+    "description":"Initial Authorization Policy",
+    "policy":
+        {
+            "type": "POLICYAUTHORIZE",
+            "policyRef":  0, 2, 3, 4, 5 ,
+            "keyPEM": "`cat $TEMP_DIR/key_backend_pub.pem`"
+        }
+    
+}
+EOF
+
+# USER POLICY
+cat <<EOF > $TEMP_DIR/$POLICY_USER
+{
+  "description": "User Policy",
+  "policy": 
+    {
+      "type": "NV",
+      "nvPath": "`echo $PATH_REVOCATION`",
+      "operandB": "0000000000000002",
+      "operation": "neq"
+    },
+    {
+      "type": "CounterTimer",
+      "operandB": "5000",
+      "operation": "signed_lt"
+    },
+    {
+      "type": "Signed",
+      "keyPEM": "`cat $TEMP_DIR/key_user_pub.pem`",
+      "keyPEMhashAlg": "SHA256"
+    }
+  
+}
+EOF
+
+## Offline Delegation Policy
+cat <<EOF > $TEMP_DIR/$POLICY_OFFLINE_DELEGATION
+{
+    "description":"Offline Delegation",
+    "policy":
+        {
+            "type": "POLICYAUTHORIZE",
+            "policyRef":  5, 2, 3, 4, 5 ,
+            "keyPEM": "`cat $TEMP_DIR/key_user_pub.pem`"
+        },
+        {
+          "type": "NV",
+          "nvPath": "`echo $PATH_REVOCATION`",
+          "operandB": "0000000000000002",
+          "operation": "neq"
+        }
+    
+}
+EOF
+
+## SUB POLICY (will be signed by user)
+cat <<EOF > $TEMP_DIR/$POLICY_SUB_POLICY
+{
+  "description": "Sub Policy",
+  "policy": 
+    {
+      "type": "CounterTimer",
+      "operandB": "5000",
+      "operation": "signed_lt"
+    },
+    {
+      "type": "Signed",
+      "keyPEM": "`cat $TEMP_DIR/key_delegated_pub.pem`",
+      "keyPEMhashAlg": "SHA256"
+    }
+  
+}
+EOF
+
+
+
+# 2. Create Setting
+tss2 provision
+
+## Create feature key with authorize policy
+tss2 import --path $PATH_POL_AUTHORIZE --importData $TEMP_DIR/$POLICY_AUTH_BACKEND_PEM
+tss2 createkey --path $PATH_FEATURE_KEY_SIGN --type="sign, noda, 0x81000002" --policyPath $PATH_POL_AUTHORIZE --authValue ""
+
+## Create revocation counter
+tss2 createnv --path $PATH_REVOCATION --type=counter --authValue ""
+tss2 nvincrement --nvPath $PATH_REVOCATION
+
+# 3. Backend creates User Policy and Offline Delegation Policy
+## 3.1 Get digests of policies and sign for authorization
+
+### Sign digest of User Policy with key_backend_priv
+tss2 import --path $PATH_POL_USER --importData $TEMP_DIR/$POLICY_USER
+tss2 createkey --path HS/SRK/tmpkey --policyPath $PATH_POL_USER --type="sign, noda" --authValue ""
+tss2 exportpolicy --path HS/SRK/tmpkey --jsonPolicy $TEMP_DIR/$POLICY_TO_BE_SIGNED_USER -f
+tss2 delete --path HS/SRK/tmpkey
+tss2 delete --path $PATH_POL_USER
+
+digest_user=`cat $TEMP_DIR/$POLICY_TO_BE_SIGNED_USER | jsonValue "digest" 1` 
+digest_user="$digest_user""0002030405"
+
+echo -n $digest_user | \
+    xxd -r -p | openssl dgst -sha256 -sign $TEMP_DIR/key_backend_priv.pem -hex | \
+    sed 's/^.* //' > signed_user_policy.sig
+
+### Sign digest of Offline Delegation Policy with key_backend_priv
+tss2 import --path $PATH_POL_OFFLINE_DELEGATION --importData $TEMP_DIR/$POLICY_OFFLINE_DELEGATION
+tss2 createkey --path HS/SRK/tmpkey --policyPath $PATH_POL_OFFLINE_DELEGATION --type="sign, noda" --authValue ""
+tss2 exportpolicy --path HS/SRK/tmpkey --jsonPolicy $TEMP_DIR/$POLICY_TO_BE_SIGNED_OFFLINE_DELEGATION -f
+tss2 delete --path HS/SRK/tmpkey
+tss2 delete --path $PATH_POL_OFFLINE_DELEGATION
+
+digest_offline_delegation=`cat $TEMP_DIR/$POLICY_TO_BE_SIGNED_OFFLINE_DELEGATION | jsonValue "digest" 1` 
+digest_offline_delegation="$digest_offline_delegation""0002030405"
+
+echo -n $digest_offline_delegation | \
+    xxd -r -p | openssl dgst -sha256 -sign $TEMP_DIR/key_backend_priv.pem -hex | \
+    sed 's/^.* //' > signed_policy_offline_delegation.sig
+
+### Sign digest of Sub Policy with key_user_priv
+tss2 import --path $PATH_POL_SUB_POLICY --importData $TEMP_DIR/$POLICY_SUB_POLICY
+tss2 createkey --path HS/SRK/tmpkey --policyPath $PATH_POL_SUB_POLICY --type="sign, noda" --authValue ""
+tss2 exportpolicy --path HS/SRK/tmpkey --jsonPolicy $TEMP_DIR/$POLICY_TO_BE_SIGNED_SUB_POLICY -f
+tss2 delete --path HS/SRK/tmpkey
+tss2 delete --path $PATH_POL_SUB_POLICY
+
+digest_sub_policy=`cat $TEMP_DIR/$POLICY_TO_BE_SIGNED_SUB_POLICY | jsonValue "digest" 1` 
+digest_sub_policy="$digest_sub_policy""0502030405"
+
+echo -n $digest_sub_policy | \
+    xxd -r -p | openssl dgst -sha256 -sign $TEMP_DIR/key_user_priv.pem -hex | \
+    sed 's/^.* //' > signed_policy_sub_policy.sig
+
+
+## 3.2 Create Authorized Policies from Template
+
+### Create Authorized User Policy
+POLICY_AUTH_TEMPLATE_USER=$(cat <<EOF
+    "policyAuthorizations":
+        {
+            "type": "pem",
+            "policyRef":  0, 2, 3, 4, 5 ,
+            "key": "`cat $TEMP_DIR/key_backend_pub.pem`",
+            "signature": "`cat signed_user_policy.sig`"
+        }
+    ,
+EOF
+)
+
+AUTHORIZED_POLICY_TMP=""
+while read line; do
+    # reading each line
+    if  $search_string == $line ; then
+        AUTHORIZED_POLICY_TMP="$AUTHORIZED_POLICY_TMP"$'\n'"$POLICY_AUTH_TEMPLATE_USER"
+    fi
+    AUTHORIZED_POLICY_TMP="$AUTHORIZED_POLICY_TMP"$'\n'"$line"
+done < $TEMP_DIR/$POLICY_TO_BE_SIGNED_USER
+AUTHORIZED_POLICY_TMP="$AUTHORIZED_POLICY_TMP"$'\n'"}"
+
+echo "$AUTHORIZED_POLICY_TMP" > $TEMP_DIR/$POLICY_AUTHORIZED_USER
+
+
+### Create Offline Delegation und Sub Policy
+
+POLICY_AUTH_TEMPLATE_OFFLINE_DELEGATION=$(cat <<EOF
+    "policyAuthorizations":
+        {
+            "type": "pem",
+            "policyRef":  0, 2, 3, 4, 5 ,
+            "key": "`cat $TEMP_DIR/key_backend_pub.pem`",
+            "signature": "`cat signed_policy_offline_delegation.sig`"
+        }
+    ,
+EOF
+)
+
+CONCATENATED_POLICY=""
+while read line; do
+    # reading each line
+    if  $search_string == $line ; then
+        CONCATENATED_POLICY="$CONCATENATED_POLICY"$'\n'"$POLICY_AUTH_TEMPLATE_OFFLINE_DELEGATION"
+    fi
+    CONCATENATED_POLICY="$CONCATENATED_POLICY"$'\n'"$line"
+done < $TEMP_DIR/$POLICY_TO_BE_SIGNED_OFFLINE_DELEGATION
+CONCATENATED_POLICY="$CONCATENATED_POLICY"$'\n'"}"
+
+echo "$CONCATENATED_POLICY" > $TEMP_DIR/$POLICY_AUTHORIZED_OFFLINE_DELEGATION
+
+POLICY_AUTH_TEMPLATE_SUB_POLICY=$(cat <<EOF
+    "policyAuthorizations":
+        {
+            "type": "pem",
+            "policyRef":  5, 2, 3, 4, 5 ,
+            "key": "`cat $TEMP_DIR/key_user_pub.pem`",
+            "signature": "`cat signed_policy_sub_policy.sig`"
+        }
+    ,
+EOF
+)
+
+CONCATENATED_POLICY=""
+while read line; do
+    # reading each line
+    if  $search_string == $line ; then
+        CONCATENATED_POLICY="$CONCATENATED_POLICY"$'\n'"$POLICY_AUTH_TEMPLATE_SUB_POLICY"
+    fi
+    CONCATENATED_POLICY="$CONCATENATED_POLICY"$'\n'"$line"
+done < $TEMP_DIR/$POLICY_TO_BE_SIGNED_SUB_POLICY
+CONCATENATED_POLICY="$CONCATENATED_POLICY"$'\n'"}"
+
+echo "$CONCATENATED_POLICY" > $TEMP_DIR/$POLICY_AUTHORIZED_SUB_POLICY
+
+## 4. Authorize with authorized policies
+
+### Create some digest data to sign
+DIGEST_FILE=$TEMP_DIR/digest.file
+echo -n 01234567890123456789 > $DIGEST_FILE
+
+### Import the authorized policies
+tss2 import --path $PATH_POL_AUTHORIZED_USER --importData $TEMP_DIR/$POLICY_AUTHORIZED_USER
+tss2 import --path $PATH_POL_AUTHORIZED_OFFLINE_DELEGATION --importData $TEMP_DIR/$POLICY_AUTHORIZED_OFFLINE_DELEGATION
+tss2 import --path $PATH_POL_AUTHORIZED_SUB_POLICY --importData $TEMP_DIR/$POLICY_AUTHORIZED_SUB_POLICY
+
+## 4.1 User authorizes key usage with the user policy
+echo "1. User authorizes key usage with the user policy"
+
+expect -c "
+  spawn tss2 sign --keyPath=$PATH_FEATURE_KEY_SIGN --digest=$DIGEST_FILE --signature=$TEST_SIGNATURE_FILE -f
+  expect -re \"Select a branch for P_RSA2048SHA256/HS/SRK/signkey .* Your choice:\" {
+    set branches split \$expect_out(buffer) \"\n\"
+    set lstSize llength \$branches
+    set index 0
+    foreach branch \$branches {
+      if {regexp -nocase \"/policy/pol_authorized_user\" \$branch} {
+        send \"\$index\r\"
+        break
+      }
+      incr index
+    }
+    if {\$index >= \$lstSize} {
+      send_user \"\nError: Branch @ index \$index not found\n\"
+      exit 1
+    }
+    expect \"Filename for nonce output: \" {
+      send \"$OUTPUT_FILE\r\"
+      expect \"Filename for signature input: \" {
+        exec openssl dgst -sha256 -sign $TEMP_DIR/key_user_priv.pem -out $SIGNATURE_FILE $OUTPUT_FILE
+        send \"$SIGNATURE_FILE\r\"
+        send_user \"\n\"
+      }
+    }
+    set ret wait
+    if {lindex \$ret 2 || lindex \$ret 3 != 0} {
+        send_user \"\nlindex \$ret\n\"
+        send_user \"Command failed\n\"
+        exit 1
+    }
+  }
+"
+
+## 4.2 Delegated User authorizes key usage with the offline delegation policy
+echo "2. Delegated User authorizes key usage with the offline delegation policy"
+
+expect -c "
+    spawn tss2 sign --keyPath=$PATH_FEATURE_KEY_SIGN --digest=$DIGEST_FILE --signature=$TEST_SIGNATURE_FILE -f
+    expect -re \"Select a branch for P_RSA2048SHA256/HS/SRK/signkey .* Your choice:\" {
+      set branches split \$expect_out(buffer) \"\n\"
+      set lstSize llength \$branches
+      set index 0
+      foreach branch \$branches {
+        if {regexp -nocase \"/policy/pol_authorized_offline_delegation\" \$branch} {
+          send \"\$index\r\"
+          break
+        }
+        incr index
+      }
+      if {\$index >= \$lstSize} {
+        send_user \"\nError: Branch @ index \$index not found\n\"
+        exit 1
+      }
+      expect \"Filename for nonce output: \" {
+          send \"$OUTPUT_FILE\r\"
+          expect \"Filename for signature input: \" {
+              exec openssl dgst -sha256 -sign $TEMP_DIR/key_delegated_priv.pem -out $SIGNATURE_FILE $OUTPUT_FILE
+              send \"$SIGNATURE_FILE\r\"
+              send_user \"\n\"
+          }
+      }
+      set ret wait
+      if {lindex \$ret 2 || lindex \$ret 3 != 0} {
+          send_user \"\nlindex \$ret\n\"
+          send_user \"Command failed 2\n\"
+          exit 1
+      }
+  }
+"
+
+exit 0
\ No newline at end of file

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-policy_signed_delegation_ecc.sh Added

@@ -0,0 +1,394 @@
+# In this test a backend issues two policies to a user "A":
+#   1. A user policy that allows "A" to authorize key usage
+#   2. An offline delegation policy that allows "A" to delegate his access rights
+#      two user "B" without further interaction with the backend. 
+
+# set -e
+source helpers.sh
+
+start_up
+
+CRYPTO_PROFILE="ECC"
+setup_fapi $CRYPTO_PROFILE
+
+# Extract value from JSON file
+function jsonValue {
+    KEY=$1
+    num=$2
+    awk -F",:}" '{for(i=1;i<=NF;i++){if($i~/'$KEY'\042/){print $(i+1)}}}' | tr -d '"' | sed -n ${num}p
+}
+
+function cleanup {
+    # In case the test is skipped, no key is created and a
+    # failure is expected here. Therefore, we need to pass a successful
+    # execution in any case
+    tss2 delete --path=/ && true
+    shut_down
+}
+
+trap cleanup EXIT
+
+# The delegation test needs at least the commit
+# b843960b6e601a786b469832392dc0a12e13cf34 of TSS to be executed successfully.
+# This commit will be introduced in version > 3.0.3. Will skip the test if
+# version is below.
+if  "$(echo $TSS_VERSION | sed 's/^0-9*//g')" -le "303" && "$TSS_VERSION" != "master" ; then
+    echo "TSS version does not support test"
+    exit 077
+fi
+
+PATH_REVOCATION="/nv/Owner/ctr"
+PATH_FEATURE_KEY_SIGN="HS/SRK/signkey"
+
+# Backend Policies
+POLICY_AUTH_BACKEND_PEM="pol_authorize_backend_pem.json"
+PATH_POL_AUTHORIZE="/policy/pol_authorize"
+
+# User Policies
+POLICY_USER="pol_user.json"
+PATH_POL_USER="/policy/pol_user"
+POLICY_TO_BE_SIGNED_USER="pol_to_be_signed_user.json"
+POLICY_AUTHORIZED_USER="pol_authorized_user.json"
+PATH_POL_AUTHORIZED_USER="/policy/pol_authorized_user"
+
+# Offline Delegation Policy
+POLICY_OFFLINE_DELEGATION="pol_offline_delegation.json"
+PATH_POL_OFFLINE_DELEGATION="/policy/pol_offline_delegation"
+POLICY_TO_BE_SIGNED_OFFLINE_DELEGATION="pol_to_be_signed_offline_delegation.json"
+POLICY_AUTHORIZED_OFFLINE_DELEGATION="pol_authorized_offline_delegation.json"
+PATH_POL_AUTHORIZED_OFFLINE_DELEGATION="/policy/pol_authorized_offline_delegation"
+
+# Sub Policy
+POLICY_SUB_POLICY="pol_sub_policy.json"
+PATH_POL_SUB_POLICY="/policy/pol_sub_policy"
+POLICY_TO_BE_SIGNED_SUB_POLICY="pol_to_be_signed_sub_policy.json"
+POLICY_AUTHORIZED_SUB_POLICY="pol_authorized_sub_policy.json"
+PATH_POL_AUTHORIZED_SUB_POLICY="/policy/pol_authorized_sub_policy"
+
+# Data for Authorization
+TEST_SIGNATURE_FILE=$TEMP_DIR/test_signature.file
+OUTPUT_FILE=$TEMP_DIR/data2sign.file
+SIGNATURE_FILE=$TEMP_DIR/signature.file
+
+search_string="\"policy\":"
+
+LOG_FILE=$TEMP_DIR/log.file
+touch $LOG_FILE
+
+EMPTY_FILE=$TEMP_DIR/empty.file
+BIG_FILE=$TEMP_DIR/big_file.file
+
+# 0. Create Keys
+
+openssl ecparam -name secp256r1 -genkey -noout -out $TEMP_DIR/key_backend_priv.pem
+openssl ec -in $TEMP_DIR/key_backend_priv.pem -pubout -out $TEMP_DIR/key_backend_pub.pem
+
+openssl ecparam -name secp256r1 -genkey -noout -out $TEMP_DIR/key_user_priv.pem
+openssl ec -in $TEMP_DIR/key_user_priv.pem -pubout -out $TEMP_DIR/key_user_pub.pem
+
+openssl ecparam -name secp256r1 -genkey -noout -out $TEMP_DIR/key_delegated_priv.pem
+openssl ec -in $TEMP_DIR/key_delegated_priv.pem -pubout -out $TEMP_DIR/key_delegated_pub.pem
+
+# 1. Create necessary policy templates
+
+## Backend Authorization Policy
+cat <<EOF > $TEMP_DIR/$POLICY_AUTH_BACKEND_PEM
+{
+    "description":"Initial Authorization Policy",
+    "policy":
+        {
+            "type": "POLICYAUTHORIZE",
+            "policyRef":  0, 2, 3, 4, 5 ,
+            "keyPEM": "`cat $TEMP_DIR/key_backend_pub.pem`"
+        }
+    
+}
+EOF
+
+# USER POLICY
+cat <<EOF > $TEMP_DIR/$POLICY_USER
+{
+  "description": "User Policy",
+  "policy": 
+    {
+      "type": "NV",
+      "nvPath": "`echo $PATH_REVOCATION`",
+      "operandB": "0000000000000002",
+      "operation": "neq"
+    },
+    {
+      "type": "CounterTimer",
+      "operandB": "5000",
+      "operation": "signed_lt"
+    },
+    {
+      "type": "Signed",
+      "keyPEM": "`cat $TEMP_DIR/key_user_pub.pem`",
+      "keyPEMhashAlg": "SHA256"
+    }
+  
+}
+EOF
+
+## Offline Delegation Policy
+cat <<EOF > $TEMP_DIR/$POLICY_OFFLINE_DELEGATION
+{
+    "description":"Offline Delegation",
+    "policy":
+        {
+            "type": "POLICYAUTHORIZE",
+            "policyRef":  5, 2, 3, 4, 5 ,
+            "keyPEM": "`cat $TEMP_DIR/key_user_pub.pem`"
+        },
+        {
+          "type": "NV",
+          "nvPath": "`echo $PATH_REVOCATION`",
+          "operandB": "0000000000000002",
+          "operation": "neq"
+        }
+    
+}
+EOF
+
+## SUB POLICY (will be signed by user)
+cat <<EOF > $TEMP_DIR/$POLICY_SUB_POLICY
+{
+  "description": "Sub Policy",
+  "policy": 
+    {
+      "type": "CounterTimer",
+      "operandB": "5000",
+      "operation": "signed_lt"
+    },
+    {
+      "type": "Signed",
+      "keyPEM": "`cat $TEMP_DIR/key_delegated_pub.pem`",
+      "keyPEMhashAlg": "SHA256"
+    }
+  
+}
+EOF
+
+
+
+# 2. Create Setting
+tss2 provision
+
+## Create feature key with authorize policy
+tss2 import --path $PATH_POL_AUTHORIZE --importData $TEMP_DIR/$POLICY_AUTH_BACKEND_PEM
+tss2 createkey --path $PATH_FEATURE_KEY_SIGN --type="sign, noda, 0x81000002" --policyPath $PATH_POL_AUTHORIZE --authValue ""
+
+## Create revocation counter
+tss2 createnv --path $PATH_REVOCATION --type=counter --authValue ""
+tss2 nvincrement --nvPath $PATH_REVOCATION
+
+# 3. Backend creates User Policy and Offline Delegation Policy
+## 3.1 Get digests of policies and sign for authorization
+
+### Sign digest of User Policy with key_backend_priv
+tss2 import --path $PATH_POL_USER --importData $TEMP_DIR/$POLICY_USER
+tss2 createkey --path HS/SRK/tmpkey --policyPath $PATH_POL_USER --type="sign, noda" --authValue ""
+tss2 exportpolicy --path HS/SRK/tmpkey --jsonPolicy $TEMP_DIR/$POLICY_TO_BE_SIGNED_USER -f
+tss2 delete --path HS/SRK/tmpkey
+tss2 delete --path $PATH_POL_USER
+
+digest_user=`cat $TEMP_DIR/$POLICY_TO_BE_SIGNED_USER | jsonValue "digest" 1` 
+digest_user="$digest_user""0002030405"
+
+echo -n $digest_user | \
+    xxd -r -p | openssl dgst -sha256 -sign $TEMP_DIR/key_backend_priv.pem -hex | \
+    sed 's/^.* //' > signed_user_policy.sig
+
+### Sign digest of Offline Delegation Policy with key_backend_priv
+tss2 import --path $PATH_POL_OFFLINE_DELEGATION --importData $TEMP_DIR/$POLICY_OFFLINE_DELEGATION
+tss2 createkey --path HS/SRK/tmpkey --policyPath $PATH_POL_OFFLINE_DELEGATION --type="sign, noda" --authValue ""
+tss2 exportpolicy --path HS/SRK/tmpkey --jsonPolicy $TEMP_DIR/$POLICY_TO_BE_SIGNED_OFFLINE_DELEGATION -f
+tss2 delete --path HS/SRK/tmpkey
+tss2 delete --path $PATH_POL_OFFLINE_DELEGATION
+
+digest_offline_delegation=`cat $TEMP_DIR/$POLICY_TO_BE_SIGNED_OFFLINE_DELEGATION | jsonValue "digest" 1` 
+digest_offline_delegation="$digest_offline_delegation""0002030405"
+
+echo -n $digest_offline_delegation | \
+    xxd -r -p | openssl dgst -sha256 -sign $TEMP_DIR/key_backend_priv.pem -hex | \
+    sed 's/^.* //' > signed_policy_offline_delegation.sig
+
+### Sign digest of Sub Policy with key_user_priv
+tss2 import --path $PATH_POL_SUB_POLICY --importData $TEMP_DIR/$POLICY_SUB_POLICY
+tss2 createkey --path HS/SRK/tmpkey --policyPath $PATH_POL_SUB_POLICY --type="sign, noda" --authValue ""
+tss2 exportpolicy --path HS/SRK/tmpkey --jsonPolicy $TEMP_DIR/$POLICY_TO_BE_SIGNED_SUB_POLICY -f
+tss2 delete --path HS/SRK/tmpkey
+tss2 delete --path $PATH_POL_SUB_POLICY
+
+digest_sub_policy=`cat $TEMP_DIR/$POLICY_TO_BE_SIGNED_SUB_POLICY | jsonValue "digest" 1` 
+digest_sub_policy="$digest_sub_policy""0502030405"
+
+echo -n $digest_sub_policy | \
+    xxd -r -p | openssl dgst -sha256 -sign $TEMP_DIR/key_user_priv.pem -hex | \
+    sed 's/^.* //' > signed_policy_sub_policy.sig
+
+
+## 3.2 Create Authorized Policies from Template
+
+### Create Authorized User Policy
+POLICY_AUTH_TEMPLATE_USER=$(cat <<EOF
+    "policyAuthorizations":
+        {
+            "type": "pem",
+            "policyRef":  0, 2, 3, 4, 5 ,
+            "key": "`cat $TEMP_DIR/key_backend_pub.pem`",
+            "signature": "`cat signed_user_policy.sig`"
+        }
+    ,
+EOF
+)
+
+AUTHORIZED_POLICY_TMP=""
+while read line; do
+    # reading each line
+    if  $search_string == $line ; then
+        AUTHORIZED_POLICY_TMP="$AUTHORIZED_POLICY_TMP"$'\n'"$POLICY_AUTH_TEMPLATE_USER"
+    fi
+    AUTHORIZED_POLICY_TMP="$AUTHORIZED_POLICY_TMP"$'\n'"$line"
+done < $TEMP_DIR/$POLICY_TO_BE_SIGNED_USER
+AUTHORIZED_POLICY_TMP="$AUTHORIZED_POLICY_TMP"$'\n'"}"
+
+echo "$AUTHORIZED_POLICY_TMP" > $TEMP_DIR/$POLICY_AUTHORIZED_USER
+
+
+### Create Offline Delegation und Sub Policy
+
+POLICY_AUTH_TEMPLATE_OFFLINE_DELEGATION=$(cat <<EOF
+    "policyAuthorizations":
+        {
+            "type": "pem",
+            "policyRef":  0, 2, 3, 4, 5 ,
+            "key": "`cat $TEMP_DIR/key_backend_pub.pem`",
+            "signature": "`cat signed_policy_offline_delegation.sig`"
+        }
+    ,
+EOF
+)
+
+CONCATENATED_POLICY=""
+while read line; do
+    # reading each line
+    if  $search_string == $line ; then
+        CONCATENATED_POLICY="$CONCATENATED_POLICY"$'\n'"$POLICY_AUTH_TEMPLATE_OFFLINE_DELEGATION"
+    fi
+    CONCATENATED_POLICY="$CONCATENATED_POLICY"$'\n'"$line"
+done < $TEMP_DIR/$POLICY_TO_BE_SIGNED_OFFLINE_DELEGATION
+CONCATENATED_POLICY="$CONCATENATED_POLICY"$'\n'"}"
+
+echo "$CONCATENATED_POLICY" > $TEMP_DIR/$POLICY_AUTHORIZED_OFFLINE_DELEGATION
+
+POLICY_AUTH_TEMPLATE_SUB_POLICY=$(cat <<EOF
+    "policyAuthorizations":
+        {
+            "type": "pem",
+            "policyRef":  5, 2, 3, 4, 5 ,
+            "key": "`cat $TEMP_DIR/key_user_pub.pem`",
+            "signature": "`cat signed_policy_sub_policy.sig`"
+        }
+    ,
+EOF
+)
+
+CONCATENATED_POLICY=""
+while read line; do
+    # reading each line
+    if  $search_string == $line ; then
+        CONCATENATED_POLICY="$CONCATENATED_POLICY"$'\n'"$POLICY_AUTH_TEMPLATE_SUB_POLICY"
+    fi
+    CONCATENATED_POLICY="$CONCATENATED_POLICY"$'\n'"$line"
+done < $TEMP_DIR/$POLICY_TO_BE_SIGNED_SUB_POLICY
+CONCATENATED_POLICY="$CONCATENATED_POLICY"$'\n'"}"
+
+echo "$CONCATENATED_POLICY" > $TEMP_DIR/$POLICY_AUTHORIZED_SUB_POLICY
+
+## 4. Authorize with authorized policies
+
+### Create some digest data to sign
+DIGEST_FILE=$TEMP_DIR/digest.file
+echo -n 01234567890123456789 > $DIGEST_FILE
+
+### Import the authorized policies
+tss2 import --path $PATH_POL_AUTHORIZED_USER --importData $TEMP_DIR/$POLICY_AUTHORIZED_USER
+tss2 import --path $PATH_POL_AUTHORIZED_OFFLINE_DELEGATION --importData $TEMP_DIR/$POLICY_AUTHORIZED_OFFLINE_DELEGATION
+tss2 import --path $PATH_POL_AUTHORIZED_SUB_POLICY --importData $TEMP_DIR/$POLICY_AUTHORIZED_SUB_POLICY
+
+## 4.1 User authorizes key usage with the user policy
+echo "1. User authorizes key usage with the user policy"
+
+expect -c "
+  spawn tss2 sign --keyPath=$PATH_FEATURE_KEY_SIGN --digest=$DIGEST_FILE --signature=$TEST_SIGNATURE_FILE -f
+  expect -re \"Select a branch for P_RSA2048SHA256/HS/SRK/signkey .* Your choice:\" {
+    set branches split \$expect_out(buffer) \"\n\"
+    set lstSize llength \$branches
+    set index 0
+    foreach branch \$branches {
+      if {regexp -nocase \"/policy/pol_authorized_user\" \$branch} {
+        send \"\$index\r\"
+        break
+      }
+      incr index
+    }
+    if {\$index >= \$lstSize} {
+      send_user \"\nError: Branch @ index \$index not found\n\"
+      exit 1
+    }
+    expect \"Filename for nonce output: \" {
+      send \"$OUTPUT_FILE\r\"
+      expect \"Filename for signature input: \" {
+        exec openssl dgst -sha256 -sign $TEMP_DIR/key_user_priv.pem -out $SIGNATURE_FILE $OUTPUT_FILE
+        send \"$SIGNATURE_FILE\r\"
+        send_user \"\n\"
+      }
+    }
+    set ret wait
+    if {lindex \$ret 2 || lindex \$ret 3 != 0} {
+        send_user \"\nlindex \$ret\n\"
+        send_user \"Command failed\n\"
+        exit 1
+    }
+  }
+"
+
+## 4.2 Delegated User authorizes key usage with the offline delegation policy
+echo "2. Delegated User authorizes key usage with the offline delegation policy"
+
+expect -c "
+    spawn tss2 sign --keyPath=$PATH_FEATURE_KEY_SIGN --digest=$DIGEST_FILE --signature=$TEST_SIGNATURE_FILE -f
+    expect -re \"Select a branch for P_RSA2048SHA256/HS/SRK/signkey .* Your choice:\" {
+      set branches split \$expect_out(buffer) \"\n\"
+      set lstSize llength \$branches
+      set index 0
+      foreach branch \$branches {
+        if {regexp -nocase \"/policy/pol_authorized_offline_delegation\" \$branch} {
+          send \"\$index\r\"
+          break
+        }
+        incr index
+      }
+      if {\$index >= \$lstSize} {
+        send_user \"\nError: Branch @ index \$index not found\n\"
+        exit 1
+      }
+      expect \"Filename for nonce output: \" {
+          send \"$OUTPUT_FILE\r\"
+          expect \"Filename for signature input: \" {
+              exec openssl dgst -sha256 -sign $TEMP_DIR/key_delegated_priv.pem -out $SIGNATURE_FILE $OUTPUT_FILE
+              send \"$SIGNATURE_FILE\r\"
+              send_user \"\n\"
+          }
+      }
+      set ret wait
+      if {lindex \$ret 2 || lindex \$ret 3 != 0} {
+          send_user \"\nlindex \$ret\n\"
+          send_user \"Command failed 2\n\"
+          exit 1
+      }
+  }
+"
+
+exit 0
\ No newline at end of file

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-policy_signed_ecc.sh Added

@@ -0,0 +1,204 @@
+
+# set -e
+source helpers.sh
+
+start_up
+
+CRYPTO_PROFILE="ECC"
+setup_fapi $CRYPTO_PROFILE
+
+function cleanup {
+    tss2 delete --path=/
+    shut_down
+}
+
+trap cleanup EXIT
+
+# openssl ecparam -name secp256r1 -genkey -noout -out key_priv.pem
+# openssl ec -in key_priv.pem -pubout -out key_pub.pem
+
+# -----BEGIN PUBLIC KEY-----
+# MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAw+PKFksCw+ikD76l6BMeXfebcZx
+# Gf8QGWT2MOy8tOfpe6m+6MUUm2GUijGPkvCTjtJPOJz//XMom+k+7OaWmA==
+# -----END PUBLIC KEY-----
+
+# -----BEGIN EC PRIVATE KEY-----
+# MHcCAQEEICf0OXKKsPkEVR1jsPOKSQQJnJVimamLYwLDZwJDj7etoAoGCCqGSM49
+# AwEHoUQDQgAEAw+PKFksCw+ikD76l6BMeXfebcZxGf8QGWT2MOy8tOfpe6m+6MUU
+# m2GUijGPkvCTjtJPOJz//XMom+k+7OaWmA==
+# -----END EC PRIVATE KEY-----
+
+
+KEY_PATH_1=HS/SRK/mySignKey1
+KEY_PATH_2=HS/SRK/mySignKey2
+SIGN_POLICY_DATA=pol_signed.json
+SIGN_POLICY_DATA_KEY_HINT=pol_signed_key_hint.json
+POLICY_SIGNED=policy/policy-signed
+POLICY_SIGNED_KEY_HINT=policy/policy-signed_key_hint
+TEST_SIGNATURE_FILE=test_signature.file
+SIGNATURE_FILE=signature.file
+DIGEST_FILE=digest.file
+PRIV_KEY_FILE=priv_key.file
+
+LOG_FILE=$TEMP_DIR/log.file
+touch $LOG_FILE
+
+EMPTY_FILE=$TEMP_DIR/empty.file
+BIG_FILE=$TEMP_DIR/big_file.file
+
+# Setup Policy Signed
+cat > $SIGN_POLICY_DATA_KEY_HINT <<EOF
+{
+    "description":"Description pol_signed",
+    "policy":
+        {
+            "type": "POLICYSIGNED",
+            "keyPEM": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAw+PKFksCw+ikD76l6BMeXfebcZx\nGf8QGWT2MOy8tOfpe6m+6MUUm2GUijGPkvCTjtJPOJz//XMom+k+7OaWmA==\n-----END PUBLIC KEY-----",
+            "keyPEMhashAlg": "SHA1",
+            "publicKeyHint": "My Signature Key"
+        }
+    
+}
+EOF
+
+cat > $SIGN_POLICY_DATA <<EOF
+{
+    "description":"Description pol_signed",
+    "policy":
+        {
+            "type": "POLICYSIGNED",
+            "keyPEM": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAw+PKFksCw+ikD76l6BMeXfebcZx\nGf8QGWT2MOy8tOfpe6m+6MUUm2GUijGPkvCTjtJPOJz//XMom+k+7OaWmA==\n-----END PUBLIC KEY-----",
+            "keyPEMhashAlg": "SHA1",
+        }
+    
+}
+EOF
+
+# Write private pem key to file
+cat > $PRIV_KEY_FILE <<EOF
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEICf0OXKKsPkEVR1jsPOKSQQJnJVimamLYwLDZwJDj7etoAoGCCqGSM49
+AwEHoUQDQgAEAw+PKFksCw+ikD76l6BMeXfebcZxGf8QGWT2MOy8tOfpe6m+6MUU
+m2GUijGPkvCTjtJPOJz//XMom+k+7OaWmA==
+-----END EC PRIVATE KEY-----
+EOF
+
+echo -n 01234567890123456789 > $DIGEST_FILE
+
+tss2 provision
+
+tss2 import --path=$POLICY_SIGNED --importData=$SIGN_POLICY_DATA
+
+tss2 import --path=$POLICY_SIGNED_KEY_HINT --importData=$SIGN_POLICY_DATA_KEY_HINT
+
+tss2 createkey --path $KEY_PATH_1 --type="sign, noda" \
+  --policyPath $POLICY_SIGNED --authValue ""
+
+tss2 createkey --path $KEY_PATH_2 --type="sign, noda" \
+  --policyPath $POLICY_SIGNED_KEY_HINT --authValue ""
+
+OUTPUT_FILE=$TEMP_DIR/data2sign.file
+
+expect <<EOF
+    spawn sh -c "tss2 sign --keyPath=$KEY_PATH_1 --digest=$DIGEST_FILE --signature=$TEST_SIGNATURE_FILE --force 2> $LOG_FILE"
+    expect "Filename for nonce output: " {
+        send "$OUTPUT_FILE\r"
+        expect "Filename for signature input: " {
+            exec openssl dgst -sha1 -sign $PRIV_KEY_FILE -out $SIGNATURE_FILE $OUTPUT_FILE
+            send "$SIGNATURE_FILE\r"
+            exp_continue
+        }
+    }
+EOF
+
+if grep "ERROR" $LOG_FILE > /dev/null
+then
+  cat $LOG_FILE
+  exit 1
+fi
+
+expect <<EOF
+    spawn sh -c "tss2 sign --keyPath=$KEY_PATH_2 --digest=$DIGEST_FILE --signature=$TEST_SIGNATURE_FILE --force 2> $LOG_FILE"
+    expect "Filename for nonce output: " {
+        send "$OUTPUT_FILE\r"
+        expect "Filename for signature input: " {
+            exec openssl dgst -sha1 -sign $PRIV_KEY_FILE -out $SIGNATURE_FILE $OUTPUT_FILE
+            send "$SIGNATURE_FILE\r"
+            exp_continue
+        }
+    }
+EOF
+
+if grep "ERROR" $LOG_FILE > /dev/null
+then
+  cat $LOG_FILE
+  exit 1
+fi
+
+echo "sign callback with BIG_FILE" # Expected to fail
+expect <<EOF
+    spawn sh -c "tss2 sign --keyPath=$KEY_PATH_1 --digest=$DIGEST_FILE --signature=$TEST_SIGNATURE_FILE --force 2> $LOG_FILE"
+    expect "Filename for nonce output: " {
+        send "$OUTPUT_FILE\r"
+        expect "Filename for signature input: " {
+            exec openssl dgst -sha1 -sign $PRIV_KEY_FILE -out $SIGNATURE_FILE $OUTPUT_FILE
+            send "$BIG_FILE\r"
+            set ret wait
+            if {lindex \$ret 2 || lindex \$ret 3 == 0} {
+                send_user "\nlindex \$ret\n"
+                send_user "Command not failed as expected\n"
+                exit 1
+            }
+        }
+        set ret wait
+        if {lindex \$ret 2 || lindex \$ret 3 == 0} {
+            set file open $LOG_FILE r
+            set log read \$file
+            close $file
+            send_user "\nlindex \$ret\n"
+            send_user "Command has not failed as expected\n"
+            exit 1
+        }
+    }          
+EOF
+
+if  "`cat $LOG_FILE`" == $SANITIZER_FILTER ; then
+  echo "Error: AddressSanitizer triggered."
+  cat $LOG_FILE
+  exit 1
+fi
+
+echo "sign callback with EMPTY_FILE" # Expected to fail
+expect <<EOF  
+    spawn sh -c "tss2 sign --keyPath=$KEY_PATH_1 --digest=$DIGEST_FILE --signature=$TEST_SIGNATURE_FILE --force 2> $LOG_FILE"
+    expect "Filename for nonce output: " {
+        send "$OUTPUT_FILE\r"
+        expect "Filename for signature input: " {
+            exec openssl dgst -sha1 -sign $PRIV_KEY_FILE -out $SIGNATURE_FILE $OUTPUT_FILE
+            send "$EMPTY_FILE\r"
+            set ret wait
+            if {lindex \$ret 2 || lindex \$ret 3 == 0} {
+                send_user "\nlindex \$ret\n"
+                send_user "Command has not failed as expected\n"
+                exit 1
+            }
+        }
+        set ret wait
+        if {lindex \$ret 2 || lindex \$ret 3 == 0} {
+            set file open $LOG_FILE r
+            set log read \$file
+            close $file
+            send_user "\nlindex \$ret\n"
+            send_user "Command has not failed as expected\n"
+            exit 1
+        }
+    }          
+EOF
+
+if  "`cat $LOG_FILE`" == $SANITIZER_FILTER ; then
+  echo "Error: AddressSanitizer triggered."
+  cat $LOG_FILE
+  exit 1
+fi
+
+exit 0
\ No newline at end of file

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/fapi/fapi-provision.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-provision.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/fapi/fapi-provision_ecc.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-provision_ecc.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/fapi/fapi-quote-verify.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-quote-verify.sh Changed

@@ -18,6 +18,7 @@
 NONCE_FILE=$TEMP_DIR/nonce.file
 PUBLIC_QUOTE_KEY=$TEMP_DIR/public_quote.key
 QUOTE_INFO=$TEMP_DIR/quote.info
+QUOTE_EMPTY_INFO=$TEMP_DIR/quote_empty.info
 SIGNATURE_FILE=$TEMP_DIR/signature.file
 CERTIFICATE_FILE=$TEMP_DIR/certificate.file
 PCR_LOG=$TEMP_DIR/pcr.log
@@ -35,18 +36,36 @@
 
 tss2 createkey --path=$KEY_PATH --type="noDa, restricted, sign" --authValue=""
 
-tss2 quote --keyPath=$KEY_PATH --pcrList="16" --qualifyingData=$NONCE_FILE \
+tss2 exportkey --pathOfKeyToDuplicate=$KEY_PATH --exportedData=$PUBLIC_QUOTE_KEY --force
+tss2 import --path="ext/myNewParent" --importData=$PUBLIC_QUOTE_KEY
+
+
+tss2 quote --keyPath=$KEY_PATH --pcrList="11, 12, 13, 14, 15, 16" --qualifyingData=$NONCE_FILE \
     --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG \
     --certificate=$CERTIFICATE_FILE --quoteInfo=$QUOTE_INFO --force
 
+tss2 verifyquote --publicKeyPath="ext/myNewParent" \
+    --qualifyingData=$NONCE_FILE --quoteInfo=$QUOTE_INFO \
+    --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG
+
 echo "tss2 quote with EMPTY_FILE" # Expected to succeed
-tss2 quote --keyPath=$KEY_PATH --pcrList="16" \
+tss2 quote --keyPath=$KEY_PATH --pcrList="11, 12, 13, 14, 15, 16" \
     --qualifyingData=$EMPTY_FILE --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG \
-    --certificate=$CERTIFICATE_FILE --quoteInfo=$QUOTE_INFO --force
+    --certificate=$CERTIFICATE_FILE --quoteInfo=$QUOTE_EMPTY_INFO --force
+
+echo "tss2 verifyquote with EMPTY_FILE qualifyingData" # Expected to succeed
+tss2 verifyquote --publicKeyPath="ext/myNewParent" \
+    --qualifyingData=$EMPTY_FILE --quoteInfo=$QUOTE_EMPTY_INFO \
+    --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG
+
+# Try with missing qualifyingData
+tss2 verifyquote --publicKeyPath="ext/myNewParent" \
+    --quoteInfo=$QUOTE_EMPTY_INFO \
+    --signature=$SIGNATURE_FILE
 
 echo "tss2 quote with BIG_FILE" # Expected to fail
 expect <<EOF
-spawn sh -c "tss2 quote --keyPath=$KEY_PATH --pcrList=\"16\" \
+spawn sh -c "tss2 quote --keyPath=$KEY_PATH --pcrList=\"11, 12, 13, 14, 15, 16\" \
     --qualifyingData=$BIG_FILE --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG \
     --certificate=$CERTIFICATE_FILE --quoteInfo=$QUOTE_INFO --force 2> $LOG_FILE"
 set ret wait
@@ -65,18 +84,6 @@
   exit 1
 fi
 
-tss2 exportkey --pathOfKeyToDuplicate=$KEY_PATH --exportedData=$PUBLIC_QUOTE_KEY --force
-tss2 import --path="ext/myNewParent" --importData=$PUBLIC_QUOTE_KEY
-
-tss2 verifyquote --publicKeyPath="ext/myNewParent" \
-    --qualifyingData=$NONCE_FILE --quoteInfo=$QUOTE_INFO \
-    --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG
-
-echo "tss2 verifyquote with EMPTY_FILE qualifyingData" # Expected to succeed
-tss2 verifyquote --publicKeyPath="ext/myNewParent" \
-    --qualifyingData=$EMPTY_FILE --quoteInfo=$QUOTE_INFO \
-    --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG
-
 echo "tss2 verifyquote with BIG_FILE qualifyingData" # Expected to fail
 expect <<EOF
 spawn sh -c "tss2 verifyquote --publicKeyPath=\"ext/myNewParent\" \
@@ -537,9 +544,4 @@
 }
 EOF
 
-# Try with missing qualifyingData
-tss2 verifyquote --publicKeyPath="ext/myNewParent" \
-    --quoteInfo=$QUOTE_INFO \
-    --signature=$SIGNATURE_FILE
-
 exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/fapi/fapi-quote-verify_ecc.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fapi/fapi-quote-verify_ecc.sh Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-arch-linux.bin Added

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-arch-linux.bin.warn Added

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-arch-linux.bin.yaml Added

@@ -0,0 +1,687 @@
+---
+version: 2
+events:
+- EventNum: 0
+  PCRIndex: 0
+  EventType: EV_NO_ACTION
+  Digest: "0000000000000000000000000000000000000000"
+  EventSize: 37
+  SpecID:
+  - Signature: Spec ID Event03
+    platformClass: 0
+    specVersionMinor: 0
+    specVersionMajor: 2
+    specErrata: 0
+    uintnSize: 2
+    numberOfAlgorithms: 2
+    Algorithms:
+    - Algorithm0:
+      algorithmId: sha1
+      digestSize: 20
+    - Algorithm1:
+      algorithmId: sha256
+      digestSize: 32
+    vendorInfoSize: 0
+- EventNum: 1
+  PCRIndex: 0
+  EventType: EV_S_CRTM_VERSION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "c42fedad268200cb1d15f97841c344e79dae3320"
+  - AlgorithmId: sha256
+    Digest: "d4720b4009438213b803568017f903093f6bea8ab47d283db32b6eabedbbf155"
+  EventSize: 16
+  Event: "1efb6b540c1d5540a4ad4ef4bf17b83a"
+- EventNum: 2
+  PCRIndex: 0
+  EventType: EV_POST_CODE
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "6b4f7011c3028cec0195a595f466515b33a82498"
+  - AlgorithmId: sha256
+    Digest: "cffddf06708f2ccb64b958cdd2a57bba0e2812937b9f7bbfc001780259919219"
+  EventSize: 16
+  Event:
+    BlobBase: 0xffa90000
+    BlobLength: 0x350000
+- EventNum: 3
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "2f20112a3f55398b208e0c42681389b4cb5b1823"
+  - AlgorithmId: sha256
+    Digest: "ce9ce386b52e099f3019e512a0d6062d6b560efe4ff3e5661c7525e2f9c263df"
+  EventSize: 52
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 10
+    VariableDataLength: 0
+    UnicodeName: SecureBoot
+    VariableData:
+      Enabled: 'No'
+- EventNum: 4
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "07c78f14aa2b98367011b004da3184d6a9797bf0"
+  - AlgorithmId: sha256
+    Digest: "5a8857c9b84ba16d96f738d82078d729ddcbbf8f37414988a334b7a6676618af"
+  EventSize: 864
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 2
+    VariableDataLength: 828
+    UnicodeName: PK
+    VariableData:
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 828
+      SignatureHeaderSize: 0
+      SignatureSize: 800
+      Keys:
+      - SignatureOwner: 198bf991-38fd-4ebc-8e31-7bdbebbe0ca0
+        SignatureData: 3082030c308201f4a003020102020900a77b8d32a15982a4300d06092a864886f70d01010b0500301a3118301606035504030c0f4a6f65205269636865792028504b293020170d3138303932333031333135365a180f32313138303833303031333135365a301a3118301606035504030c0f4a6f65205269636865792028504b2930820122300d06092a864886f70d01010105000382010f003082010a0282010100b9515f43871585b1542cf2e1e0accb725d27bbbbf32635a07effe0b4798c01d8e0903d7ee7fff05fdb8f2c8ff74453896c91292104a65d4fd613d50b09465c5891420960cdb0d17bab7278e02161a0091896ca42259d825e3167ae85cbfd2f2245cc42ebbcdb1b40b2e4a26327487d7f0f95a231d9a954ddcbdcce3b6d4fe54ee8ff5f19e0f200c430c236bc9a55d880d3f2e7fe6b0bf09518ec525058a1ecc70fb73f17daf37f082860b3d17fc9a77a087161e0e92015aea5b673d85a144d26289e26ce35fa7bc27f32f0a61030bce4c5d7afc42cdf58c151a54bb50db39b100946317d261391740c7743599f071d2fee75b82c63b723b27c22955fde1664230203010001a3533051301d0603551d0e04160414b8c3f94cf0f6d74d286bde70bcb6d6fc890b1020301f0603551d23041830168014b8c3f94cf0f6d74d286bde70bcb6d6fc890b1020300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010096cc2623f1f6ca83ecc1f97869d4df4277161efa1e2b3b2145907ba4d3ecc08b760be41ebcf122eabb4a49f194bf6b2ec2c282dad751ba3349b6ed852e6b81158721e84965dcc2fa641487008831e02c47388a3a6247b7b6995e4999322a6863eb78f6fd139e1bc6e04106bc179339788f4315cfbbc9f41aef30dd2a8c1b42aca715060bdf9c8af15800778a27ad3ec11ba010c9d355020c0b88fe5720edb8331b7b35c9c2118bf57caf9a83fdd21fcf95a5223149ac4adbc8ad26632361eb0bb72f720733d1fa87acf8515095ae61fa3830616991655fd5d21ec0f8b52f98eaffa83d7b4ea2dd4a2b451df3731e1ab34c09926144c267285422e789d1cb0d8a
+- EventNum: 5
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "52f38b592534395cfdccf805aafccc2cec035d29"
+  - AlgorithmId: sha256
+    Digest: "301c7f60b96d59e0bf4d820032fbccc3fd21069bf45611541cc59be2e69353db"
+  EventSize: 2428
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 3
+    VariableDataLength: 2390
+    UnicodeName: KEK
+    VariableData:
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 830
+      SignatureHeaderSize: 0
+      SignatureSize: 802
+      Keys:
+      - SignatureOwner: 198bf991-38fd-4ebc-8e31-7bdbebbe0ca0
+        SignatureData: 3082030e308201f6a003020102020900be080ebd4704921d300d06092a864886f70d01010b0500301b3119301706035504030c104a6f652052696368657920284b454b293020170d3138303932333031333231395a180f32313138303833303031333231395a301b3119301706035504030c104a6f652052696368657920284b454b2930820122300d06092a864886f70d01010105000382010f003082010a0282010100ab3ca2875cf2d562a5a2516c087df6bd20d4b25bb95df92ad4ff657be317d86c022ce3d2af549cb5bc115bf93f15686be76223f5697dc1034c74bea8500665694d5a5211f10843b5038b61dcf36475cff1f105a9d9604917bccd84f1208aacde8f9dbc5b8a0a3a20127a1cf09b40d9eb9b79435f9142f167e9b505941da232f4dc1e9b3a2b7cfc445f93ef4aa5a544a71e75c34679b400ca8e31fd76a7392e3bceb79b84abe833d9258649ffcb48627754cf7c4e78a8e9fb48dcc57837c082efd89fc561f3befbd362aa774be1fa6e6279434f71ec3d084425d3f81fa4ccc20efdcb3ca7cc78ace20263c4c564450ca1a89a4b8b2deb97de646e3a8f82d0a9a90203010001a3533051301d0603551d0e04160414fb071ef998f896276b07bd4f20294422fc73fc0f301f0603551d23041830168014fb071ef998f896276b07bd4f20294422fc73fc0f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b05000382010100a4d561d9b654a77e0c572f2fcf20f88d9691c3d3342f8d4c5279aee4523838ec215166e938a9f1953609fb70b1b1918703d0c7216a46629052e9ed880359c705ffc16fa6d1aeff3dfcbdfd331979c083f5f97241d0c3cc97a8bad5af62c1d7523f2d6278891ea20afb016fd1b15ab80dbdba0153bcdc2d837c413e0dac7ba38dbb46fbf5d46635392522c2091c31c78feadab66fabb6224f39ce57f6a1d46d1f6d8d34348f7c90d6e94e0df45035aa46901b044cc56c50a44f35dbbceeedb10cc667eda23af36b3de5475659934a22ebbab58515510a2cb483a29dfdc8a1b2ee6440181691570f61dc4bd5ed9230b2b77aaf2eec5138a3387ecf3c0ee34244a1
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 1560
+      SignatureHeaderSize: 0
+      SignatureSize: 1532
+      Keys:
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 308205e8308203d0a003020102020a610ad188000000000003300d06092a864886f70d01010b0500308191310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313b3039060355040313324d6963726f736f667420436f72706f726174696f6e205468697264205061727479204d61726b6574706c61636520526f6f74301e170d3131303632343230343132395a170d3236303632343230353132395a308180310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312a3028060355040313214d6963726f736f667420436f72706f726174696f6e204b454b204341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100c4e8b58abfad5726b026c3eae7fb577a44025d070dda4ae5742ae6b00fec6debec7fb9e35a63327c11174f0ee30ba73815938ec6f5e084b19a9b2ce7f5b791d609e1e2c004a8ac301cdf48f306509a64a7517fc8854f8f2086cefe2fe19fff82c0ede9cdcef4536a623a0b43b9e225fdfe05f9d4c414ab11e223898d70b7a41d4decaee59cfa16c2d7c1cbd4e8c42fe599ee248b03ec8df28beac34afb4311120b7eb547926cdce60489ebf53304eb10012a71e5f983133cff25092f687646ffba4fbedcad712a58aafb0ed2793de49b653bcc292a9ffc7259a2ebae92eff6351380c602ece45fcc9d76cdef6392c1af79408479877fe352a8e89d7b07698f150203010001a382014f3082014b301006092b06010401823715010403020100301d0603551d0e0416041462fc43cda03ea4cb6712d25bd955ac7bccb68a5f301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d2304183016801445665243e17e5811bfd64e9e2355083b3a226aa8305c0603551d1f045530533051a04fa04d864b687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e637274300d06092a864886f70d01010b05000382020100d48488f514941802ca2a3cfb2a921c0cd7a0d1f1e85266a8eea2b5757a9000aa2da4765aea79b7b9376a517b1064f6e164f20267bef7a81b78bdbace8858640cd657c819a35f05d6dbc6d069ce484b32b7eb5dd230f5c0f5b8ba7807a32bfe9bdb345684ec82caae4125709c6be9fe900fd7961fe5e7941fb22a0c8d4bff2829107bf7d77ca5d176b905c879ed0f90929cc2fedf6f7e6c0f7bd4c145dd345196390fe55e56d8180596f407a642b3a077fd0819f27156cc9f8623a487cba6fd587ed4696715917e81f27f13e50d8b8a3c8784ebe3cebd43e5ad2d84938e6a2b5a7c44fa52aa81c82d1cbbe052df0011f89a3dc160b0e133b5a388d165190a1ae7ac7ca4c182874e38b12f0dc514876ffd8d2ebc39b6e7e6c3e0e4cd2784ef9442ef298b9046413b811b67d8f9435965cb0dbcfd00924ff4753ba7a924fc50414079e02d4f0a6a27766e52ed96697baf0ff78705d045c2ad5314811ffb3004aa373661da4a691b34d868edd602cf6c940cd3cf6c2279adb1f0bc03a24660a9c407c22182f1fdf2e8793260bfd8aca522144bcac1d84beb7d3f5735b2e64f75b4b060032253ae91791dd69b411f15865470b2de0d350f7cb03472ba97603bf079eba2b21c5da216b887c5e91bf6b597256f389fe391fa8a7998c3690eb7a31c200597f8ca14ae00d7c4f3c01410756b34a01bb59960f35cb0c5574e36d23284bf9e
+- EventNum: 6
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "e8025df1eca6637d24259be9cdc5c7b921c24dcc"
+  - AlgorithmId: sha256
+    Digest: "db1db3e6f2ee6684e5b5169f52df55526a3f2dc7904edfd3bb3dc3aa94bfdda5"
+  EventSize: 4691
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 2
+    VariableDataLength: 4655
+    UnicodeName: db
+    VariableData:
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 828
+      SignatureHeaderSize: 0
+      SignatureSize: 800
+      Keys:
+      - SignatureOwner: 198bf991-38fd-4ebc-8e31-7bdbebbe0ca0
+        SignatureData: 3082030c308201f4a003020102020900d8bf861a9dc5a6ec300d06092a864886f70d01010b0500301a3118301606035504030c0f4a6f652052696368657920284442293020170d3138303932333031333233315a180f32313138303833303031333233315a301a3118301606035504030c0f4a6f6520526963686579202844422930820122300d06092a864886f70d01010105000382010f003082010a0282010100a04760d90981998b8aea54265d330b1d63b7672d37d27096f47d9666b38181114ca65fa968c0a4513aea62b6c5f03f76067c03f760ab519ab5dfd58d83701138f74aa7e2bfbd5c09a456661b353aa9fa8e0a4e0ece1d7fffeedd619a8c1befe8f853f360ab5e336b891b9f55cfbc831d7b49e889a7980fe55798bf81507c44728d84bba80e4a167340d73f49e3d946dcc58599ea7d3982b5e232c312827e781bcb8d948ec93524832d87a5593373a448a256febfeb76aafc094e27ecfd2e69dc9db2be80dee26d493dfd875ec565a05d591cb8d9f5a44f90144015ddc1b704a816b31346ca92210c49265ef8eb395322be860a9c4d50c0f7225b76b574680c2f0203010001a3533051301d0603551d0e04160414c51e8894342341ccfd3dd8211bf32330d24b5f8d301f0603551d23041830168014c51e8894342341ccfd3dd8211bf32330d24b5f8d300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101002cc1b478114337888466906e1e4553fd40b9ba9310b62fcf51a5113e7afc21cc1208da6e3d7792052d8527ac99b0b99766925f37e9353715e733fef003ce7cfd1520f26383e95349d0b8293a0c7715a88c8312208fa457d463dbee32838af951b5f9bc22bcfe7848ecd8229febe36592a5f74da20740fb110b2d96400ecf4c6c1d88fef59c3f5b2984ee0e18eb9ff0d687f7b08e1a18e3146b6272ab2b1315faa527a475e8a72807f372737749513df3e3b1046113d7d8366ae60494958ddce48ee5346ec193728d7e41fdf563af3fa9eabff9c7a2f3313c8e0653e1c9b097e39ef50f15e7257d22195dc1c30897b2d5914df32cd5e878e64a77122718ec36b1
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 1543
+      SignatureHeaderSize: 0
+      SignatureSize: 1515
+      Keys:
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 308205d7308203bfa003020102020a61077656000000000008300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3131313031393138343134325a170d3236313031393138353134325a308184310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e20504341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100dd0cbba2e42e09e3e7c5f79669bc0021bd693333efad04cb5480ee0683bbc52084d9f7d28bf338b0aba4ad2d7c627905ffe34a3f04352070e3c4e76be09cc03675e98a31dd8d70e5dc37b5744696285b8760232cbfdc47a567f751279e72eb07a6c9b91e3b53357ce5d3ec27b9871cfeb9c923096fa84691c16e963c41d3cba33f5d026a4dec691f25285c36fffd43150a94e019b4cfdfc212e2c25b27ee2778308b5b2a096b22895360162cc0681d53baec49f39d618c85680973445d7da2542bdd79f715cf355d6c1c2b5ccebc9c238b6f6eb526d93613c34fd627aeb9323b41922ce1c7cd77e8aa544ef75c0b048765b44318a8b2e06d1977ec5a24fa48030203010001a38201433082013f301006092b06010401823715010403020100301d0603551d0e04160414a92902398e16c49778cd90f99e4f9ae17c55af53301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014d5f656cb8fe8a25c6268d13d94905bd7ce9a18c430560603551d1f044f304d304ba049a0478645687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f4365724175745f323031302d30362d32332e63726c305a06082b06010505070101044e304c304a06082b06010505073002863e687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f4365724175745f323031302d30362d32332e637274300d06092a864886f70d01010b0500038202010014fc7c7151a579c26eb2ef393ebc3c520f6e2b3f101373fea868d048a6344d8a960526ee3146906179d6ff382e456bf4c0e528b8da1d8f8adb09d71ac74c0a36666a8cec1bd70490a81817a49bb9e240323676c4c15ac6bfe404c0ea16d3acc368ef62acdd546c503058a6eb7cfe94a74e8ef4ec7c867357c2522173345af3a38a56c804da0709edf88be3cef47e8eaef0f60b8a08fb3fc91d727f53b8ebbe63e0e33d3165b081e5f2accd16a49f3da8b19bc242d090845f541dff89eaba1d47906fb0734e419f409f5fe5a12ab21191738a2128f0cede73395f3eab5c60ecdf0310a8d309e9f4f69685b67f51886647198da2b0123d812a680577bb914c627bb6c107c7ba7a8734030e4b627a99e9cafcce4a37c92da4577c1cfe3ddcb80f5afad6c4b30285023aeab3d96ee4692137de81d1f675190567d393575e291b39c8ee2de1cde445735bd0d2ce7aab1619824658d05e9d81b367af6c35f2bce53f24e235a20a7506f6185699d4782cd1051bebd088019daa10f105dfba7e2c63b7069b2321c4f9786ce2581706362b911203cca4d9f22dbaf9949d40ed1845f1ce8a5c6b3eab03d370182a0a6ae05f47d1d5630a32f2afd7361f2a705ae5425908714b57ba7e8381f0213cf41cc1c5b990930e88459386e9b12099be98cbc595a45d62d6a0630820bd7510777d3df345b99f979fcb57806f33a904cf77a4621c597e
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 1600
+      SignatureHeaderSize: 0
+      SignatureSize: 1572
+      Keys:
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 30820610308203f8a003020102020a6108d3c4000000000004300d06092a864886f70d01010b0500308191310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313b3039060355040313324d6963726f736f667420436f72706f726174696f6e205468697264205061727479204d61726b6574706c61636520526f6f74301e170d3131303632373231323234355a170d3236303632373231333234355a308181310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312b3029060355040313224d6963726f736f667420436f72706f726174696f6e2055454649204341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100a5086c4cc745096a4b0ca4c0877f06750c43015464e0167f07ed927d0bb273bf0c0ac64a4561a0c5162d96d3f52ba0fb4d499b4180903cb954fde6bcd19dc4a4188a7f418a5c59836832bb8c47c9ee71bc214f9a8a7cff443f8d8f32b22648ae75b5eec94c1e4a197ee4829a1d78774d0cb0bdf60fd316d3bcfa2ba551385df5fbbadb7802dbffec0a1b96d583b81913e9b6c07b407be11f2827c9faef565e1ce67e947ec0f044b27939e5dab2628b4dbf3870e2682414c933a40837d558695ed37cedc1045308e74eb02a876308616f631559eab22b79d70c61678a5bfd5ead877fba86674f71581222042222ce8bef547100ce503558769508ee6ab1a201d50203010001a382017630820172301206092b060104018237150104050203010001302306092b060104018237150204160414f8c16bb77f77534af325371d4ea1267b0f207080301d0603551d0e0416041413adbf4309bd82709c8cd54f316ed522988a1bd4301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d2304183016801445665243e17e5811bfd64e9e2355083b3a226aa8305c0603551d1f045530533051a04fa04d864b687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e637274300d06092a864886f70d01010b05000382020100350842ff30cccef7760cad1068583529463276277cef124127421b4aaa6d813848591355f3e95834a6160b82aa5dad82da808341068fb41df203b9f31a5d1bf15090f9b3558442281c20bdb2ae5114c5c0ac9795211c90db0ffc779e95739188cabdbd52b905500ddf579ea061ed0de56d25d9400f1740c8cea34ac24daf9a121d08548fbdc7bcb92b3d492b1f32fc6a21694f9bc87e4234fc3606178b8f2040c0b39a257527cdc903a3f65dd1e736547ab950b5d312d107bfbb74dfdc1e8f80d5ed18f42f14166b2fde668cb023e5c784d8edeac13382ad564b182df1689507cdcff072f0aebbdd8685982c214c332bf00f4af06887b592553275a16a826a3ca32511a4edadd704aecbd84059a084d1954c6291221a741d8c3d470e44a6e4b09b3435b1fab653a82c81eca40571c89db8bae81b4466e447540e8e567fb39f1698b286d0683e9023b52f5e8f50858dc68d825f41a1f42e0de099d26c75e4b669b52186fa07d1f6e24dd1daad2c77531e253237c76c52729586b0f135616a19f5b23b815056a6322dfea289f94286271855a182ca5a9bf830985414a64796252fc826e441941a5c023fe596e3855b3c3e3fbb47167255e22522b1d97be703062aa3f71e9046c3000dd61989e30e352762037115a6efd027a0a0593760f83894b8e07870f8ba4c868794f6e0ae0245ee65c2b6a37e69167507929bf5a6bc598358
+    - SignatureType: c1c41626-504c-4092-aca9-41f936934328
+      SignatureListSize: 76
+      SignatureHeaderSize: 0
+      SignatureSize: 48
+      Keys:
+      - SignatureOwner: 26dc4851-195f-4ae1-9a19-fbf883bbb35e
+        SignatureData: 2551513ad36c0ab88c70acc158f8428545909f25ec737f9aec01e8c0d19ee52a
+    - SignatureType: c1c41626-504c-4092-aca9-41f936934328
+      SignatureListSize: 76
+      SignatureHeaderSize: 0
+      SignatureSize: 48
+      Keys:
+      - SignatureOwner: 26dc4851-195f-4ae1-9a19-fbf883bbb35e
+        SignatureData: 11a40d7e935a507450a6d61f51ee97987a49534a1c2d2db3e505e3d15b3faa21
+    - SignatureType: c1c41626-504c-4092-aca9-41f936934328
+      SignatureListSize: 76
+      SignatureHeaderSize: 0
+      SignatureSize: 48
+      Keys:
+      - SignatureOwner: 26dc4851-195f-4ae1-9a19-fbf883bbb35e
+        SignatureData: 4fa56bb60171c9f50d8887bed590a5c19c2e7cccbeeb3eb80795ef11a19c5aec
+    - SignatureType: c1c41626-504c-4092-aca9-41f936934328
+      SignatureListSize: 76
+      SignatureHeaderSize: 0
+      SignatureSize: 48
+      Keys:
+      - SignatureOwner: 26dc4851-195f-4ae1-9a19-fbf883bbb35e
+        SignatureData: 83608b6648271f097c95612eb161a49359197fb4e4355cd3a1fad0c02065dd4d
+    - SignatureType: c1c41626-504c-4092-aca9-41f936934328
+      SignatureListSize: 76
+      SignatureHeaderSize: 0
+      SignatureSize: 48
+      Keys:
+      - SignatureOwner: 26dc4851-195f-4ae1-9a19-fbf883bbb35e
+        SignatureData: 0e9b0272ddd11c5f095a7ddcd0110d214639b9388af7417b26ea93029a84c33d
+    - SignatureType: c1c41626-504c-4092-aca9-41f936934328
+      SignatureListSize: 76
+      SignatureHeaderSize: 0
+      SignatureSize: 48
+      Keys:
+      - SignatureOwner: 26dc4851-195f-4ae1-9a19-fbf883bbb35e
+        SignatureData: 27ca924d7c397268299a8f17be5db52177731944bbdcc4c69b581ee4b5a131c6
+    - SignatureType: c1c41626-504c-4092-aca9-41f936934328
+      SignatureListSize: 76
+      SignatureHeaderSize: 0
+      SignatureSize: 48
+      Keys:
+      - SignatureOwner: 26dc4851-195f-4ae1-9a19-fbf883bbb35e
+        SignatureData: df7d74f21ae3f28369bf290833be7f0851dad0ee8cca987e8171de69ee4c642a
+    - SignatureType: c1c41626-504c-4092-aca9-41f936934328
+      SignatureListSize: 76
+      SignatureHeaderSize: 0
+      SignatureSize: 48
+      Keys:
+      - SignatureOwner: 26dc4851-195f-4ae1-9a19-fbf883bbb35e
+        SignatureData: 4879e82ab193737a212a4c531efdaad560a8a064e41de6d465c0b8c6254c8300
+    - SignatureType: c1c41626-504c-4092-aca9-41f936934328
+      SignatureListSize: 76
+      SignatureHeaderSize: 0
+      SignatureSize: 48
+      Keys:
+      - SignatureOwner: 26dc4851-195f-4ae1-9a19-fbf883bbb35e
+        SignatureData: 493e1b0abe3356c73608b45a0b1c71387fb6854a1fbe8312b8d23f28639893de
+- EventNum: 7
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9e04b683b1ade74270dc6083dd716acc63a33310"
+  - AlgorithmId: sha256
+    Digest: "a044b4ce4a4dca9af312c897dc56ee1727c385eb88f7cfb9092b8265029d5b1e"
+  EventSize: 3762
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 3
+    VariableDataLength: 3724
+    UnicodeName: dbx
+    VariableData:
+    - SignatureType: c1c41626-504c-4092-aca9-41f936934328
+      SignatureListSize: 3724
+      SignatureHeaderSize: 0
+      SignatureSize: 48
+      Keys:
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 80b4d96931bf0d02fd91a61e19d14f1da452e66db2408ca8604d411f92659f0a
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: f52f83a3fa9cfbd6920f722824dbe4034534d25b8507246b3b957dac6e1bce7a
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: c5d9d8a186e2c82d09afaa2a6f7f2e73870d3e64f72c4e08ef67796a840f0fbd
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 363384d14d1f2e0b7815626484c459ad57a318ef4396266048d058c5a19bbf76
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 1aec84b84b6c65a51220a9be7181965230210d62d6d33c48999c6b295a2b0a06
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: e6ca68e94146629af03f69c2f86e6bef62f930b37c6fbcc878b78df98c0334e5
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: c3a99a460da464a057c3586d83cef5f4ae08b7103979ed8932742df0ed530c66
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 58fb941aef95a25943b3fb5f2510a0df3fe44c58c95e0ab80487297568ab9771
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 5391c3a2fb112102a6aa1edc25ae77e19f5d6f09cd09eeb2509922bfcd5992ea
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: d626157e1d6a718bc124ab8da27cbb65072ca03a7b6b257dbdcbbd60f65ef3d1
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: d063ec28f67eba53f1642dbf7dff33c6a32add869f6013fe162e2c32f1cbe56d
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 29c6eb52b43c3aa18b2cd8ed6ea8607cef3cfae1bafe1165755cf2e614844a44
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 90fbe70e69d633408d3e170c6832dbb2d209e0272527dfb63d49d29572a6f44c
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 075eea060589548ba060b2feed10da3c20c7fe9b17cd026b94e8a683b8115238
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 07e6c6a858646fb1efc67903fe28b116011f2367fe92e6be2b36999eff39d09e
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 09df5f4e511208ec78b96d12d08125fdb603868de39f6f72927852599b659c26
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 0bbb4392daac7ab89b30a4ac657531b97bfaab04f90b0dafe5f9b6eb90a06374
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 0c189339762df336ab3dd006a463df715a39cfb0f492465c600e6c6bd7bd898c
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 0d0dbeca6f29eca06f331a7d72e4884b12097fb348983a2a14a0d73f4f10140f
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 0dc9f3fb99962148c3ca833632758d3ed4fc8d0b0007b95b31e6528f2acd5bfc
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 106faceacfecfd4e303b74f480a08098e2d0802b936f8ec774ce21f31686689c
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 174e3a0b5b43c6a607bbd3404f05341e3dcf396267ce94f8b50e2e23a9da920c
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 18333429ff0562ed9f97033e1148dceee52dbe2e496d5410b5cfd6c864d2d10f
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 2b99cf26422e92fe365fbf4bc30d27086c9ee14b7a6fff44fb2f6b9001699939
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 2bbf2ca7b8f1d91f27ee52b6fb2a5dd049b85a2b9b529c5d6662068104b055f8
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 2c73d93325ba6dcbe589d4a4c63c5b935559ef92fbf050ed50c4e2085206f17d
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 2e70916786a6f773511fa7181fab0f1d70b557c6322ea923b2a8d3b92b51af7d
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 306628fa5477305728ba4a467de7d0387a54f569d3769fce5e75ec89d28d1593
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 3608edbaf5ad0f41a414a1777abf2faf5e670334675ec3995e6935829e0caad2
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 3841d221368d1583d75c0a02e62160394d6c4e0a6760b6f607b90362bc855b02
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 3fce9b9fdf3ef09d5452b0f95ee481c2b7f06d743a737971558e70136ace3e73
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 4397daca839e7f63077cb50c92df43bc2d2fb2a8f59f26fc7a0e4bd4d9751692
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 47cc086127e2069a86e03a6bef2cd410f8c55a6d6bdb362168c31b2ce32a5adf
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 518831fe7382b514d03e15c621228b8ab65479bd0cbfa3c5c1d0f48d9c306135
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 5ae949ea8855eb93e439dbc65bda2e42852c2fdf6789fa146736e3c3410f2b5c
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 6b1d138078e4418aa68deb7bb35e066092cf479eeb8ce4cd12e7d072ccb42f66
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 6c8854478dd559e29351b826c06cb8bfef2b94ad3538358772d193f82ed1ca11
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 6f1428ff71c9db0ed5af1f2e7bbfcbab647cc265ddf5b293cdb626f50a3a785e
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 71f2906fd222497e54a34662ab2497fcc81020770ff51368e9e3d9bfcbfd6375
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 726b3eb654046a30f3f83d9b96ce03f670e9a806d1708a0371e62dc49d2c23c1
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 72e0bd1867cf5d9d56ab158adf3bddbc82bf32a8d8aa1d8c5e2f6df29428d6d8
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 7827af99362cfaf0717dade4b1bfe0438ad171c15addc248b75bf8caa44bb2c5
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 81a8b965bb84d3876b9429a95481cc955318cfaa1412d808c8a33bfd33fff0e4
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 82db3bceb4f60843ce9d97c3d187cd9b5941cd3de8100e586f2bda5637575f67
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 895a9785f617ca1d7ed44fc1a1470b71f3f1223862d9ff9dcc3ae2df92163daf
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 8ad64859f195b5f58dafaa940b6a6167acd67a886e8f469364177221c55945b9
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 8bf434b49e00ccf71502a2cd900865cb01ec3b3da03c35be505fdf7bd563f521
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 8d8ea289cfe70a1c07ab7365cb28ee51edd33cf2506de888fbadd60ebf80481c
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 9998d363c491be16bd74ba10b94d9291001611736fdca643a36664bc0f315a42
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 9e4a69173161682e55fde8fef560eb88ec1ffedcaf04001f66c0caf707b2b734
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: a6b5151f3655d3a2af0d472759796be4a4200e5495a7d869754c4848857408a7
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: a7f32f508d4eb0fead9a087ef94ed1ba0aec5de6f7ef6ff0a62b93bedf5d458d
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: ad6826e1946d26d3eaf3685c88d97d85de3b4dcb3d0ee2ae81c70560d13c5720
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: aeebae3151271273ed95aa2e671139ed31a98567303a332298f83709a9d55aa1
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: afe2030afb7d2cda13f9fa333a02e34f6751afec11b010dbcd441fdf4c4002b3
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: b54f1ee636631fad68058d3b0937031ac1b90ccb17062a391cca68afdbe40d55
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: b8f078d983a24ac433216393883514cd932c33af18e7dd70884c8235f4275736
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: b97a0889059c035ff1d54b6db53b11b9766668d9f955247c028b2837d7a04cd9
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: bc87a668e81966489cb508ee805183c19e6acd24cf17799ca062d2e384da0ea7
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: c409bdac4775add8db92aa22b5b718fb8c94a1462c1fe9a416b95d8a3388c2fc
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: c617c1a8b1ee2a811c28b5a81b4c83d7c98b5b0c27281d610207ebe692c2967f
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: c90f336617b8e7f983975413c997f10b73eb267fd8a10cb9e3bdbfc667abdb8b
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: cb6b858b40d3a098765815b592c1514a49604fafd60819da88d7a76e9778fef7
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: ce3bfabe59d67ce8ac8dfd4a16f7c43ef9c224513fbc655957d735fa29f540ce
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: d8cbeb9735f5672b367e4f96cdc74969615d17074ae96c724d42ce0216f8f3fa
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: e92c22eb3b5642d65c1ec2caf247d2594738eebb7fb3841a44956f59e2b0d1fa
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: fddd6e3d29ea84c7743dad4a1bdbc700b5fec1b391f932409086acc71dd6dbd8
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: fe63a84f782cc9d3fcf2ccf9fc11fbd03760878758d26285ed12669bdc6e6d01
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: fecfb232d12e994b6d485d2c7167728aa5525984ad5ca61e7516221f079a1436
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: ca171d614a8d7e121c93948cd0fe55d39981f9d11aa96e03450a415227c2c65b
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 55b99b0de53dbcfe485aa9c737cf3fb616ef3d91fab599aa7cab19eda763b5ba
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 77dd190fa30d88ff5e3b011a0ae61e6209780c130b535ecb87e6f0888a0b6b2f
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: c83cb13922ad99f560744675dd37cc94dcad5a1fcba6472fee341171d939e884
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 3b0287533e0cc3d0ec1aa823cbf0a941aad8721579d1c499802dd1c3a636b8a9
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 939aeef4f5fa51e23340c3f2e49048ce8872526afdf752c3a7f3a3f2bc9f6049
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 64575bd912789a2e14ad56f6341f52af6bf80cf94400785975e9f04e2d64d745
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 45c7c8ae750acfbb48fc37527d6412dd644daed8913ccd8a24c94d856967df8e
+- EventNum: 8
+  PCRIndex: 7
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 9
+  PCRIndex: 2
+  EventType: EV_EFI_BOOT_SERVICES_DRIVER
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "5e58cd33cbf6f6058139e716508bbf5d03f2c94f"
+  - AlgorithmId: sha256
+    Digest: "2de50158a70fa60bcb0eff4f8ad5d5a8d6e4a808bfbe5446b74464163191a8bf"
+  EventSize: 84
+  Event:
+    ImageLocationInMemory: 0xb6bf9018
+    ImageLengthInMemory: 133728
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 52
+    DevicePath: '02010c00d041030a00000000010106000001010106000000040818000000000050f2000000000000ff010200000000007fff0400'
+- EventNum: 10
+  PCRIndex: 0
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 11
+  PCRIndex: 1
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 12
+  PCRIndex: 2
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 13
+  PCRIndex: 3
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 14
+  PCRIndex: 4
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 15
+  PCRIndex: 5
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 16
+  PCRIndex: 6
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 17
+  PCRIndex: 5
+  EventType: EV_EFI_GPT_EVENT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "a30700c4eccddd14eb6c80b8c16474c4519e2a70"
+  - AlgorithmId: sha256
+    Digest: "dcc6b7eaf2b013c6a37c720fe1d5098b5daf56ac9922f222125df7a1126b9596"
+  EventSize: 484
+  Event:
+    Header:
+      Signature: "EFI PART"
+      Revision: 0x10000
+      HeaderSize: 92
+      HeaderCRC32: 0x986df596
+      MyLBA: 0x1
+      AlternateLBA: 0x1dcf32af
+      FirstUsableLBA: 0x22
+      LastUsableLBA: 0x1dcf328e
+      DiskGUID: f9f4bb69-5418-46bb-9501-2d615a3edc79
+      PartitionEntryLBA: 0x2
+      NumberOfPartitionEntry: 128
+      SizeOfPartitionEntry: 128
+      PartitionEntryArrayCRC32: 0xe4012e1b
+    NumberOfPartitions: 3
+    Partitions:
+    - PartitionTypeGUID: c12a7328-f81f-11d2-ba4b-00a0c93ec93b
+      UniquePartitionGUID: 1a504613-19b5-4b44-a83d-d926d40daa1c
+      StartingLBA: 0x800
+      EndingLBA: 0x807ff
+      Attributes: 0x0
+      PartitionName: "EFI System"
+    - PartitionTypeGUID: a19d880f-05fc-4d3b-a006-743f0f84911e
+      UniquePartitionGUID: c3fe0624-3db7-44f4-941e-49e6823d5a30
+      StartingLBA: 0x80800
+      EndingLBA: 0x1d24594e
+      Attributes: 0x0
+      PartitionName: "Linux RAID"
+    - PartitionTypeGUID: 0fc63daf-8483-4772-8e79-3d69d8477de4
+      UniquePartitionGUID: 07ca55d3-efba-43a7-aea7-334c379e6b70
+      StartingLBA: 0x1d246000
+      EndingLBA: 0x1dcf328e
+      Attributes: 0x0
+      PartitionName: "Linux filesystem"
+- EventNum: 18
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "359b9b1edab9f2841d8fd4312d8528079a3777b4"
+  - AlgorithmId: sha256
+    Digest: "66c174f6bcd22cea3a37bb47d9669da541f0488b9be9abca33323ac31838d68e"
+  EventSize: 56
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 9
+    VariableDataLength: 6
+    UnicodeName: BootOrder
+    VariableData:
+    - Boot0000
+    - Boot0003
+    - Boot0002
+- EventNum: 19
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "0113948871b7c34c97695e6351b1acf39f8e8291"
+  - AlgorithmId: sha256
+    Digest: "6fff79a21c2c8f94652fb0fc53c37da0aa4ea839ebd945566b804f8c6c4f0162"
+  EventSize: 208
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 160
+    UnicodeName: Boot0000
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 116
+      Description: "Linux Boot Manager"
+      DevicePath: '04012a0001000000000800000000000000000800000000001346501ab519444ba83dd926d40daa1c0202040446005c004500460049005c00530059005300540045004d0044005c00530059005300540045004d0044002d0042004f004f0054005800360034002e0045004600490000007fff0400'
+- EventNum: 20
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "39d79e549dc8ce20c55b44733dd7c73d21bd159a"
+  - AlgorithmId: sha256
+    Digest: "d865a2d13db7529aaae8105153650c4557a33f471650e4099b5178d21f6516bf"
+  EventSize: 168
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 120
+    UnicodeName: Boot0003
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 94
+      Description: "UEFI OS"
+      DevicePath: '04012a0001000000000800000000000000000800000000001346501ab519444ba83dd926d40daa1c0202040430005c004500460049005c0042004f004f0054005c0042004f004f0054005800360034002e0045004600490000007fff04000000424f'
+- EventNum: 21
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "72411782e0c50340e583ff814e236de1364bd2af"
+  - AlgorithmId: sha256
+    Digest: "a5428f6cb55f36175733db8f1ead37be44cca8cfe027268d0cb893d862078ca0"
+  EventSize: 232
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 184
+    UnicodeName: Boot0002
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 140
+      Description: "Linux Boot Manager"
+      DevicePath: '01041400e775e299a075374ba2e6c5385e6c00cb7fff040004012a00010000000008000000000000003011000000000047856cc0b612db43af4c413316e029360202040446005c004500460049005c00530059005300540045004d0044005c00530059005300540045004d0044002d0042004f004f0054005800360034002e0045004600490000007fff0400'
+- EventNum: 22
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "c429e591c3d5542d366037d5dee18bc178e58535"
+  - AlgorithmId: sha256
+    Digest: "d51e9d20c0e180d8fdded3e7d5e05b4ab8e87b2f30e6995632a14e399332103b"
+  EventSize: 176
+  Event:
+    ImageLocationInMemory: 0xb616b018
+    ImageLengthInMemory: 96725
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 144
+    DevicePath: '02010c00d041030a0000000001010600001703120a000100ffff000004012a0001000000000800000000000000000800000000001346501ab519444ba83dd926d40daa1c0202040446005c004500460049005c00530059005300540045004d0044005c00530059005300540045004d0044002d0042004f004f0054005800360034002e0045004600490000007fff0400'
+- EventNum: 23
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "8fce1cd38d7b7dd55d6e841dab1629aee55cd212"
+  - AlgorithmId: sha256
+    Digest: "6c1b73563471cd9082ea3d149fa4668cd8f1a0c315531d4bf513bc5ede8939a5"
+  EventSize: 148
+  Event:
+    ImageLocationInMemory: 0xb5763018
+    ImageLengthInMemory: 9180448
+    ImageLinkTimeAddress: 0x1000000
+    LengthOfDevicePath: 116
+    DevicePath: '02010c00d041030a0000000001010600001703120a000100ffff000004012a0001000000000800000000000000000800000000001346501ab519444ba83dd926d40daa1c020204042a005c0076006d006c0069006e0075007a002d006c0069006e00750078002d006c007400730000007fff0400'
+- EventNum: 24
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "7fd3abec2afe8e68028be79cfc143a56c9918e69"
+  - AlgorithmId: sha256
+    Digest: "362d5603871294a44287df0c3c63c120972e5b3897704315b99cf8406ac413b6"
+  EventSize: 365
+  Event:
+    String: |-
+      "i\0n\0i\0t\0r\0d\0=\0\\\0i\0n\0t\0e\0l\0-\0u\0c\0o\0d\0e\0.\0i\0m\0g\0 \0i\0n\0i\0t\0r\0d\0=\0\\\0i\0n\0i\0t\0r\0a\0m\0f\0s\0-\0l\0i\0n\0u\0x\0-\0l\0t\0s\0.\0i\0m\0g\0 \0c\0r\0y\0p\0t\0d\0e\0v\0i\0c\0e\0=\0U\0U\0I\0D\0=\05\04\06\05\03\06\09\0a\0-\09\09\06\0d\0-\04\02\0c\0a\0-\09\0a\0d\04\0-\09\01\0d\00\00\08\02\0e\00\0b\03\04\0:\0c\0r\0y\0p\0t\0r\0o\0o\0t\0 \0r\0o\0o\0t\0=\0/\0d\0e\0v\0/\0m\0a\0p\0p\0e\0r\0/\0c\0r\0y\0p\0t\0r\0o\0o\0t\0 \0r\0w\0 \0i\0n\0t\0e\0l\0_\0i\0o\0m\0m\0u\0=\0o\0n\0 \0i\0o\0m\0m\0u\0=\0p\0t\0 \0l\01\0t\0f\0=\0o\0f\0f\0\0"
+pcrs:
+  sha1:
+    0  : 0xa0487b0d95387d4a30560edf5f041307bf4a1dcc
+    1  : 0x56b71c334a5b67d3b7b3343e3241dff5a1ad87bf
+    2  : 0x01098a68e44e4fbd0af3b9a836b1b79e78c4f6f5
+    3  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    4  : 0x2845117447a59571c424c1d0824c25112b902eb7
+    5  : 0x0dfa5ca60508ac5214515b20ed3e66289514fcb6
+    6  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    7  : 0x029c700c2fa2bc83cbf3ce4ee501ad4d984ec5ae
+    8  : 0xaa99fc93faa0777f42da6e1ae77a0653b5005619
+  sha256:
+    0  : 0x758b773d94feabf52ef5a4c00a7ad2c80d8d6e6d9d58756150be9bc973da9087
+    1  : 0xbfda688a5d320123fddb3fc70b746bc17647e2e7f2f96e130d429542bf4622d5
+    2  : 0x65dee4a48cde677aa89fa83c5c35e883fda658f743853e3ebad504ca6702f7c5
+    3  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    4  : 0x7672cbacaf6568fd1767a29cce541602ad91360dbd753a16b0d64021e619d65d
+    5  : 0x202522f005ef625588bb7c9e21335ba96a63c5086306138885b3bb2c381730ca
+    6  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    7  : 0x3b4a4db44b7a872524055364e62e897ae678e0d47ab0809f65c3a4ed77f66ab9
+    8  : 0x47591b43af431963eaeb5238a5c42eda1eb0014c27f7de7ae483066a2d2a2e61

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-bootorder.bin.yaml Added

@@ -0,0 +1,1467 @@
+---
+version: 1
+events:
+- EventNum: 0
+  PCRIndex: 0
+  EventType: EV_NO_ACTION
+  Digest: "0000000000000000000000000000000000000000"
+  EventSize: 37
+  SpecID:
+  - Signature: Spec ID Event03
+    platformClass: 0
+    specVersionMinor: 0
+    specVersionMajor: 2
+    specErrata: 0
+    uintnSize: 2
+    numberOfAlgorithms: 2
+    Algorithms:
+    - Algorithm0:
+      algorithmId: sha1
+      digestSize: 20
+    - Algorithm1:
+      algorithmId: sha256
+      digestSize: 32
+    vendorInfoSize: 0
+- EventNum: 1
+  PCRIndex: 0
+  EventType: EV_S_CRTM_VERSION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "1489f923c4dca729178b3e3233458550d8dddf29"
+  - AlgorithmId: sha256
+    Digest: "96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7"
+  EventSize: 2
+  Event: "0000"
+- EventNum: 2
+  PCRIndex: 0
+  EventType: EV_EFI_PLATFORM_FIRMWARE_BLOB
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "6488855f69f459ef2e2038344ec566ca4bcad690"
+  - AlgorithmId: sha256
+    Digest: "163240b109aa840ad3c3409a19b5c3488994b831d3e5ab0bca99aef11d95281f"
+  EventSize: 16
+  Event:
+    BlobBase: 0x820000
+    BlobLength: 0xe0000
+- EventNum: 3
+  PCRIndex: 0
+  EventType: EV_EFI_PLATFORM_FIRMWARE_BLOB
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "fad74ec73e2093b46d934e57bb15eb07dab2daa4"
+  - AlgorithmId: sha256
+    Digest: "0893258878179ebb61ea991f3e058a3b9352512086e683eb0458d31e45e474f7"
+  EventSize: 16
+  Event:
+    BlobBase: 0x900000
+    BlobLength: 0xb00000
+- EventNum: 4
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "57cd4dc19442475aa82743484f3b1caa88e142b8"
+  - AlgorithmId: sha256
+    Digest: "115aa827dbccfb44d216ad9ecfda56bdea620b860a94bed5b7a27bba1c4d02d8"
+  EventSize: 53
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 10
+    VariableDataLength: 1
+    UnicodeName: SecureBoot
+    VariableData: "00"
+- EventNum: 5
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9b1387306ebb7ff8e795e7be77563666bbf4516e"
+  - AlgorithmId: sha256
+    Digest: "dea7b80ab53a3daaa24d5cc46c64e1fa9ffd03739f90aadbd8c0867c4a5b4890"
+  EventSize: 36
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 2
+    VariableDataLength: 0
+    UnicodeName: PK
+- EventNum: 6
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9afa86c507419b8570c62167cb9486d9fc809758"
+  - AlgorithmId: sha256
+    Digest: "e670e121fcebd473b8bc41bb801301fc1d9afa33904f06f7149b74f12c47a68f"
+  EventSize: 38
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 3
+    VariableDataLength: 0
+    UnicodeName: KEK
+- EventNum: 7
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "5bf8faa078d40ffbd03317c93398b01229a0e1e0"
+  - AlgorithmId: sha256
+    Digest: "baf89a3ccace52750c5f0128351e0422a41597a1adfd50822aa363b9d124ea7c"
+  EventSize: 36
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 2
+    VariableDataLength: 0
+    UnicodeName: db
+- EventNum: 8
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "734424c9fe8fc71716c42096f4b74c88733b175e"
+  - AlgorithmId: sha256
+    Digest: "9f75b6823bff6af1024a4e2036719cdd548d3cbc2bf1de8e7ef4d0ed01f94bf9"
+  EventSize: 38
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 3
+    VariableDataLength: 0
+    UnicodeName: dbx
+- EventNum: 9
+  PCRIndex: 7
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 10
+  PCRIndex: 2
+  EventType: EV_EFI_BOOT_SERVICES_DRIVER
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "94f73ca3598b5b7fff3b295b5788cbbfcd27a10c"
+  - AlgorithmId: sha256
+    Digest: "2b37dc2f75e2db4099e0dd546e6bbb05d1be905f8cd449baafc86353bda5dd54"
+  EventSize: 78
+  Event:
+    ImageLocationInMemory: 0xbeeed018
+    ImageLengthInMemory: 205768
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 46
+    DevicePath: '02010c00d041030a000000000101060000030408180000000000005c010000000000ff7f0400000000007fff0400'
+- EventNum: 11
+  PCRIndex: 2
+  EventType: EV_EFI_BOOT_SERVICES_DRIVER
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "94f73ca3598b5b7fff3b295b5788cbbfcd27a10c"
+  - AlgorithmId: sha256
+    Digest: "2b37dc2f75e2db4099e0dd546e6bbb05d1be905f8cd449baafc86353bda5dd54"
+  EventSize: 78
+  Event:
+    ImageLocationInMemory: 0xbeeed018
+    ImageLengthInMemory: 205768
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 46
+    DevicePath: '02010c00d041030a000000000101060000040408180000000000005c010000000000ff7f0400000000007fff0400'
+- EventNum: 12
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "ea3f530d2b261b5a945812c15858c09de04abe9c"
+  - AlgorithmId: sha256
+    Digest: "263d99957c7b574c63a265b32da7fff8b8ad831828946bfbff650d7074dd9198"
+  EventSize: 56
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 9
+    VariableDataLength: 6
+    UnicodeName: BootOrder
+    VariableData: "010000000200"
+- EventNum: 13
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "2a9a2be325bb21a601ecc332059d1326bda65629"
+  - AlgorithmId: sha256
+    Digest: "d381b8aa422440ccf1edfd12e58e8ad0074e4b9735fad17d27783f24ec33ff26"
+  EventSize: 126
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 78
+    UnicodeName: Boot0001
+    VariableData: "010000001600550045004600490020004d006900730063002000440065007600690063006500000002010c00d041030a000000000101060000067fff04004eac0881119f594d850ee21a522c59b2"
+- EventNum: 14
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "22a4f6ee9af6dba01d3528deb64b74b582fc182b"
+  - AlgorithmId: sha256
+    Digest: "3197be1e300fa1600d1884c3a4bd4a90a15405bfb546cf2e6cf6095f8c362a93"
+  EventSize: 110
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 62
+    UnicodeName: Boot0000
+    VariableData: "090100002c0055006900410070007000000004071400c9bdb87cebf8344faaea3ee4af6516a10406140021aa2c4614760345836e8ab6f46623317fff0400"
+- EventNum: 15
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "df5d6605cb8f4366d745a8464cfb26c1efdc305c"
+  - AlgorithmId: sha256
+    Digest: "4d387b02d63b2f4cd7f667feb0a387fe47a10a3e26bf3533ddd001c605f3dec5"
+  EventSize: 136
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 88
+    UnicodeName: Boot0002
+    VariableData: "010000002c00450046004900200049006e007400650072006e0061006c0020005300680065006c006c00000004071400c9bdb87cebf8344faaea3ee4af6516a10406140083a5047c3e9e1c4fad65e05268d0b4d17fff0400"
+- EventNum: 16
+  PCRIndex: 4
+  EventType: EV_EFI_ACTION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "cd0fdb4531a6ec41be2753ba042637d6e5f7f256"
+  - AlgorithmId: sha256
+    Digest: "3d6772b4f84ed47595d72a2c4c5ffd15f5bb72c7507fe26f2aaee2c69d5633ba"
+  EventSize: 40
+  Event: |-
+    Calling EFI Application from Boot Option
+- EventNum: 17
+  PCRIndex: 0
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 18
+  PCRIndex: 1
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 19
+  PCRIndex: 2
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 20
+  PCRIndex: 3
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 21
+  PCRIndex: 4
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 22
+  PCRIndex: 5
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 23
+  PCRIndex: 6
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 24
+  PCRIndex: 5
+  EventType: EV_EFI_GPT_EVENT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d35cb7d68eaa9de91261f18f3077b7ba9dd32974"
+  - AlgorithmId: sha256
+    Digest: "2b406513198abc7ffebdec8a744c1a8b828fe07489e000dbde27bf237aca3de2"
+  EventSize: 484
+  Event: "4546492050415254000001005c000000d8b2b15d000000000100000000000000ff5f6604000000002200000000000000de5f660400000000a21b0807c97c63468ecf4692ccb7e3ec02000000000000008000000080000000160e4f720300000000000000af3dc60f838472478e793d69d8477de47010a9784677964382b8ffc7ba90d8890078030000000000de5f66040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004861682149646f6e744e656564454649daf9d10afb18ac429f39fbba46240cbd0008000000000000ff27000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000028732ac11ff8d211ba4b00a0c93ec93b98e759c36a59b642b6f6eca290429d990028000000000000ff770300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+- EventNum: 25
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d0e6f939f1304a83975f34ff678da573ae2b3ee5"
+  - AlgorithmId: sha256
+    Digest: "007f4c95125713b112093e21663e2d23e3c1ae9ce4b5de0d58a297332336a2d8"
+  EventSize: 144
+  Event:
+    ImageLocationInMemory: 0xbec2b018
+    ImageLengthInMemory: 1334816
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 112
+    DevicePath: '02010c00d041030a0000000001010600000604012a000f0000000028000000000000005003000000000098e759c36a59b642b6f6eca290429d990202040430005c004500460049005c0042004f004f0054005c0042004f004f0054005800360034002e0045004600490000007fff0400'
+- EventNum: 26
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "26040ba214343fb89f2f82599675474f092d506d"
+  - AlgorithmId: sha256
+    Digest: "70fd78ce1d6de8d0cc7d5ca74e2e69e03cb92762d8a19d63a61b50070d41593f"
+  EventSize: 41
+  Event:
+    ImageLocationInMemory: 0x0
+    ImageLengthInMemory: 0
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 0
+    DevicePath: '0090150000a01500af'
+- EventNum: 27
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "5bb3e7b9b843fa3bf11e7a85877c095031f6242f"
+  - AlgorithmId: sha256
+    Digest: "b2166ffbf190a9bb3809a5a1dcb44bb5f3de6b44c2c27f1e4220a83f92d0c06a"
+  EventSize: 69
+  Event:
+    String: |-
+      "grub_cmd:  -z (hd0,gpt15)/boot/grub -o ! -e (hd0,gpt15)/boot/grub \0"
+- EventNum: 28
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "74bebd5904e1e03e1b33c6b282f02c1495a6399a"
+  - AlgorithmId: sha256
+    Digest: "204e96107885ed140d3e8dbef893e1c64e4a3d9924db6c2ab247a36daadef64a"
+  EventSize: 59
+  Event:
+    String: |-
+      "grub_cmd:  -e (hd0,gpt15)/boot/grub/x86_64-efi/grub.cfg \0"
+- EventNum: 29
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d213ef93b23586b61de14638c1777ec837604074"
+  - AlgorithmId: sha256
+    Digest: "172b207a85a5f584b99ce06ae8fd97eec2df94b1c8ad305cf144d9bff797bccf"
+  EventSize: 48
+  Event:
+    String: |-
+      "grub_cmd:  -e (hd0,gpt15)/boot/grub/grub.cfg \0"
+- EventNum: 30
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "89390cd4a7a4db44da0828e0b25850e74ae1b5a2"
+  - AlgorithmId: sha256
+    Digest: "d2d0bcff3471ed8513c735eae972e18b64697980124f3634ba71ccd304f73b22"
+  EventSize: 48
+  Event:
+    String: |-
+      "grub_cmd: source (hd0,gpt15)/boot/grub/grub.cfg\0"
+- EventNum: 31
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "e7dfe5cc66a86749c2035e148e5d05e7208d7bd7"
+  - AlgorithmId: sha256
+    Digest: "3193758bf575102eeea79b1f7a7bef60772effcb7e9ca8b5fd42e33c9e8953bf"
+  EventSize: 31
+  Event:
+    String: |-
+      "(hd0,gpt15)/boot/grub/grub.cfg\0"
+- EventNum: 32
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "dc67bcc9abc2411af92a6b61683d09b888ab9b6c"
+  - AlgorithmId: sha256
+    Digest: "154a0f30f044fc2e043ad9330b5cf5f3970422281ad8fe902dd1d0b42aa07b54"
+  EventSize: 76
+  Event:
+    String: |-
+      "grub_cmd: search.fs_uuid d64f335d-4d71-46c8-9379-3375973830f3 root hd0,gpt1\0"
+- EventNum: 33
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "c90fdbd8bc3928f93d41ef4176a3415df2d584eb"
+  - AlgorithmId: sha256
+    Digest: "679845b798116003dcee938a7e87a07c7b7dd42b5349e54632bbfa82a740541b"
+  EventSize: 42
+  Event:
+    String: |-
+      "grub_cmd: set prefix=(hd0,gpt1)/boot/grub\0"
+- EventNum: 34
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "7f7e85909fb37d150f57822c0ad3b636e7853aff"
+  - AlgorithmId: sha256
+    Digest: "5137257cdcec140bce7e0c83c1000df3f7ecf18de11bde46b8d32f49ba657791"
+  EventSize: 44
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/x86_64-efi/command.lst\0"
+- EventNum: 35
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f091655c7ac7314eb0df21931415de47628d621f"
+  - AlgorithmId: sha256
+    Digest: "32fc7f5de8c0a5dc0b1e7eb609ca31a77eb3475539e1d97a4543dca1b9b26c57"
+  EventSize: 39
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/x86_64-efi/fs.lst\0"
+- EventNum: 36
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "ff00d28114398cf1a052329494d63aceeb8ff29a"
+  - AlgorithmId: sha256
+    Digest: "1b766f38a94927fe9b7bc1e809f0363e778e14c601e800faea271a2e75d3fc43"
+  EventSize: 43
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/x86_64-efi/crypto.lst\0"
+- EventNum: 37
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "66b726c6d64bc109d3948a9528f502ea94938ef4"
+  - AlgorithmId: sha256
+    Digest: "46f888c52f36baf9b62d60bc8d06426a314aad5a0ff86a4362a91c2512a1df9c"
+  EventSize: 45
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/x86_64-efi/terminal.lst\0"
+- EventNum: 38
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "1284bee568af2e320e6a03dce30144182be7d51e"
+  - AlgorithmId: sha256
+    Digest: "874d063ee6d5776d8474fcbaed76cdd44f32572d8454338fef7138347e866d7d"
+  EventSize: 51
+  Event:
+    String: |-
+      "grub_cmd: configfile (hd0,gpt1)/boot/grub/grub.cfg\0"
+- EventNum: 39
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "6629b50b4251a5dad59be69a1dfa3b9cd77371f5"
+  - AlgorithmId: sha256
+    Digest: "457040ecfb2efcb062b4b833ed45d8f9c5773f09697eb71d7d64705677fddcae"
+  EventSize: 30
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/grub.cfg\0"
+- EventNum: 40
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "3e5cd7ea0fdc2e2b2f956d41f9090ee3732fb833"
+  - AlgorithmId: sha256
+    Digest: "7e2b3493baa3f9e4c6a836282d1e66b5855692169dee44d46fe20d11dbc17381"
+  EventSize: 46
+  Event:
+    String: |-
+      "grub_cmd:  -s (hd0,gpt1)/boot/grub/grubenv \0"
+- EventNum: 41
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d824837898575ca2fcae32fed643e00b84d62611"
+  - AlgorithmId: sha256
+    Digest: "42439fda5143449c668430706de270c764912b08766180e594bcd75d961da46c"
+  EventSize: 29
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/grubenv\0"
+- EventNum: 42
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "3c4e9b1198ecc160aff6022c0f96b5b22fab1469"
+  - AlgorithmId: sha256
+    Digest: "0e3a17e0c48e42d79f4d1576e7f787c911239510586505c326143b9b268bdd65"
+  EventSize: 32
+  Event:
+    String: |-
+      "grub_cmd: set have_grubenv=true\0"
+- EventNum: 43
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "453dee6ce82bd80ea89bd8085724ae9784ff0f1b"
+  - AlgorithmId: sha256
+    Digest: "f8b99f77983990e8804864cade91f361b5b6600cc2832febaef878ac8b44d27e"
+  EventSize: 19
+  Event:
+    String: |-
+      "grub_cmd: load_env\0"
+- EventNum: 44
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d824837898575ca2fcae32fed643e00b84d62611"
+  - AlgorithmId: sha256
+    Digest: "42439fda5143449c668430706de270c764912b08766180e594bcd75d961da46c"
+  EventSize: 29
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/grubenv\0"
+- EventNum: 45
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "69ac3a89588aa0a95d8ff937642868a0ccfe2c09"
+  - AlgorithmId: sha256
+    Digest: "492fe6f726b0b3b92fce889eaba1aab7be7c5a373c7438557b3ea49ba98d4940"
+  EventSize: 20
+  Event:
+    String: |-
+      "grub_cmd:  1 = 2 \0"
+- EventNum: 46
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "aa0c1b41d0046552dea2a47b1f8e592716137f4a"
+  - AlgorithmId: sha256
+    Digest: "5935716bf513717f6b6931f3f8e40962606850cfc43d25ff2ca4754dcc13dceb"
+  EventSize: 20
+  Event:
+    String: |-
+      "grub_cmd:  1 = 1 \0"
+- EventNum: 47
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d8f3601c7085b0e7d08c2b5925720404d9b799d1"
+  - AlgorithmId: sha256
+    Digest: "6b59ff87625a202766cd5d6172f00dd63378823bf413a551a628f874bbb642cf"
+  EventSize: 26
+  Event:
+    String: |-
+      "grub_cmd: set next_entry=\0"
+- EventNum: 48
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "aa78b63e975d20ee4af7e4bfa0c8314ca2e72862"
+  - AlgorithmId: sha256
+    Digest: "4a6e5876f2d88fa867f1099e143631ad94a37484e682790d9e1848b92a07abee"
+  EventSize: 26
+  Event:
+    String: |-
+      "grub_cmd: set prev_entry=\0"
+- EventNum: 49
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "69634430fcd587c877479d7390cd3eacfc2f27cc"
+  - AlgorithmId: sha256
+    Digest: "fdcca48e2c9aab6cbe435b5cda9b395d67aa165516b62e7e5ce3a50ac039ac32"
+  EventSize: 30
+  Event:
+    String: |-
+      "grub_cmd: save_env prev_entry\0"
+- EventNum: 50
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "710cbf237c9abd071ca91c4104324800bec7b0fb"
+  - AlgorithmId: sha256
+    Digest: "ce8124bc1b0fbc0cb5cd47338ca0c7d5f5446d79936e443a201d96b192a7bd65"
+  EventSize: 15
+  Event:
+    String: |-
+      "grub_cmd:   \0"
+- EventNum: 51
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "710cbf237c9abd071ca91c4104324800bec7b0fb"
+  - AlgorithmId: sha256
+    Digest: "ce8124bc1b0fbc0cb5cd47338ca0c7d5f5446d79936e443a201d96b192a7bd65"
+  EventSize: 15
+  Event:
+    String: |-
+      "grub_cmd:   \0"
+- EventNum: 52
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "75409120452bbbee30abe289af973ecdd7e0ef6b"
+  - AlgorithmId: sha256
+    Digest: "3a118940bf2675007df3368cb6d45cf2756f328d3e75daf69a971dd21bd1bc58"
+  EventSize: 24
+  Event:
+    String: |-
+      "grub_cmd: set default=0\0"
+- EventNum: 53
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f5b067e59c163f67b19b836fbee9e8a487a19cdd"
+  - AlgorithmId: sha256
+    Digest: "4568361fb7581b31a42d645ab534302fb9f742adaa37b7fde152215d69e259fb"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  xy = xy \0"
+- EventNum: 54
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "bd5209e50c09650ffcf5c2d12a8be8277e438023"
+  - AlgorithmId: sha256
+    Digest: "09f17d4dfb4b97f16246632c21b1ac2125c95c148899eee5069fbb1b34365513"
+  EventSize: 35
+  Event:
+    String: |-
+      "grub_cmd: menuentry_id_option=--id\0"
+- EventNum: 55
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "6248599bae0d78ccbda185ed2fce0182ed41e297"
+  - AlgorithmId: sha256
+    Digest: "4af0bb370c9e3b7982027d02e04c935e32d52b528007476bfc50d36d1b86815e"
+  EventSize: 37
+  Event:
+    String: |-
+      "grub_cmd: export menuentry_id_option\0"
+- EventNum: 56
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "710cbf237c9abd071ca91c4104324800bec7b0fb"
+  - AlgorithmId: sha256
+    Digest: "ce8124bc1b0fbc0cb5cd47338ca0c7d5f5446d79936e443a201d96b192a7bd65"
+  EventSize: 15
+  Event:
+    String: |-
+      "grub_cmd:   \0"
+- EventNum: 57
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "7dc272da02b00e0ee2958961bb99a2e3196ec24a"
+  - AlgorithmId: sha256
+    Digest: "df24f1cae6b428fdd09bc14b06df255f93060ff05d56c3127724168596f73d5f"
+  EventSize: 33
+  Event:
+    String: |-
+      "grub_cmd: terminal_input console\0"
+- EventNum: 58
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "155e201c47f534b1201190d61e9d178a525540e6"
+  - AlgorithmId: sha256
+    Digest: "fed7c930939012174a23271f9fa177a39891cd1baf6ccd22bccce96acd0514d1"
+  EventSize: 34
+  Event:
+    String: |-
+      "grub_cmd: terminal_output console\0"
+- EventNum: 59
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "aa0c1b41d0046552dea2a47b1f8e592716137f4a"
+  - AlgorithmId: sha256
+    Digest: "5935716bf513717f6b6931f3f8e40962606850cfc43d25ff2ca4754dcc13dceb"
+  EventSize: 20
+  Event:
+    String: |-
+      "grub_cmd:  1 = 1 \0"
+- EventNum: 60
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "4f44a4a7a7523e637715ea96d38b3614bb6c22d8"
+  - AlgorithmId: sha256
+    Digest: "d3a793f471b6bfe8d783f5e629314cad4763d48986a8cd4df25475334b40f49b"
+  EventSize: 24
+  Event:
+    String: |-
+      "grub_cmd: set timeout=0\0"
+- EventNum: 61
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "0d570854895a5a9ce25dc6c25026278c2d1a6367"
+  - AlgorithmId: sha256
+    Digest: "207cda95fd859189d016c7c2cc03b9c05672984589e4809e1dcee665d629cf7d"
+  EventSize: 44
+  Event:
+    String: |-
+      "grub_cmd: set menu_color_normal=white/black\0"
+- EventNum: 62
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d4a516aec1bccafec65420d98fcb243aa465d837"
+  - AlgorithmId: sha256
+    Digest: "6f18799fe0ecb5c4bb4c0695a3094dc9841c940c3b463e14c25e444246348a2a"
+  EventSize: 52
+  Event:
+    String: |-
+      "grub_cmd: set menu_color_highlight=black/light-gray\0"
+- EventNum: 63
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "ecdcad74115ad02c9d8440f27b4e0689d76774e7"
+  - AlgorithmId: sha256
+    Digest: "6cf48a4c26fa07a4c8ae470218b37d52b0ff3095c23c35a3bb8872b87c883ebe"
+  EventSize: 60
+  Event:
+    String: |-
+      "grub_cmd: set partuuid=78a91070-7746-4396-82b8-ffc7ba90d889\0"
+- EventNum: 64
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "ffc5ff69933dd9a11ca68638ce3658ef0d2269ca"
+  - AlgorithmId: sha256
+    Digest: "947920653060a5560f1c4a13befe97d2c3d13c1f36effb24c29f57d1e53edbb5"
+  EventSize: 21
+  Event:
+    String: |-
+      "grub_cmd:  1 != 1 \0"
+- EventNum: 65
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "b22f5db5791853fce95f8623ab479d81483b71dc"
+  - AlgorithmId: sha256
+    Digest: "5618ae564712085435199ecf654a3ab87e1c1fd87a1823c780d7f0f677dd7b5d"
+  EventSize: 34
+  Event:
+    String: |-
+      "grub_cmd: set linux_gfx_mode=text\0"
+- EventNum: 66
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9deef0fa444e59d7a08e615f25628826e7feddf9"
+  - AlgorithmId: sha256
+    Digest: "22e041251eb54eeb3270245759aa3e8bd3b77a647db988b681b1eafc6960aa45"
+  EventSize: 32
+  Event:
+    String: |-
+      "grub_cmd: export linux_gfx_mode\0"
+- EventNum: 67
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "ca904a776c820180356d1f6d200588daa7fa64b7"
+  - AlgorithmId: sha256
+    Digest: "461ab8369f3a3d8b10c911724a3f4e0f242ec9155565ba6116a2290c8f321b84"
+  EventSize: 1023
+  Event:
+    String: |-
+      "grub_cmd: menuentry Ubuntu --class ubuntu --class gnu-linux --class gnu --class os --id gnulinux-simple-d64f335d-4d71-46c8-9379-3375973830f3 {"
+      "\trecordfail"
+      "\tload_video"
+      "\tgfxmode $linux_gfx_mode"
+      "\tinsmod gzio"
+      "\tif  x$grub_platform = xxen ; then insmod xzio; insmod lzopio; fi"
+      "\tinsmod part_gpt"
+      "\tinsmod ext2"
+      "\tset root=\'hd0,gpt1\'"
+      "\tif  x$feature_platform_search_hint = xy ; then"
+      "\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  d64f335d-4d71-46c8-9379-3375973830f3"
+      "\telse"
+      "\t  search --no-floppy --fs-uuid --set=root d64f335d-4d71-46c8-9379-3375973830f3"
+      "\tfi"
+      "\tif  "${initrdfail}" = 1 ; then"
+      "\t  linux\t/boot/vmlinuz-5.4.0-45-generic root=PARTUUID=78a91070-7746-4396-82b8-ffc7ba90d889 ro biosdevname=0 net.ifnames=0 console=tty1 console=ttyS0"
+      "\t  initrd\t/boot/initrd.img-5.4.0-45-generic"
+      "\telse"
+      "\t  linux\t/boot/vmlinuz-5.4.0-45-generic root=PARTUUID=78a91070-7746-4396-82b8-ffc7ba90d889 ro biosdevname=0 net.ifnames=0 console=tty1 console=ttyS0 panic=-1"
+      "\tfi"
+      "\tinitrdfail"
+      "}\0"
+- EventNum: 68
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "e0a4b6ed5d77ec6442f5fe4248e10fafbbf558f6"
+  - AlgorithmId: sha256
+    Digest: "180e24f477566b850732c77bf45ee0460552451c391d111a31b31ae5d7be9d14"
+  EventSize: 2484
+  Event:
+    String: |-
+      "grub_cmd: submenu Advanced options for Ubuntu --id gnulinux-advanced-d64f335d-4d71-46c8-9379-3375973830f3 {"
+      "\tmenuentry \'Ubuntu, with Linux 5.4.0-45-generic\' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option \'gnulinux-5.4.0-45-generic-advanced-d64f335d-4d71-46c8-9379-3375973830f3\' {"
+      "\t\trecordfail"
+      "\t\tload_video"
+      "\t\tgfxmode $linux_gfx_mode"
+      "\t\tinsmod gzio"
+      "\t\tif  x$grub_platform = xxen ; then insmod xzio; insmod lzopio; fi"
+      "\t\tinsmod part_gpt"
+      "\t\tinsmod ext2"
+      "\t\tset root=\'hd0,gpt1\'"
+      "\t\tif  x$feature_platform_search_hint = xy ; then"
+      "\t\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  d64f335d-4d71-46c8-9379-3375973830f3"
+      "\t\telse"
+      "\t\t  search --no-floppy --fs-uuid --set=root d64f335d-4d71-46c8-9379-3375973830f3"
+      "\t\tfi"
+      "\t\techo\t\'Loading Linux 5.4.0-45-generic ...\'"
+      "\t\tif  "${initrdfail}" = 1 ; then"
+      "\t\t  linux\t/boot/vmlinuz-5.4.0-45-generic root=PARTUUID=78a91070-7746-4396-82b8-ffc7ba90d889 ro biosdevname=0 net.ifnames=0 console=tty1 console=ttyS0"
+      "\t\t  echo\t\'Loading initial ramdisk ...\'"
+      "\t\t  initrd\t/boot/initrd.img-5.4.0-45-generic"
+      "\t\telse"
+      "\t\t  linux\t/boot/vmlinuz-5.4.0-45-generic root=PARTUUID=78a91070-7746-4396-82b8-ffc7ba90d889 ro biosdevname=0 net.ifnames=0 console=tty1 console=ttyS0 panic=-1"
+      "\t\tfi"
+      "\t\tinitrdfail"
+      "\t}"
+      "\tmenuentry \'Ubuntu, with Linux 5.4.0-45-generic (recovery mode)\' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option \'gnulinux-5.4.0-45-generic-recovery-d64f335d-4d71-46c8-9379-3375973830f3\' {"
+      "\t\trecordfail"
+      "\t\tload_video"
+      "\t\tinsmod gzio"
+      "\t\tif  x$grub_platform = xxen ; then insmod xzio; insmod lzopio; fi"
+      "\t\tinsmod part_gpt"
+      "\t\tinsmod ext2"
+      "\t\tset root=\'hd0,gpt1\'"
+      "\t\tif  x$feature_platform_search_hint = xy ; then"
+      "\t\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  d64f335d-4d71-46c8-9379-3375973830f3"
+      "\t\telse"
+      "\t\t  search --no-floppy --fs-uuid --set=root d64f335d-4d71-46c8-9379-3375973830f3"
+      "\t\tfi"
+      "\t\techo\t\'Loading Linux 5.4.0-45-generic ...\'"
+      "\t\tif  "${initrdfail}" = 1 ; then"
+      "\t\t  linux\t/boot/vmlinuz-5.4.0-45-generic root=PARTUUID=78a91070-7746-4396-82b8-ffc7ba90d889 ro recovery nomodeset dis_ucode_ldr biosdevname=0 net.ifnames=0"
+      "\t\t  echo\t\'Loading initial ramdisk ...\'"
+      "\t\t  initrd\t/boot/initrd.img-5.4.0-45-generic"
+      "\t\telse"
+      "\t\t  linux\t/boot/vmlinuz-5.4.0-45-generic root=PARTUUID=78a91070-7746-4396-82b8-ffc7ba90d889 ro recovery nomodeset dis_ucode_ldr biosdevname=0 net.ifnames=0 panic=-1"
+      "\t\tfi"
+      "\t\tinitrdfail"
+      "\t}"
+      "}\0"
+- EventNum: 69
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "273f5c80c12e935c1d37c2cfe3e161bc42d79d8e"
+  - AlgorithmId: sha256
+    Digest: "1ea37430950c837021ebcc02f98c12018c31e593e366429436e1353584c7ec72"
+  EventSize: 49
+  Event:
+    String: |-
+      "grub_cmd:  -f (hd0,gpt1)/boot/grub/custom.cfg \0"
+- EventNum: 70
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "a3326df3194201575e51c3b9a1c8d5d17aeff2d0"
+  - AlgorithmId: sha256
+    Digest: "d5478d9057580531bf6ff37383b01bb78e1279c20a23721aa3a67ad0d1ca35db"
+  EventSize: 76
+  Event:
+    String: |-
+      "grub_cmd:  -z (hd0,gpt1)/boot/grub -a -f (hd0,gpt1)/boot/grub/custom.cfg \0"
+- EventNum: 71
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "17c76a65ebda6aa310da041aabbcd6483bf00df4"
+  - AlgorithmId: sha256
+    Digest: "bf5d10a466c0f77818990a9d0fdcc8fa2c4561ba92912d5fbc9d4ac1e31a00fb"
+  EventSize: 27
+  Event:
+    String: |-
+      "grub_cmd: setparams Ubuntu\0"
+- EventNum: 72
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "98d066f8ffd046bacb38b106188cbe7fe9ada729"
+  - AlgorithmId: sha256
+    Digest: "a57e067e286efc4eea89659d40f13a38cc1792e4277bed820ded674c94bf2ead"
+  EventSize: 21
+  Event:
+    String: |-
+      "grub_cmd: recordfail\0"
+- EventNum: 73
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "bac17085fef5043662a50cef18bf366844c074ff"
+  - AlgorithmId: sha256
+    Digest: "64bda8f65b1585d7868248a292c449660cc8f75075c10d87ae59a4db401ce119"
+  EventSize: 27
+  Event:
+    String: |-
+      "grub_cmd: set recordfail=1\0"
+- EventNum: 74
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "55cfd6463ef334abb6b48080b33ec063a9c051eb"
+  - AlgorithmId: sha256
+    Digest: "cfa4676ffe751d1547e77a8d66a033b59b3eed3400d9b3a305d2601891ab0e59"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  -n true \0"
+- EventNum: 75
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d31e5f156b716d7835b261891644bb5f7f65e285"
+  - AlgorithmId: sha256
+    Digest: "4e7a22f96bae467df0f26975e0bf7614d6b92993301c65bae6a85c6530e460bf"
+  EventSize: 18
+  Event:
+    String: |-
+      "grub_cmd:  -z  \0"
+- EventNum: 76
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "925ee69b7c8ac4937cbe47d5c85351d869b4e8d7"
+  - AlgorithmId: sha256
+    Digest: "ce2cc20777ba8d3bc75b662163c3abe370344d4bae17d75fb5bd408d1fb6badf"
+  EventSize: 30
+  Event:
+    String: |-
+      "grub_cmd: save_env recordfail\0"
+- EventNum: 77
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "8fe59e66d6ec198420477f24f791e929f153e144"
+  - AlgorithmId: sha256
+    Digest: "7626abd8be7442c2e575364a3e95cb3a3b533c58afbba402d2bdabdff85d29c7"
+  EventSize: 21
+  Event:
+    String: |-
+      "grub_cmd: load_video\0"
+- EventNum: 78
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f5b067e59c163f67b19b836fbee9e8a487a19cdd"
+  - AlgorithmId: sha256
+    Digest: "4568361fb7581b31a42d645ab534302fb9f742adaa37b7fde152215d69e259fb"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  xy = xy \0"
+- EventNum: 79
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "59ced343b060b7df54fa7ba251ef877940601ee4"
+  - AlgorithmId: sha256
+    Digest: "d71353f5368eb2c1280590928128979bd96ea8db1e8c81493f7878383b76ab3b"
+  EventSize: 27
+  Event:
+    String: |-
+      "grub_cmd: insmod all_video\0"
+- EventNum: 80
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9e12ea97e4dadf46b29402cc55eacd227ee3f364"
+  - AlgorithmId: sha256
+    Digest: "6efe5245f640eb0b7e601bc996652d06902a4bbd1b34b902903fc217a826f30e"
+  EventSize: 23
+  Event:
+    String: |-
+      "grub_cmd: gfxmode text\0"
+- EventNum: 81
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "75538862ec020d327e306ea27c200bddae3406eb"
+  - AlgorithmId: sha256
+    Digest: "c89c80d69cfeedad50036743cb6964f8ed5ef494dff379a57c46345a327ebb64"
+  EventSize: 30
+  Event:
+    String: |-
+      "grub_cmd: set gfxpayload=text\0"
+- EventNum: 82
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "2058b2755fa0eb1e9c76399a4fa797b0675da67e"
+  - AlgorithmId: sha256
+    Digest: "ce014fbd540f5a1796d7b9def2294a75114f28ccd23c556c9e7ba1b4a38a0557"
+  EventSize: 26
+  Event:
+    String: |-
+      "grub_cmd:  text = keep \0"
+- EventNum: 83
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "6568ee5d89e912eb995ad4c82d000ab8d0b4548e"
+  - AlgorithmId: sha256
+    Digest: "09e725869682d71dba50ef98b2f78022466e9c0173f5f4bcc4f0f863067e65f8"
+  EventSize: 26
+  Event:
+    String: |-
+      "grub_cmd: set vt_handoff=\0"
+- EventNum: 84
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "ba509ca38210f0683c477c9dc40e4c4f653e1dfb"
+  - AlgorithmId: sha256
+    Digest: "6c4674d4c652ee67b98a6206d7541ccbf2d5dc0a18dae31ad66e82c794c49784"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd: insmod gzio\0"
+- EventNum: 85
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "2de845dce8a51c8fddbaa04686760093325b7569"
+  - AlgorithmId: sha256
+    Digest: "18865468f2e4bd9f0cc4ffdda1335f405d06df8d6ff183b373f50e08e81f924d"
+  EventSize: 26
+  Event:
+    String: |-
+      "grub_cmd:  xefi = xxen \0"
+- EventNum: 86
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "a4e1c6f50579b47c964111d1ea2170e6f923c941"
+  - AlgorithmId: sha256
+    Digest: "62cd76d31ca3d10d742e46c6ff171046ce19dd90f361a827fec6571e59c24794"
+  EventSize: 26
+  Event:
+    String: |-
+      "grub_cmd: insmod part_gpt\0"
+- EventNum: 87
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "af3f07abac9e5c56b82f09ab98328905aabbf6ef"
+  - AlgorithmId: sha256
+    Digest: "b838a4d2860c81058105fbb1907a1fb7f60b65591b099b3b000d9b31d8d2fb20"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd: insmod ext2\0"
+- EventNum: 88
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "cbf1bcb38df72c190b4db0d27ee96eca3c7a9e44"
+  - AlgorithmId: sha256
+    Digest: "20df4eb78bbf966925af51ad614806aa3ad6f146a9a0c85ac2582a3eaa9a30ca"
+  EventSize: 28
+  Event:
+    String: |-
+      "grub_cmd: set root=hd0,gpt1\0"
+- EventNum: 89
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f5b067e59c163f67b19b836fbee9e8a487a19cdd"
+  - AlgorithmId: sha256
+    Digest: "4568361fb7581b31a42d645ab534302fb9f742adaa37b7fde152215d69e259fb"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  xy = xy \0"
+- EventNum: 90
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9beaa2097e4493a4bb31f11a3f6d8f958b3429b2"
+  - AlgorithmId: sha256
+    Digest: "1781ff193c82654750367a4fc175c77e971e4c53517470ddb02afa23a40290f4"
+  EventSize: 156
+  Event:
+    String: |-
+      "grub_cmd: search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1 d64f335d-4d71-46c8-9379-3375973830f3\0"
+- EventNum: 91
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "aa0c1b41d0046552dea2a47b1f8e592716137f4a"
+  - AlgorithmId: sha256
+    Digest: "5935716bf513717f6b6931f3f8e40962606850cfc43d25ff2ca4754dcc13dceb"
+  EventSize: 20
+  Event:
+    String: |-
+      "grub_cmd:  1 = 1 \0"
+- EventNum: 92
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "b6f8fec26a7eb65f3927aa43af6e8ec1846ee688"
+  - AlgorithmId: sha256
+    Digest: "d78fa3dd0776f200df573cff8c4fd68f5091ed7ad3a6437db8b0db3325c6b0ed"
+  EventSize: 156
+  Event:
+    String: |-
+      "grub_cmd: linux /boot/vmlinuz-5.4.0-45-generic root=PARTUUID=78a91070-7746-4396-82b8-ffc7ba90d889 ro biosdevname=0 net.ifnames=0 console=tty1 console=ttyS0\0"
+- EventNum: 93
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "8a0b7b8226ad59b5ac4381ca4afd38709d8448eb"
+  - AlgorithmId: sha256
+    Digest: "6f6461546ce9fbee0b33dcad75f6f5534ecf907a397f29b5c8c0d93093b6e4e2"
+  EventSize: 31
+  Event:
+    String: |-
+      "/boot/vmlinuz-5.4.0-45-generic\0"
+- EventNum: 94
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "3130fdda238d47b4164505d920baca259ce81219"
+  - AlgorithmId: sha256
+    Digest: "5f8193381b94ebb69a821609308177d3fa8d1fb6fbd817266a61e4ff77d154ef"
+  EventSize: 156
+  Event:
+    String: |-
+      "kernel_cmdline: /boot/vmlinuz-5.4.0-45-generic root=PARTUUID=78a91070-7746-4396-82b8-ffc7ba90d889 ro biosdevname=0 net.ifnames=0 console=tty1 console=ttyS0\0"
+- EventNum: 95
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "c92cb595ef1e034296cdba12b58df0c15e4fbb3b"
+  - AlgorithmId: sha256
+    Digest: "4bdfca86598a2eca99da0d5d8d7eb437a4009db929616f243a41936c4460d446"
+  EventSize: 51
+  Event:
+    String: |-
+      "grub_cmd: initrd /boot/initrd.img-5.4.0-45-generic\0"
+- EventNum: 96
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "186473f3819194651227f49e5f389db7b7cae751"
+  - AlgorithmId: sha256
+    Digest: "46109c40d06946c299a8efc66c93fe882df02ce8f7ae0546571d6eaa02457552"
+  EventSize: 34
+  Event:
+    String: |-
+      "/boot/initrd.img-5.4.0-45-generic\0"
+- EventNum: 97
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "8c6944c5ed9f1516843fd5f5bc32941b1306e7db"
+  - AlgorithmId: sha256
+    Digest: "76bc6c6d70ce34a24bda263584ed03d0fd5d94f90ca206dd5e500b0fe98b3df2"
+  EventSize: 21
+  Event:
+    String: |-
+      "grub_cmd: initrdfail\0"
+- EventNum: 98
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "55cfd6463ef334abb6b48080b33ec063a9c051eb"
+  - AlgorithmId: sha256
+    Digest: "cfa4676ffe751d1547e77a8d66a033b59b3eed3400d9b3a305d2601891ab0e59"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  -n true \0"
+- EventNum: 99
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "86365ebcde91a88bd1c97b4864e7058e66d97e7a"
+  - AlgorithmId: sha256
+    Digest: "3602091ace7833250a353f8e3d7b79f1efcabb25ac761f5764f6a4403eec4974"
+  EventSize: 54
+  Event:
+    String: |-
+      "grub_cmd:  -n 78a91070-7746-4396-82b8-ffc7ba90d889 \0"
+- EventNum: 100
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "a3a5563acacd3a3545f38b1efec4328b19e1db6d"
+  - AlgorithmId: sha256
+    Digest: "50be723e27218e2db23928b27f224484c593978e2073b88ff455eb0caa481260"
+  EventSize: 19
+  Event:
+    String: |-
+      "grub_cmd:  -z 1 \0"
+- EventNum: 101
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9f1950c2967bc0668269446aa91b2f1e2b088862"
+  - AlgorithmId: sha256
+    Digest: "a05839fd9bfebe3bde7739df6a1983a0008d37e25a47ffa6a164b4a22050c80f"
+  EventSize: 30
+  Event:
+    String: |-
+      "grub_cmd: save_env initrdfail\0"
+- EventNum: 102
+  PCRIndex: 5
+  EventType: EV_EFI_ACTION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "443a6b7b82b7af564f2e393cd9d5a388b7fa4a98"
+  - AlgorithmId: sha256
+    Digest: "d8043d6b7b85ad358eb3b6ae6a873ab7ef23a26352c5dc4faa5aeedacf5eb41b"
+  EventSize: 29
+  Event: |-
+    Exit Boot Services Invocation
+- EventNum: 103
+  PCRIndex: 5
+  EventType: EV_EFI_ACTION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "475545ddc978d7bfd036facc7e2e987f48189f0d"
+  - AlgorithmId: sha256
+    Digest: "b54f7542cbd872a81a9d9dea839b2b8d747c7ebd5ea6615c40f42f44a6dbeba0"
+  EventSize: 40
+  Event: |-
+    Exit Boot Services Returned with Success
+pcrs:
+  sha1:
+    0  : 0x74c8f4bec7f58dea3941ce46e688440cce91cf5c
+    1  : 0x293a334523288b61943f3101008ad5ca1f56e127
+    2  : 0x64bdfedc3a257a7dbc5bf9e94692ec6033f1dc76
+    3  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    4  : 0x13f0dcc5114f14c3df03cf437d7181f256e07a01
+    5  : 0x461d7b57e3c62d7a2cda4e4acdec3908c866432e
+    6  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    7  : 0x518bd167271fbb64589c61e43d8c0165861431d8
+    8  : 0x43aaff1eb3b4ec57d1a5c1427f6ae4748fe40cd8
+    9  : 0xf1ec9df00222a772a04fa20afbd7e707ac3ad677
+  sha256:
+    0  : 0x804c3cb76b471627372c8e5ebd068d1f8f8af088af43dc9de620af652f11116f
+    1  : 0x61137129a04703282cd3a002a6cd3694e09c68115cbe1e11f4efa892685648d9
+    2  : 0x6bb89e2dc338e478b9b58d7c987c67fd2b09435be88195decc1e6ecf6e719d8e
+    3  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    4  : 0xa01755784426c92d1d22a4305319644855ba0204dcc46ed920d74473defffe42
+    5  : 0x8017b57031d6bb5a8e830949ca3c04bcaafe196d6de802697c9fb0acb38f2dac
+    6  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    7  : 0x65caf8dd1e0ea7a6347b635d2b379c93b9a1351edc2afc3ecda700e534eb3068
+    8  : 0xf5ce9866af7ad692ed3afe642b65992d6f5d93389ddb119b49eef3a9fe54a1c1
+    9  : 0xd734aa05ed0dfe770bcf88e0ff26113bb3aab42e2e8b8f287aa84aee86acefa1

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-gce-ubuntu-2104-log.bin Added

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-gce-ubuntu-2104-log.bin.yaml Added

@@ -0,0 +1,2004 @@
+---
+version: 2
+events:
+- EventNum: 0
+  PCRIndex: 0
+  EventType: EV_NO_ACTION
+  Digest: "0000000000000000000000000000000000000000"
+  EventSize: 41
+  SpecID:
+  - Signature: Spec ID Event03
+    platformClass: 0
+    specVersionMinor: 0
+    specVersionMajor: 2
+    specErrata: 0
+    uintnSize: 2
+    numberOfAlgorithms: 3
+    Algorithms:
+    - Algorithm0:
+      algorithmId: sha1
+      digestSize: 20
+    - Algorithm1:
+      algorithmId: sha256
+      digestSize: 32
+    - Algorithm2:
+      algorithmId: sha384
+      digestSize: 48
+    vendorInfoSize: 0
+- EventNum: 1
+  PCRIndex: 0
+  EventType: EV_S_CRTM_VERSION
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "3f708bdbaff2006655b540360e16474c100c1310"
+  - AlgorithmId: sha256
+    Digest: "d0fcf11a32a8fbf5a4e1a58cd74dd2357d07e7503b5b6afd5a7989a98e17be7f"
+  - AlgorithmId: sha384
+    Digest: "6d01b1822e08428dcf9234f6a78ac5cb49f49bc1c4393f3717319d8161218bb614df8af7a68c14cea682616589bf0963"
+  EventSize: 48
+  Event: "47004300450020005600690072007400750061006c0020004600690072006d0077006100720065002000760031000000"
+- EventNum: 2
+  PCRIndex: 0
+  EventType: EV_NONHOST_INFO
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9e8af742718df04092551f27c117723769acfe7e"
+  - AlgorithmId: sha256
+    Digest: "7b74dea34ce9b49755ab1babe8bac9ad528d3d5addec4e2fa298e3ae68fd276f"
+  - AlgorithmId: sha384
+    Digest: "a74de6271fa4ad2b7b1846f1d40c28eb103f5ee055abc9883f2ca7d9bedf8ec8c848fce5aa0ad22f1750ce78f5bbf15e"
+  EventSize: 32
+  Event: "474345204e6f6e486f7374496e666f0000000000000000000000000000000000"
+- EventNum: 3
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "57cd4dc19442475aa82743484f3b1caa88e142b8"
+  - AlgorithmId: sha256
+    Digest: "115aa827dbccfb44d216ad9ecfda56bdea620b860a94bed5b7a27bba1c4d02d8"
+  - AlgorithmId: sha384
+    Digest: "cfa4e2c606f572627bf06d5669cc2ab1128358d27b45bc63ee9ea56ec109cfafb7194006f847a6a74b5eaed6b73332ec"
+  EventSize: 53
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 10
+    VariableDataLength: 1
+    UnicodeName: SecureBoot
+    VariableData:
+      Enabled: 'No'
+- EventNum: 4
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "5abd9412abf33e34a79b3d1a93d350e742d8ecd8"
+  - AlgorithmId: sha256
+    Digest: "0bdbbbe39766588565c5cc98a2aeb6e44a9178c9f1935bd241f38372448418bb"
+  - AlgorithmId: sha384
+    Digest: "a763553c9606770cd3a5e607f8e0c1ef01cdf2555af753fa3a1f6afe43eb7b2a0af4a6f80fd8e4dd10459668f3b011e0"
+  EventSize: 842
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 2
+    VariableDataLength: 806
+    UnicodeName: PK
+    VariableData:
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 806
+      SignatureHeaderSize: 0
+      SignatureSize: 778
+      Keys:
+      - SignatureOwner: d281fad2-8d88-47a4-9792-5baa47bb1b89
+        SignatureData: 308202f6308201dea003020102020900d54a14e867835dea300d06092a864886f70d01010b05003010310e300c06035504030c056e6577706b301e170d3138303832313231353131355a170d3138303932303231353131355a3010310e300c06035504030c056e6577706b30820122300d06092a864886f70d01010105000382010f003082010a0282010100ccb9d5087cf86d6b63ea1702c962f40b93c9fe90e39d7c2c45ce85015252487cfb4326bf0da589b0f2dd13c736e87f6995aa8c6fd0a2236f34c24fb19e6bc6fa151bb894c19c8e70879142ce69210f937dda759fbf31172050c1ef8023fbbe3b56e30ad747ea9d30afd45da9036389a2fc39e196a187c33d0326b2d3a26cecc897d7ceda18eab2953cb3040707ce028acfda3a5110883f25b04b3eccddf9dadb51d591169a1da107bd88e2f112b4f1b30092b7e367e6ad8c6adc273f1ddcd44e6cc116bdefde562ada1359600979d3a97c578dfd519061379d7f7de4b76e95f0529b439edc483c1dcdbc399f12a3e8470d46b836dc92b395a8ce4ae34623584b0203010001a3533051301d0603551d0e041604149850840342f32fdb97822728977431465e60cbc5301f0603551d230418301680149850840342f32fdb97822728977431465e60cbc5300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101008aa11e52113f17aae7bdb024ab8bad32b049fd7b34cb3b8076603d8edcca6b69c25b94e8b8139c8c2cd7bcac7d8259c3b511c42ea26c16a5ec981df003312336f8cb3083673a3a1f2b622117602cbaf52ef9286eca6670582886678f69846c002758259c501405e970b8606e54854aaf086d8f451ba65b34fc264d1c3c81e1bb242e79e013d1c8ac7cd97f3847114381196b335057e3739ea67f87ddc3e24afc737b4b070987c78309365aea698740840c2c94802f3dae3dcb70c40335c2b93e7108b2a3c6add8243f7d60ab186fa0ee7a1b9acf759fe84cabcd5187685833b2d901bc04021038252a984b1d45fb67339b259c3fac1ba44344cccdd3c80b6ee1
+- EventNum: 5
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f0501c79b607cc42e9142ee85a74d9c27669c0e2"
+  - AlgorithmId: sha256
+    Digest: "622647d8138f5b8a64087d2d2e6682c162097b6c1315a6b7225a6657c256b582"
+  - AlgorithmId: sha384
+    Digest: "c000a71b17a6054093ed791ece8b1556973ddef6da91bf0aeb5792b3c842423742b52943a58bdf2328a434937e327888"
+  EventSize: 1598
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 3
+    VariableDataLength: 1560
+    UnicodeName: KEK
+    VariableData:
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 1560
+      SignatureHeaderSize: 0
+      SignatureSize: 1532
+      Keys:
+      - SignatureOwner: d281fad2-8d88-47a4-9792-5baa47bb1b89
+        SignatureData: 308205e8308203d0a003020102020a610ad188000000000003300d06092a864886f70d01010b0500308191310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313b3039060355040313324d6963726f736f667420436f72706f726174696f6e205468697264205061727479204d61726b6574706c61636520526f6f74301e170d3131303632343230343132395a170d3236303632343230353132395a308180310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312a3028060355040313214d6963726f736f667420436f72706f726174696f6e204b454b204341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100c4e8b58abfad5726b026c3eae7fb577a44025d070dda4ae5742ae6b00fec6debec7fb9e35a63327c11174f0ee30ba73815938ec6f5e084b19a9b2ce7f5b791d609e1e2c004a8ac301cdf48f306509a64a7517fc8854f8f2086cefe2fe19fff82c0ede9cdcef4536a623a0b43b9e225fdfe05f9d4c414ab11e223898d70b7a41d4decaee59cfa16c2d7c1cbd4e8c42fe599ee248b03ec8df28beac34afb4311120b7eb547926cdce60489ebf53304eb10012a71e5f983133cff25092f687646ffba4fbedcad712a58aafb0ed2793de49b653bcc292a9ffc7259a2ebae92eff6351380c602ece45fcc9d76cdef6392c1af79408479877fe352a8e89d7b07698f150203010001a382014f3082014b301006092b06010401823715010403020100301d0603551d0e0416041462fc43cda03ea4cb6712d25bd955ac7bccb68a5f301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d2304183016801445665243e17e5811bfd64e9e2355083b3a226aa8305c0603551d1f045530533051a04fa04d864b687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e637274300d06092a864886f70d01010b05000382020100d48488f514941802ca2a3cfb2a921c0cd7a0d1f1e85266a8eea2b5757a9000aa2da4765aea79b7b9376a517b1064f6e164f20267bef7a81b78bdbace8858640cd657c819a35f05d6dbc6d069ce484b32b7eb5dd230f5c0f5b8ba7807a32bfe9bdb345684ec82caae4125709c6be9fe900fd7961fe5e7941fb22a0c8d4bff2829107bf7d77ca5d176b905c879ed0f90929cc2fedf6f7e6c0f7bd4c145dd345196390fe55e56d8180596f407a642b3a077fd0819f27156cc9f8623a487cba6fd587ed4696715917e81f27f13e50d8b8a3c8784ebe3cebd43e5ad2d84938e6a2b5a7c44fa52aa81c82d1cbbe052df0011f89a3dc160b0e133b5a388d165190a1ae7ac7ca4c182874e38b12f0dc514876ffd8d2ebc39b6e7e6c3e0e4cd2784ef9442ef298b9046413b811b67d8f9435965cb0dbcfd00924ff4753ba7a924fc50414079e02d4f0a6a27766e52ed96697baf0ff78705d045c2ad5314811ffb3004aa373661da4a691b34d868edd602cf6c940cd3cf6c2279adb1f0bc03a24660a9c407c22182f1fdf2e8793260bfd8aca522144bcac1d84beb7d3f5735b2e64f75b4b060032253ae91791dd69b411f15865470b2de0d350f7cb03472ba97603bf079eba2b21c5da216b887c5e91bf6b597256f389fe391fa8a7998c3690eb7a31c200597f8ca14ae00d7c4f3c01410756b34a01bb59960f35cb0c5574e36d23284bf9e
+- EventNum: 6
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "0915a210049c2781fba26180600fb32217c7c972"
+  - AlgorithmId: sha256
+    Digest: "62ba0f38c3848a9462f98774c586e9d954e72921b3a5254124b63632ccaf8f5a"
+  - AlgorithmId: sha384
+    Digest: "3509cd62ba8fbef6fae05bee7c3c1ae528f328120879d37f778c3611f9bbf1eaf362423ad89bc8a69283ad2821c5fc37"
+  EventSize: 3179
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 2
+    VariableDataLength: 3143
+    UnicodeName: db
+    VariableData:
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 1600
+      SignatureHeaderSize: 0
+      SignatureSize: 1572
+      Keys:
+      - SignatureOwner: d281fad2-8d88-47a4-9792-5baa47bb1b89
+        SignatureData: 30820610308203f8a003020102020a6108d3c4000000000004300d06092a864886f70d01010b0500308191310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313b3039060355040313324d6963726f736f667420436f72706f726174696f6e205468697264205061727479204d61726b6574706c61636520526f6f74301e170d3131303632373231323234355a170d3236303632373231333234355a308181310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312b3029060355040313224d6963726f736f667420436f72706f726174696f6e2055454649204341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100a5086c4cc745096a4b0ca4c0877f06750c43015464e0167f07ed927d0bb273bf0c0ac64a4561a0c5162d96d3f52ba0fb4d499b4180903cb954fde6bcd19dc4a4188a7f418a5c59836832bb8c47c9ee71bc214f9a8a7cff443f8d8f32b22648ae75b5eec94c1e4a197ee4829a1d78774d0cb0bdf60fd316d3bcfa2ba551385df5fbbadb7802dbffec0a1b96d583b81913e9b6c07b407be11f2827c9faef565e1ce67e947ec0f044b27939e5dab2628b4dbf3870e2682414c933a40837d558695ed37cedc1045308e74eb02a876308616f631559eab22b79d70c61678a5bfd5ead877fba86674f71581222042222ce8bef547100ce503558769508ee6ab1a201d50203010001a382017630820172301206092b060104018237150104050203010001302306092b060104018237150204160414f8c16bb77f77534af325371d4ea1267b0f207080301d0603551d0e0416041413adbf4309bd82709c8cd54f316ed522988a1bd4301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d2304183016801445665243e17e5811bfd64e9e2355083b3a226aa8305c0603551d1f045530533051a04fa04d864b687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e637274300d06092a864886f70d01010b05000382020100350842ff30cccef7760cad1068583529463276277cef124127421b4aaa6d813848591355f3e95834a6160b82aa5dad82da808341068fb41df203b9f31a5d1bf15090f9b3558442281c20bdb2ae5114c5c0ac9795211c90db0ffc779e95739188cabdbd52b905500ddf579ea061ed0de56d25d9400f1740c8cea34ac24daf9a121d08548fbdc7bcb92b3d492b1f32fc6a21694f9bc87e4234fc3606178b8f2040c0b39a257527cdc903a3f65dd1e736547ab950b5d312d107bfbb74dfdc1e8f80d5ed18f42f14166b2fde668cb023e5c784d8edeac13382ad564b182df1689507cdcff072f0aebbdd8685982c214c332bf00f4af06887b592553275a16a826a3ca32511a4edadd704aecbd84059a084d1954c6291221a741d8c3d470e44a6e4b09b3435b1fab653a82c81eca40571c89db8bae81b4466e447540e8e567fb39f1698b286d0683e9023b52f5e8f50858dc68d825f41a1f42e0de099d26c75e4b669b52186fa07d1f6e24dd1daad2c77531e253237c76c52729586b0f135616a19f5b23b815056a6322dfea289f94286271855a182ca5a9bf830985414a64796252fc826e441941a5c023fe596e3855b3c3e3fbb47167255e22522b1d97be703062aa3f71e9046c3000dd61989e30e352762037115a6efd027a0a0593760f83894b8e07870f8ba4c868794f6e0ae0245ee65c2b6a37e69167507929bf5a6bc598358
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 1543
+      SignatureHeaderSize: 0
+      SignatureSize: 1515
+      Keys:
+      - SignatureOwner: d281fad2-8d88-47a4-9792-5baa47bb1b89
+        SignatureData: 308205d7308203bfa003020102020a61077656000000000008300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3131313031393138343134325a170d3236313031393138353134325a308184310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e20504341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100dd0cbba2e42e09e3e7c5f79669bc0021bd693333efad04cb5480ee0683bbc52084d9f7d28bf338b0aba4ad2d7c627905ffe34a3f04352070e3c4e76be09cc03675e98a31dd8d70e5dc37b5744696285b8760232cbfdc47a567f751279e72eb07a6c9b91e3b53357ce5d3ec27b9871cfeb9c923096fa84691c16e963c41d3cba33f5d026a4dec691f25285c36fffd43150a94e019b4cfdfc212e2c25b27ee2778308b5b2a096b22895360162cc0681d53baec49f39d618c85680973445d7da2542bdd79f715cf355d6c1c2b5ccebc9c238b6f6eb526d93613c34fd627aeb9323b41922ce1c7cd77e8aa544ef75c0b048765b44318a8b2e06d1977ec5a24fa48030203010001a38201433082013f301006092b06010401823715010403020100301d0603551d0e04160414a92902398e16c49778cd90f99e4f9ae17c55af53301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014d5f656cb8fe8a25c6268d13d94905bd7ce9a18c430560603551d1f044f304d304ba049a0478645687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f4365724175745f323031302d30362d32332e63726c305a06082b06010505070101044e304c304a06082b06010505073002863e687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f4365724175745f323031302d30362d32332e637274300d06092a864886f70d01010b0500038202010014fc7c7151a579c26eb2ef393ebc3c520f6e2b3f101373fea868d048a6344d8a960526ee3146906179d6ff382e456bf4c0e528b8da1d8f8adb09d71ac74c0a36666a8cec1bd70490a81817a49bb9e240323676c4c15ac6bfe404c0ea16d3acc368ef62acdd546c503058a6eb7cfe94a74e8ef4ec7c867357c2522173345af3a38a56c804da0709edf88be3cef47e8eaef0f60b8a08fb3fc91d727f53b8ebbe63e0e33d3165b081e5f2accd16a49f3da8b19bc242d090845f541dff89eaba1d47906fb0734e419f409f5fe5a12ab21191738a2128f0cede73395f3eab5c60ecdf0310a8d309e9f4f69685b67f51886647198da2b0123d812a680577bb914c627bb6c107c7ba7a8734030e4b627a99e9cafcce4a37c92da4577c1cfe3ddcb80f5afad6c4b30285023aeab3d96ee4692137de81d1f675190567d393575e291b39c8ee2de1cde445735bd0d2ce7aab1619824658d05e9d81b367af6c35f2bce53f24e235a20a7506f6185699d4782cd1051bebd088019daa10f105dfba7e2c63b7069b2321c4f9786ce2581706362b911203cca4d9f22dbaf9949d40ed1845f1ce8a5c6b3eab03d370182a0a6ae05f47d1d5630a32f2afd7361f2a705ae5425908714b57ba7e8381f0213cf41cc1c5b990930e88459386e9b12099be98cbc595a45d62d6a0630820bd7510777d3df345b99f979fcb57806f33a904cf77a4621c597e
+- EventNum: 7
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "734424c9fe8fc71716c42096f4b74c88733b175e"
+  - AlgorithmId: sha256
+    Digest: "9f75b6823bff6af1024a4e2036719cdd548d3cbc2bf1de8e7ef4d0ed01f94bf9"
+  - AlgorithmId: sha384
+    Digest: "18cc6e01f0c6ea99aa23f8a280423e94ad81d96d0aeb5180504fc0f7a40cb3619dd39bd6a95ec1680a86ed6ab0f9828d"
+  EventSize: 38
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 3
+    VariableDataLength: 0
+    UnicodeName: dbx
+    VariableData:
+- EventNum: 8
+  PCRIndex: 7
+  EventType: EV_SEPARATOR
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  - AlgorithmId: sha384
+    Digest: "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 9
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "b6a0ebef70ae24d9fe913dd0c6d2b4e0d80dc049"
+  - AlgorithmId: sha256
+    Digest: "415093c7a014e1aba1f54f87ae7747228f31cbf4ed40a68476d48a4651551be3"
+  - AlgorithmId: sha384
+    Digest: "17ac1475128af46c9ea8f807632543c44415306dd06cca9efc8ecf3913146c3095f47ba61d93bcf0618de8759fc13989"
+  EventSize: 58
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 9
+    VariableDataLength: 8
+    UnicodeName: BootOrder
+    VariableData:
+    - Boot0003
+    - Boot0000
+    - Boot0001
+    - Boot0002
+- EventNum: 10
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "dde878cdae43d75a4799189ae872ba915cea8905"
+  - AlgorithmId: sha256
+    Digest: "81b4afa14fa6dd52a1d528671d197fbdd24ebd7d9c8cf9af83c1341710953b2d"
+  - AlgorithmId: sha384
+    Digest: "53de75d2a6230b37a0f7dd1cdb8c0b08b4c138c3a53eaa1a547cde643c1fda1e0a0224e444c74e2d62e6c06131c2ee55"
+  EventSize: 166
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 118
+    UnicodeName: Boot0003
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 98
+      Description: "ubuntu"
+      DevicePath: '04012a000f0000000028000000000000005003000000000040f7a66eef256942838d1a6f21ebf27f0202040434005c004500460049005c007500620075006e00740075005c007300680069006d007800360034002e0065006600690000007fff0400'
+- EventNum: 11
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "22a4f6ee9af6dba01d3528deb64b74b582fc182b"
+  - AlgorithmId: sha256
+    Digest: "3197be1e300fa1600d1884c3a4bd4a90a15405bfb546cf2e6cf6095f8c362a93"
+  - AlgorithmId: sha384
+    Digest: "23ada07f5261f12f34a0bd8e46760962d6b4d576a416f1fea1c64bc656b1d28eacf7047ae6e967c58fd2a98bfa74c298"
+  EventSize: 110
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 62
+    UnicodeName: Boot0000
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 44
+      Description: "UiApp"
+      DevicePath: '04071400c9bdb87cebf8344faaea3ee4af6516a10406140021aa2c4614760345836e8ab6f46623317fff0400'
+- EventNum: 12
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "1deddbe8c4412b10f998870099d4067be3da37f4"
+  - AlgorithmId: sha256
+    Digest: "a8b06578022cffbeffdd688cf545207c1a039630ab6665d72aa98d257cf2db36"
+  - AlgorithmId: sha384
+    Digest: "9ca06fa06fbd36593f57c008963ad83985714d9674964e447247285bc60b43286e1ce06da50a1dab88f507bb132f4b9e"
+  EventSize: 156
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 108
+    UnicodeName: Boot0001
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 30
+      Description: "UEFI Google PersistentDisk "
+      DevicePath: '02010c00d041030a0000000001010600000303020800010000007fff04004eac0881119f594d850ee21a522c59b2'
+- EventNum: 13
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "3197898dc01b3d5e97a774aeca14ec921b1af49f"
+  - AlgorithmId: sha256
+    Digest: "a13a898b836634a61c2c011e61e7ced4ea1c5aefbdae5a9ada39acaf8497acba"
+  - AlgorithmId: sha384
+    Digest: "8018a1de7cd3d787648f7a2c781745ca78b47dd9f6a33351ae0e27e06373111a445b67f3d944f3ac5da6344bcbf86907"
+  EventSize: 131
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 83
+    UnicodeName: Boot0002
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 33
+      Description: "VirtScsi(0,3,0) Disk"
+      DevicePath: '05011d0002000000566972745363736928302c332c3029204469736b007fff04001100'
+- EventNum: 14
+  PCRIndex: 4
+  EventType: EV_EFI_ACTION
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "cd0fdb4531a6ec41be2753ba042637d6e5f7f256"
+  - AlgorithmId: sha256
+    Digest: "3d6772b4f84ed47595d72a2c4c5ffd15f5bb72c7507fe26f2aaee2c69d5633ba"
+  - AlgorithmId: sha384
+    Digest: "77a0dab2312b4e1e57a84d865a21e5b2ee8d677a21012ada819d0a98988078d3d740f6346bfe0abaa938ca20439a8d71"
+  EventSize: 40
+  Event: |-
+    Calling EFI Application from Boot Option
+- EventNum: 15
+  PCRIndex: 0
+  EventType: EV_SEPARATOR
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  - AlgorithmId: sha384
+    Digest: "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 16
+  PCRIndex: 1
+  EventType: EV_SEPARATOR
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  - AlgorithmId: sha384
+    Digest: "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 17
+  PCRIndex: 2
+  EventType: EV_SEPARATOR
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  - AlgorithmId: sha384
+    Digest: "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 18
+  PCRIndex: 3
+  EventType: EV_SEPARATOR
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  - AlgorithmId: sha384
+    Digest: "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 19
+  PCRIndex: 4
+  EventType: EV_SEPARATOR
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  - AlgorithmId: sha384
+    Digest: "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 20
+  PCRIndex: 5
+  EventType: EV_SEPARATOR
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  - AlgorithmId: sha384
+    Digest: "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 21
+  PCRIndex: 6
+  EventType: EV_SEPARATOR
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  - AlgorithmId: sha384
+    Digest: "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 22
+  PCRIndex: 5
+  EventType: EV_EFI_GPT_EVENT
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "50eecfcec250c8b1d356a9217e0dd79c0f2a6e1a"
+  - AlgorithmId: sha256
+    Digest: "2d1e69a4adbf5f58c957fdb6aedc86ea037a0f5016003c7513ada83525852362"
+  - AlgorithmId: sha384
+    Digest: "72d16133b50db63de38da942d1ae8de3e68339b22ef23a6c15d0209627d18f26c94c9dd2aa2a5f210231742ca9f1ae2d"
+  EventSize: 484
+  Event:
+    Header:
+      Signature: "EFI PART"
+      Revision: 0x10000
+      HeaderSize: 92
+      HeaderCRC32: 0x7e4c86d1
+      MyLBA: 0x1
+      AlternateLBA: 0x13fffff
+      FirstUsableLBA: 0x22
+      LastUsableLBA: 0x13fffde
+      DiskGUID: cb2b7180-7317-44b2-b13d-ea395dabb1a7
+      PartitionEntryLBA: 0x2
+      NumberOfPartitionEntry: 128
+      SizeOfPartitionEntry: 128
+      PartitionEntryArrayCRC32: 0x4f717292
+    NumberOfPartitions: 3
+    Partitions:
+    - PartitionTypeGUID: 0fc63daf-8483-4772-8e79-3d69d8477de4
+      UniquePartitionGUID: bf817bdf-6a3a-4221-8edb-2c1ca7c5537f
+      StartingLBA: 0x37800
+      EndingLBA: 0x13fffde
+      Attributes: 0x0
+      PartitionName: ""
+    - PartitionTypeGUID: 21686148-6449-6e6f-744e-656564454649
+      UniquePartitionGUID: 9faed655-11db-4854-bb3c-87170ce39bd6
+      StartingLBA: 0x800
+      EndingLBA: 0x27ff
+      Attributes: 0x0
+      PartitionName: ""
+    - PartitionTypeGUID: c12a7328-f81f-11d2-ba4b-00a0c93ec93b
+      UniquePartitionGUID: 6ea6f740-25ef-4269-838d-1a6f21ebf27f
+      StartingLBA: 0x2800
+      EndingLBA: 0x377ff
+      Attributes: 0x0
+      PartitionName: ""
+- EventNum: 23
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "92e6ec17937f600b9ec7f23adf4ea5553b4e2364"
+  - AlgorithmId: sha256
+    Digest: "d99c93fcb042dbe52707bbde371c75fcf081dd5b0c88a195d44cc57536f6f521"
+  - AlgorithmId: sha384
+    Digest: "d8811e9c08119168b156255c6d695614d1593422bc5044186d29c1aaaa86fff0a633f324ac1ac1122e547479ce50a75a"
+  EventSize: 156
+  Event:
+    ImageLocationInMemory: 0xbdde4018
+    ImageLengthInMemory: 955072
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 124
+    DevicePath: '02010c00d041030a00000000010106000003030208000100000004012a000f0000000028000000000000005003000000000040f7a66eef256942838d1a6f21ebf27f0202040434005c004500460049005c007500620075006e00740075005c007300680069006d007800360034002e0065006600690000007fff0400'
+- EventNum: 24
+  PCRIndex: 14
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "68bcec6001e5c3f2fbdd9aa9aa91da92fc893f29"
+  - AlgorithmId: sha256
+    Digest: "2f196b05a0564764cca674175ecd97898e74ed3891c7c63ce6f17dc82603164a"
+  - AlgorithmId: sha384
+    Digest: "053357ea65185f010b8caa1fc265cfd5e80c7cc781254fa3f1e5ea9d345a87003cf761472a2f0423f15297f55cfe248f"
+  EventSize: 8
+  Event:
+    String: |-
+      "MokList\0"
+- EventNum: 25
+  PCRIndex: 14
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "e284bf593c56945bcb057c6b6470a2fe577ac1be"
+  - AlgorithmId: sha256
+    Digest: "6c29c7fb3c9e800e1d16bed2fa9ca691feacbc308959cdefaef04a5a4ae213c4"
+  - AlgorithmId: sha384
+    Digest: "5978bf6aa483f562bf18f46e1e865e35f3b6f4284733c7444a060602c0e9910397f4d6dfcaf7082894ce849077f128c1"
+  EventSize: 9
+  Event:
+    String: |-
+      "MokListX\0"
+- EventNum: 26
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_AUTHORITY
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "15875d39b8872f8aff3a92fc9f9e40ac75268e04"
+  - AlgorithmId: sha256
+    Digest: "922e939a5565798a5ef12fe09d8b49bf951a8e7f89a0cca7a51636693d41a34d"
+  - AlgorithmId: sha384
+    Digest: "f143e2948d63fcd3442e841bb36a7e180871f0a8946541961fe9d12e70d0727874600956264dba531e2edd8729c5eb38"
+  EventSize: 68
+  Event:
+    VariableName: 605dab50-e046-4300-abb6-3dd810dd8b23
+    UnicodeNameLength: 9
+    VariableDataLength: 18
+    UnicodeName: SbatLevel
+    VariableData:
+      String: |-
+        "sbat,1,2021030218"
+- EventNum: 27
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "4f9604e61091095594c206c8a404afe187a92586"
+  - AlgorithmId: sha256
+    Digest: "b0a836fec2faf4a9bea0e1a5f1945bc86ddc03ac98ce0ae172ed9b1e536d7595"
+  - AlgorithmId: sha384
+    Digest: "bbcdda8a6d872385b10802434eb8de1ac7b92dbaddf18bc1d7ea24fcc71b45291db5cc7b930a29c93405d6aecdb70683"
+  EventSize: 88
+  Event:
+    ImageLocationInMemory: 0xbd23a018
+    ImageLengthInMemory: 1718144
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 56
+    DevicePath: '040434005c004500460049005c007500620075006e00740075005c0067007200750062007800360034002e0065006600690000007fff0400'
+- EventNum: 28
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "af62033e4dacde359d80f7b1720e3dbcdb5f35f7"
+  - AlgorithmId: sha256
+    Digest: "f604450f3c810e0dd17b5136aced8c612ce8ec6d8cefa7fcf705cce8e69908df"
+  - AlgorithmId: sha384
+    Digest: "1ef3cc75a524bfb7ea72a5d7c139b75a3e8da87c724a2b54aff9122a9c4706ff0fc812af1bc2ea930fd238104d798325"
+  EventSize: 32
+  Event:
+    String: |-
+      "(hd0,gpt15)/EFI/ubuntu/grub.cfg\0"
+- EventNum: 29
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "4e2b524b079af00b681bf224f75c3570ef603e6a"
+  - AlgorithmId: sha256
+    Digest: "211e321017e1e3b8976b64602f33c267ebe925d7d27f0eacc7102596b545a0a4"
+  - AlgorithmId: sha384
+    Digest: "ec7c3b4aae280d870cf4b970b521e3351f57b2cd69b5e6696cc3a6014b258692d330c6fec08298ab66adb3d386624803"
+  EventSize: 67
+  Event:
+    String: |-
+      "grub_cmd: search.fs_uuid c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a root\0"
+- EventNum: 30
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "c90fdbd8bc3928f93d41ef4176a3415df2d584eb"
+  - AlgorithmId: sha256
+    Digest: "679845b798116003dcee938a7e87a07c7b7dd42b5349e54632bbfa82a740541b"
+  - AlgorithmId: sha384
+    Digest: "c72923093dd8b083105397c639763c931800fe96d4e379d980d043c7f8aba3c8f60dada07d9b2a8cebd9762638211365"
+  EventSize: 42
+  Event:
+    String: |-
+      "grub_cmd: set prefix=(hd0,gpt1)/boot/grub\0"
+- EventNum: 31
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "7f7e85909fb37d150f57822c0ad3b636e7853aff"
+  - AlgorithmId: sha256
+    Digest: "5137257cdcec140bce7e0c83c1000df3f7ecf18de11bde46b8d32f49ba657791"
+  - AlgorithmId: sha384
+    Digest: "0ab1f13106b96ec5605b11e504cb8d3a597747f51fe0332a74408c7f9065cb6b654ef2a8c90afa6b8755bcfc5a1f1182"
+  EventSize: 44
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/x86_64-efi/command.lst\0"
+- EventNum: 32
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f091655c7ac7314eb0df21931415de47628d621f"
+  - AlgorithmId: sha256
+    Digest: "32fc7f5de8c0a5dc0b1e7eb609ca31a77eb3475539e1d97a4543dca1b9b26c57"
+  - AlgorithmId: sha384
+    Digest: "73e17c3ea36dea576f107728630b937f74006954f2be9143eb124b76706173d7d9a68c32e7c90f74b0ff5ced89603914"
+  EventSize: 39
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/x86_64-efi/fs.lst\0"
+- EventNum: 33
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "ff00d28114398cf1a052329494d63aceeb8ff29a"
+  - AlgorithmId: sha256
+    Digest: "1b766f38a94927fe9b7bc1e809f0363e778e14c601e800faea271a2e75d3fc43"
+  - AlgorithmId: sha384
+    Digest: "c7d01ae51404411a65b0d26a601a01d63b914e7477825d5ecd87840a36434c6bd956725441b82a66b6581c36bd38fad4"
+  EventSize: 43
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/x86_64-efi/crypto.lst\0"
+- EventNum: 34
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "66b726c6d64bc109d3948a9528f502ea94938ef4"
+  - AlgorithmId: sha256
+    Digest: "46f888c52f36baf9b62d60bc8d06426a314aad5a0ff86a4362a91c2512a1df9c"
+  - AlgorithmId: sha384
+    Digest: "800824fd124df10eeafd6bba36c596c33afbb527e3006b58c19fadced47b03c8ae92f89ef3caef2346b3bd545cfdd8de"
+  EventSize: 45
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/x86_64-efi/terminal.lst\0"
+- EventNum: 35
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "1284bee568af2e320e6a03dce30144182be7d51e"
+  - AlgorithmId: sha256
+    Digest: "874d063ee6d5776d8474fcbaed76cdd44f32572d8454338fef7138347e866d7d"
+  - AlgorithmId: sha384
+    Digest: "ab8c53accc47ffef55c4b607725b4bdac7eb63e4ed7ec2d56550eb0b974ae546b5dfb6b119b9c6569f4737ad9ad79dbb"
+  EventSize: 51
+  Event:
+    String: |-
+      "grub_cmd: configfile (hd0,gpt1)/boot/grub/grub.cfg\0"
+- EventNum: 36
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "35a61aeb146c7d0f13fab9d135f969926e515610"
+  - AlgorithmId: sha256
+    Digest: "60b17900690b284a561dfd1b23c4ea861dc78517a04be80f0419ce3e2da41692"
+  - AlgorithmId: sha384
+    Digest: "b6530120db1db3760f49810e897b016f067d3452a74e6b83d3c059034884949fe1bcd3e8b99e25c5cda3a5d36909d9a1"
+  EventSize: 30
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/grub.cfg\0"
+- EventNum: 37
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "3e5cd7ea0fdc2e2b2f956d41f9090ee3732fb833"
+  - AlgorithmId: sha256
+    Digest: "7e2b3493baa3f9e4c6a836282d1e66b5855692169dee44d46fe20d11dbc17381"
+  - AlgorithmId: sha384
+    Digest: "56bbcd8647a6e5bfe7c8716f3610cefff4aca1b4c31def4ad9f47f7a6cee68bb831fe474026630bed7d053e12aa9751e"
+  EventSize: 46
+  Event:
+    String: |-
+      "grub_cmd:  -s (hd0,gpt1)/boot/grub/grubenv \0"
+- EventNum: 38
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "cff2c89594431f0c3c508fd97f8bb4d2eca36937"
+  - AlgorithmId: sha256
+    Digest: "2d963f969fbd116484ad1f6aa6b6b3eae710aa4c5e759f7d7ce58eb0565e9db6"
+  - AlgorithmId: sha384
+    Digest: "6c6e9ced736b9b1f2d98f0e00af20032817aa9f0eb92cc19ca6d8de7d76a2d612fcdd02e21cd9bd86a1c031be6378884"
+  EventSize: 29
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/grubenv\0"
+- EventNum: 39
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "3c4e9b1198ecc160aff6022c0f96b5b22fab1469"
+  - AlgorithmId: sha256
+    Digest: "0e3a17e0c48e42d79f4d1576e7f787c911239510586505c326143b9b268bdd65"
+  - AlgorithmId: sha384
+    Digest: "541c82f4046719d9bda2729278af735f44e40d779dc860b69b6fc9e4ddc3d1233830fb101dc487f9524ccf5aa152f5f5"
+  EventSize: 32
+  Event:
+    String: |-
+      "grub_cmd: set have_grubenv=true\0"
+- EventNum: 40
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "453dee6ce82bd80ea89bd8085724ae9784ff0f1b"
+  - AlgorithmId: sha256
+    Digest: "f8b99f77983990e8804864cade91f361b5b6600cc2832febaef878ac8b44d27e"
+  - AlgorithmId: sha384
+    Digest: "b0f5c156e035813aeb78d5ec47d4a6c2d0651c884384987907340fd18b45384cdab8cb460b5475427c848868b132887b"
+  EventSize: 19
+  Event:
+    String: |-
+      "grub_cmd: load_env\0"
+- EventNum: 41
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "cff2c89594431f0c3c508fd97f8bb4d2eca36937"
+  - AlgorithmId: sha256
+    Digest: "2d963f969fbd116484ad1f6aa6b6b3eae710aa4c5e759f7d7ce58eb0565e9db6"
+  - AlgorithmId: sha384
+    Digest: "6c6e9ced736b9b1f2d98f0e00af20032817aa9f0eb92cc19ca6d8de7d76a2d612fcdd02e21cd9bd86a1c031be6378884"
+  EventSize: 29
+  Event:
+    String: |-
+      "(hd0,gpt1)/boot/grub/grubenv\0"
+- EventNum: 42
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "b4e99b40d2dddcdf68e8aa439e18dd5ebacbffc9"
+  - AlgorithmId: sha256
+    Digest: "d2b92983e66aff99982fe5af55e0f9277dc0f8879934e17b00147e1f4156179e"
+  - AlgorithmId: sha384
+    Digest: "1b2d9a89f98d0d60ee47648b016de86c2c7840b26bd31248be74c3146a07e0c83e889887fe212a121943ddbdab5d3246"
+  EventSize: 19
+  Event:
+    String: |-
+      "grub_cmd:   = 2 \0"
+- EventNum: 43
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "05ba452bf00b7f880528b35d02e9077f89c08538"
+  - AlgorithmId: sha256
+    Digest: "82a4a14e43a4f76118ae63285d0af05af139f260fae57b2c20737a1c1df3382b"
+  - AlgorithmId: sha384
+    Digest: "ae1061c45b3c25c89cea3f7ddee4640f8e776086f7d62fb4b9c1d56148a1be04bf11de6a395344567b538c6df06d079e"
+  EventSize: 19
+  Event:
+    String: |-
+      "grub_cmd:   = 1 \0"
+- EventNum: 44
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "710cbf237c9abd071ca91c4104324800bec7b0fb"
+  - AlgorithmId: sha256
+    Digest: "ce8124bc1b0fbc0cb5cd47338ca0c7d5f5446d79936e443a201d96b192a7bd65"
+  - AlgorithmId: sha384
+    Digest: "222e2570e52f72bb99f3ef97cb751dd4de0f3a545583ea4d66015680673f74bb27031bd0ca5cb3b58a25ec78ce8f4851"
+  EventSize: 15
+  Event:
+    String: |-
+      "grub_cmd:   \0"
+- EventNum: 45
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "75409120452bbbee30abe289af973ecdd7e0ef6b"
+  - AlgorithmId: sha256
+    Digest: "3a118940bf2675007df3368cb6d45cf2756f328d3e75daf69a971dd21bd1bc58"
+  - AlgorithmId: sha384
+    Digest: "6bf6242f8eb0ca7217c6e3a5d4c6a62e5858440264e84696cd67306ef2db8cf625952d5fd9061daadefd181039479740"
+  EventSize: 24
+  Event:
+    String: |-
+      "grub_cmd: set default=0\0"
+- EventNum: 46
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f5b067e59c163f67b19b836fbee9e8a487a19cdd"
+  - AlgorithmId: sha256
+    Digest: "4568361fb7581b31a42d645ab534302fb9f742adaa37b7fde152215d69e259fb"
+  - AlgorithmId: sha384
+    Digest: "10b1f8d036aefd32ce770311ea00426e147b3daee378dd0679aeda81963b2c5389178787962ce9ea08e5571701cce94a"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  xy = xy \0"
+- EventNum: 47
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "bd5209e50c09650ffcf5c2d12a8be8277e438023"
+  - AlgorithmId: sha256
+    Digest: "09f17d4dfb4b97f16246632c21b1ac2125c95c148899eee5069fbb1b34365513"
+  - AlgorithmId: sha384
+    Digest: "8661953f518c898cb9407c831fa60654fdaf9804d25d99cbc31fd15255b532bad044c390b7a63b2961eed1e9beac6603"
+  EventSize: 35
+  Event:
+    String: |-
+      "grub_cmd: menuentry_id_option=--id\0"
+- EventNum: 48
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "6248599bae0d78ccbda185ed2fce0182ed41e297"
+  - AlgorithmId: sha256
+    Digest: "4af0bb370c9e3b7982027d02e04c935e32d52b528007476bfc50d36d1b86815e"
+  - AlgorithmId: sha384
+    Digest: "952dce390ea9e283ee7b3defb664fc8d7f942a9598bd8b6d20a9843b28786ec7c27f6bafa28c0c16013cfb88dbb7b568"
+  EventSize: 37
+  Event:
+    String: |-
+      "grub_cmd: export menuentry_id_option\0"
+- EventNum: 49
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "710cbf237c9abd071ca91c4104324800bec7b0fb"
+  - AlgorithmId: sha256
+    Digest: "ce8124bc1b0fbc0cb5cd47338ca0c7d5f5446d79936e443a201d96b192a7bd65"
+  - AlgorithmId: sha384
+    Digest: "222e2570e52f72bb99f3ef97cb751dd4de0f3a545583ea4d66015680673f74bb27031bd0ca5cb3b58a25ec78ce8f4851"
+  EventSize: 15
+  Event:
+    String: |-
+      "grub_cmd:   \0"
+- EventNum: 50
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "7dc272da02b00e0ee2958961bb99a2e3196ec24a"
+  - AlgorithmId: sha256
+    Digest: "df24f1cae6b428fdd09bc14b06df255f93060ff05d56c3127724168596f73d5f"
+  - AlgorithmId: sha384
+    Digest: "5cd34cee9ce24ca6e401a80ecb4654031bfbcfe5c5b21c19f2d990676f8453e89a69ecf4a153c2b025ff7ba4b03a2e2a"
+  EventSize: 33
+  Event:
+    String: |-
+      "grub_cmd: terminal_input console\0"
+- EventNum: 51
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "155e201c47f534b1201190d61e9d178a525540e6"
+  - AlgorithmId: sha256
+    Digest: "fed7c930939012174a23271f9fa177a39891cd1baf6ccd22bccce96acd0514d1"
+  - AlgorithmId: sha384
+    Digest: "a47d5422ef1405120a2246a55bc4e6f60de6f4aa0410dc205d5e80ba9dce7ab480ac93a026d1751202b2e68ba3a0694c"
+  EventSize: 34
+  Event:
+    String: |-
+      "grub_cmd: terminal_output console\0"
+- EventNum: 52
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "05ba452bf00b7f880528b35d02e9077f89c08538"
+  - AlgorithmId: sha256
+    Digest: "82a4a14e43a4f76118ae63285d0af05af139f260fae57b2c20737a1c1df3382b"
+  - AlgorithmId: sha384
+    Digest: "ae1061c45b3c25c89cea3f7ddee4640f8e776086f7d62fb4b9c1d56148a1be04bf11de6a395344567b538c6df06d079e"
+  EventSize: 19
+  Event:
+    String: |-
+      "grub_cmd:   = 1 \0"
+- EventNum: 53
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f5b067e59c163f67b19b836fbee9e8a487a19cdd"
+  - AlgorithmId: sha256
+    Digest: "4568361fb7581b31a42d645ab534302fb9f742adaa37b7fde152215d69e259fb"
+  - AlgorithmId: sha384
+    Digest: "10b1f8d036aefd32ce770311ea00426e147b3daee378dd0679aeda81963b2c5389178787962ce9ea08e5571701cce94a"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  xy = xy \0"
+- EventNum: 54
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "58795e8592d9ff3b6b39add68ddba958eff547a2"
+  - AlgorithmId: sha256
+    Digest: "61caa54fc24ba8b3e79be63f375a08f374244e4ede8e0d6080060aa3fa5f7fbb"
+  - AlgorithmId: sha384
+    Digest: "9f76cda76fd82e4b45a00f258357a71046172ea7dee437017ad0d94b489f7d8b021f121044e7886542f5dc8a1cf15617"
+  EventSize: 35
+  Event:
+    String: |-
+      "grub_cmd: set timeout_style=hidden\0"
+- EventNum: 55
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9d31b8e60e42fe9361ef5990996db527824f9022"
+  - AlgorithmId: sha256
+    Digest: "cdf593a612aaaaeb957243bb1e8e27d96f4c726ec523cd38290382bdf1faf54d"
+  - AlgorithmId: sha384
+    Digest: "9c452ba5b9a6104c8ed813cc0692b7e69c76c0ff1ce99fc0f38940f540b465b86b1e8f556885eb5acce9f10e6cef1b0d"
+  EventSize: 26
+  Event:
+    String: |-
+      "grub_cmd: set timeout=0.1\0"
+- EventNum: 56
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "55cfd6463ef334abb6b48080b33ec063a9c051eb"
+  - AlgorithmId: sha256
+    Digest: "cfa4676ffe751d1547e77a8d66a033b59b3eed3400d9b3a305d2601891ab0e59"
+  - AlgorithmId: sha384
+    Digest: "934aafc99cb0a7cb1ef83c5a1eb01c31d60927f08b2ff72d2c05e0b4660ed1dd1e139738b3c5630502e629e8f593d7af"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  -n true \0"
+- EventNum: 57
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "7a86009dc1f23867d8951bb95471618bde2d1918"
+  - AlgorithmId: sha256
+    Digest: "2436afe3cb181454ab807d6ca526ed3132dc1759787f9ed3f2f148e86948e978"
+  - AlgorithmId: sha384
+    Digest: "4cf726ecd422b56df71dca2f377cb2a4ee6d9ca1f5b44096f8fc6607b73b56d0effc393100c506a93327511a72cbf707"
+  EventSize: 18
+  Event:
+    String: |-
+      "grub_cmd:  -n  \0"
+- EventNum: 58
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "5e1cea54b6044a1b5341cccdf101a5f9fbfc101b"
+  - AlgorithmId: sha256
+    Digest: "681e45c7ba76e7c4bec5a79dead78461eb175b67656e03f4809aa012d275c823"
+  - AlgorithmId: sha384
+    Digest: "21140b393213229d532701ca514452dbb33a28d37d1a62f424aadf68d3b87817cebd7f6cd183ebc2191ff427a5cc11ef"
+  EventSize: 51
+  Event:
+    String: |-
+      "grub_cmd: set initrdless_boot_fallback_triggered=0\0"
+- EventNum: 59
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "eb11507f1980d7ea78190040b49c79cf3a6c6b93"
+  - AlgorithmId: sha256
+    Digest: "01ffa4a5eae6be98974c1b75e839f442eed9d9f5c1d65c03d355e04fc81d2873"
+  - AlgorithmId: sha384
+    Digest: "8e0666266caf626cedc801ac78249b0e70cca2936ae65826a8b0baaca9c6aa9bc84e1156b02b7749ac1e7ad797c6fe6a"
+  EventSize: 54
+  Event:
+    String: |-
+      "grub_cmd: save_env initrdless_boot_fallback_triggered\0"
+- EventNum: 60
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "0d570854895a5a9ce25dc6c25026278c2d1a6367"
+  - AlgorithmId: sha256
+    Digest: "207cda95fd859189d016c7c2cc03b9c05672984589e4809e1dcee665d629cf7d"
+  - AlgorithmId: sha384
+    Digest: "697c60cddf7d386b91a21c6bd5005181777d52d625ae27fd61036ef4424c57d4b2b97552b484177d628761a396148dac"
+  EventSize: 44
+  Event:
+    String: |-
+      "grub_cmd: set menu_color_normal=white/black\0"
+- EventNum: 61
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d4a516aec1bccafec65420d98fcb243aa465d837"
+  - AlgorithmId: sha256
+    Digest: "6f18799fe0ecb5c4bb4c0695a3094dc9841c940c3b463e14c25e444246348a2a"
+  - AlgorithmId: sha384
+    Digest: "4eeef8dcc4a61638868d1dca696cad45913d3922b90ea7f264ba78f02e1f80095c9b668229ecff972c4cc586b14d9870"
+  EventSize: 52
+  Event:
+    String: |-
+      "grub_cmd: set menu_color_highlight=black/light-gray\0"
+- EventNum: 62
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f0ea058e7e94c1de682ed36c367c8e02c8a1fbd9"
+  - AlgorithmId: sha256
+    Digest: "d892fc45719b7363b8121ef243a8abb7577db336676532876620fcc24c1d45a2"
+  - AlgorithmId: sha384
+    Digest: "d280f592667201a4b811f185cfab0e290407db1982f30ff5036aa124ca64e5710bd457864b3f40924afd53452ee37daf"
+  EventSize: 60
+  Event:
+    String: |-
+      "grub_cmd: set partuuid=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f\0"
+- EventNum: 63
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "423287a40b914bb51497db32f9086697d1fb9e12"
+  - AlgorithmId: sha256
+    Digest: "f0b4b3c23103828ea2fa05044a2cfce5efc9d15e99ffb9c61d7349c1303741af"
+  - AlgorithmId: sha384
+    Digest: "7a5ac0796fa82f4efa88b6213985b213d878e64988066a9958760166cf85c5f4778a00a3cf84952c18a6cad3f38553cb"
+  EventSize: 20
+  Event:
+    String: |-
+      "grub_cmd:   != 1 \0"
+- EventNum: 64
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "292cce90d28e1736a8e914e8540d9bf0e3cb3691"
+  - AlgorithmId: sha256
+    Digest: "5d884e52d0e191d8821b77c7a853a89a2d05844743c8e98187b474d800f1c7e6"
+  - AlgorithmId: sha384
+    Digest: "a5e07cfc9671766b7f9bb83873c6ff4bed7dfbb927d5b0273d2aebb930dba4630c372075a092dbd7c5495fafa7453ed0"
+  EventSize: 55
+  Event:
+    String: |-
+      "grub_cmd:  -e (hd0,gpt1)/boot/grub/gfxblacklist.txt \0"
+- EventNum: 65
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "3c478e70547a82a4000a6941b85af79242734271"
+  - AlgorithmId: sha256
+    Digest: "c08a8b76f5bc9ce36f6af0d203c7c1d54be9cee4c74c7e4d52bf7821edcca28f"
+  - AlgorithmId: sha384
+    Digest: "1754fc7f385a671597fbf1a2ad0c93c6748d29da5eaee6f40f7b7c5a2611c990da2d88620ecd1a866d03f89ec82a556b"
+  EventSize: 58
+  Event:
+    String: |-
+      "grub_cmd: hwmatch (hd0,gpt1)/boot/grub/gfxblacklist.txt 3\0"
+- EventNum: 66
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "6bcfa9ba9fe5adc995142ad3074b66402dc0a7a6"
+  - AlgorithmId: sha256
+    Digest: "a36de0798eb0ac94d6edf367749c0ced605c5b92d74b83312f94132434f549e5"
+  - AlgorithmId: sha384
+    Digest: "5270439d089d97e0a03b28b358a87c3929665c1b6c93daf7a8b71d8cd5a52952ba821a0c2d440038628cda61712de01d"
+  EventSize: 18
+  Event:
+    String: |-
+      "grub_cmd:  = 0 \0"
+- EventNum: 67
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "68977a27d93c5e2836f7c54d624dd48feec0f67d"
+  - AlgorithmId: sha256
+    Digest: "f249e761a7e37510f8acf59142c117444c3aa1bc5a719ae7eab60d3b7109180a"
+  - AlgorithmId: sha384
+    Digest: "e16fb8446b3d8cdc0e33185504b69e3d00d9646d5c71c42311c1dbaa996451a9f1910b70f8fa1d97e6a4ec3abe6bf48d"
+  EventSize: 34
+  Event:
+    String: |-
+      "grub_cmd: set linux_gfx_mode=keep\0"
+- EventNum: 68
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9deef0fa444e59d7a08e615f25628826e7feddf9"
+  - AlgorithmId: sha256
+    Digest: "22e041251eb54eeb3270245759aa3e8bd3b77a647db988b681b1eafc6960aa45"
+  - AlgorithmId: sha384
+    Digest: "f5e5365d6e97649411362c83e2e8808f7c19efa11d4f16d4ac66093214510beed55448882cbbdda8f0164688465905b0"
+  EventSize: 32
+  Event:
+    String: |-
+      "grub_cmd: export linux_gfx_mode\0"
+- EventNum: 69
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "cf64c383ab75ebe55cb542af42efa01a47b86280"
+  - AlgorithmId: sha256
+    Digest: "577db70e3460e11bdb32e3dc5374bb89736cf9397477dcc1e4d4fad162015900"
+  - AlgorithmId: sha384
+    Digest: "ba3e98910b1f1d534da9d112008728603800e461c7410065a7ff6107e22e9ef8ffdc16950932febd36922d6d1a1df8ed"
+  EventSize: 1160
+  Event:
+    String: |-
+      "grub_cmd: menuentry Ubuntu --class ubuntu --class gnu-linux --class gnu --class os --id gnulinux-simple-c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a {"
+      "\trecordfail"
+      "\tload_video"
+      "\tgfxmode $linux_gfx_mode"
+      "\tinsmod gzio"
+      "\tif  x$grub_platform = xxen ; then insmod xzio; insmod lzopio; fi"
+      "\tinsmod part_gpt"
+      "\tinsmod ext2"
+      "\tset root=\'hd0,gpt1\'"
+      "\tif  x$feature_platform_search_hint = xy ; then"
+      "\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\telse"
+      "\t  search --no-floppy --fs-uuid --set=root c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\tfi"
+      "\tif  "${initrdfail}" = 1 ; then"
+      "\t  echo\t\'GRUB_FORCE_PARTUUID set, initrdless boot failed. Attempting with initrd.\'"
+      "\t  linux\t/boot/vmlinuz-5.11.0-1008-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro scsi_mod.use_blk_mq=Y ima_hash=sha256 console=ttyS0"
+      "\t  initrd\t/boot/initrd.img-5.11.0-1008-gcp"
+      "\telse"
+      "\t  echo\t\'GRUB_FORCE_PARTUUID set, attempting initrdless boot.\'"
+      "\t  linux\t/boot/vmlinuz-5.11.0-1008-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro scsi_mod.use_blk_mq=Y ima_hash=sha256 console=ttyS0 panic=-1"
+      "\tfi"
+      "\tinitrdfail"
+      "}\0"
+- EventNum: 70
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "af6d6420510c54acb9bae20c45fc4fdd9eaa4ff6"
+  - AlgorithmId: sha256
+    Digest: "5356e324ba760d7f33f96426fec805aa856c4960b540ad2fd53700403063e642"
+  - AlgorithmId: sha384
+    Digest: "84dbd33027441f7e35b2aa4559eca8b55d59b4cbb8619c5e691dcb1b379784b1c7955823ea20cc61406b359f9f5db4ab"
+  EventSize: 5454
+  Event:
+    String: |-
+      "grub_cmd: submenu Advanced options for Ubuntu --id gnulinux-advanced-c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a {"
+      "\tmenuentry \'Ubuntu, with Linux 5.11.0-1008-gcp\' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option \'gnulinux-5.11.0-1008-gcp-advanced-c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a\' {"
+      "\t\trecordfail"
+      "\t\tload_video"
+      "\t\tgfxmode $linux_gfx_mode"
+      "\t\tinsmod gzio"
+      "\t\tif  x$grub_platform = xxen ; then insmod xzio; insmod lzopio; fi"
+      "\t\tinsmod part_gpt"
+      "\t\tinsmod ext2"
+      "\t\tset root=\'hd0,gpt1\'"
+      "\t\tif  x$feature_platform_search_hint = xy ; then"
+      "\t\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\telse"
+      "\t\t  search --no-floppy --fs-uuid --set=root c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\tfi"
+      "\t\techo\t\'Loading Linux 5.11.0-1008-gcp ...\'"
+      "\t\tif  "${initrdfail}" = 1 ; then"
+      "\t\t  echo\t\'GRUB_FORCE_PARTUUID set, initrdless boot failed. Attempting with initrd.\'"
+      "\t\t  linux\t/boot/vmlinuz-5.11.0-1008-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro scsi_mod.use_blk_mq=Y ima_hash=sha256 console=ttyS0"
+      "\t\t  echo\t\'Loading initial ramdisk ...\'"
+      "\t\t  initrd\t/boot/initrd.img-5.11.0-1008-gcp"
+      "\t\telse"
+      "\t\t  echo\t\'GRUB_FORCE_PARTUUID set, attempting initrdless boot.\'"
+      "\t\t  linux\t/boot/vmlinuz-5.11.0-1008-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro scsi_mod.use_blk_mq=Y ima_hash=sha256 console=ttyS0 panic=-1"
+      "\t\tfi"
+      "\t\tinitrdfail"
+      "\t}"
+      "\tmenuentry \'Ubuntu, with Linux 5.11.0-1008-gcp (recovery mode)\' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option \'gnulinux-5.11.0-1008-gcp-recovery-c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a\' {"
+      "\t\trecordfail"
+      "\t\tload_video"
+      "\t\tinsmod gzio"
+      "\t\tif  x$grub_platform = xxen ; then insmod xzio; insmod lzopio; fi"
+      "\t\tinsmod part_gpt"
+      "\t\tinsmod ext2"
+      "\t\tset root=\'hd0,gpt1\'"
+      "\t\tif  x$feature_platform_search_hint = xy ; then"
+      "\t\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\telse"
+      "\t\t  search --no-floppy --fs-uuid --set=root c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\tfi"
+      "\t\techo\t\'Loading Linux 5.11.0-1008-gcp ...\'"
+      "\t\tif  "${initrdfail}" = 1 ; then"
+      "\t\t  echo\t\'GRUB_FORCE_PARTUUID set, initrdless boot failed. Attempting with initrd.\'"
+      "\t\t  linux\t/boot/vmlinuz-5.11.0-1008-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro recovery nomodeset dis_ucode_ldr scsi_mod.use_blk_mq=Y ima_hash=sha256"
+      "\t\t  echo\t\'Loading initial ramdisk ...\'"
+      "\t\t  initrd\t/boot/initrd.img-5.11.0-1008-gcp"
+      "\t\telse"
+      "\t\t  echo\t\'GRUB_FORCE_PARTUUID set, attempting initrdless boot.\'"
+      "\t\t  linux\t/boot/vmlinuz-5.11.0-1008-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro recovery nomodeset dis_ucode_ldr scsi_mod.use_blk_mq=Y ima_hash=sha256 panic=-1"
+      "\t\tfi"
+      "\t\tinitrdfail"
+      "\t}"
+      "\tmenuentry \'Ubuntu, with Linux 5.11.0-1007-gcp\' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option \'gnulinux-5.11.0-1007-gcp-advanced-c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a\' {"
+      "\t\trecordfail"
+      "\t\tload_video"
+      "\t\tgfxmode $linux_gfx_mode"
+      "\t\tinsmod gzio"
+      "\t\tif  x$grub_platform = xxen ; then insmod xzio; insmod lzopio; fi"
+      "\t\tinsmod part_gpt"
+      "\t\tinsmod ext2"
+      "\t\tset root=\'hd0,gpt1\'"
+      "\t\tif  x$feature_platform_search_hint = xy ; then"
+      "\t\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\telse"
+      "\t\t  search --no-floppy --fs-uuid --set=root c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\tfi"
+      "\t\techo\t\'Loading Linux 5.11.0-1007-gcp ...\'"
+      "\t\tif  "${initrdfail}" = 1 ; then"
+      "\t\t  echo\t\'GRUB_FORCE_PARTUUID set, initrdless boot failed. Attempting with initrd.\'"
+      "\t\t  linux\t/boot/vmlinuz-5.11.0-1007-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro scsi_mod.use_blk_mq=Y ima_hash=sha256 console=ttyS0"
+      "\t\t  echo\t\'Loading initial ramdisk ...\'"
+      "\t\t  initrd\t/boot/initrd.img-5.11.0-1007-gcp"
+      "\t\telse"
+      "\t\t  echo\t\'GRUB_FORCE_PARTUUID set, attempting initrdless boot.\'"
+      "\t\t  linux\t/boot/vmlinuz-5.11.0-1007-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro scsi_mod.use_blk_mq=Y ima_hash=sha256 console=ttyS0 panic=-1"
+      "\t\tfi"
+      "\t\tinitrdfail"
+      "\t}"
+      "\tmenuentry \'Ubuntu, with Linux 5.11.0-1007-gcp (recovery mode)\' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option \'gnulinux-5.11.0-1007-gcp-recovery-c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a\' {"
+      "\t\trecordfail"
+      "\t\tload_video"
+      "\t\tinsmod gzio"
+      "\t\tif  x$grub_platform = xxen ; then insmod xzio; insmod lzopio; fi"
+      "\t\tinsmod part_gpt"
+      "\t\tinsmod ext2"
+      "\t\tset root=\'hd0,gpt1\'"
+      "\t\tif  x$feature_platform_search_hint = xy ; then"
+      "\t\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\telse"
+      "\t\t  search --no-floppy --fs-uuid --set=root c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\tfi"
+      "\t\techo\t\'Loading Linux 5.11.0-1007-gcp ...\'"
+      "\t\tif  "${initrdfail}" = 1 ; then"
+      "\t\t  echo\t\'GRUB_FORCE_PARTUUID set, initrdless boot failed. Attempting with initrd.\'"
+      "\t\t  linux\t/boot/vmlinuz-5.11.0-1007-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro recovery nomodeset dis_ucode_ldr scsi_mod.use_blk_mq=Y ima_hash=sha256"
+      "\t\t  echo\t\'Loading initial ramdisk ...\'"
+      "\t\t  initrd\t/boot/initrd.img-5.11.0-1007-gcp"
+      "\t\telse"
+      "\t\t  echo\t\'GRUB_FORCE_PARTUUID set, attempting initrdless boot.\'"
+      "\t\t  linux\t/boot/vmlinuz-5.11.0-1007-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro recovery nomodeset dis_ucode_ldr scsi_mod.use_blk_mq=Y ima_hash=sha256 panic=-1"
+      "\t\tfi"
+      "\t\tinitrdfail"
+      "\t}"
+      "}\0"
+- EventNum: 71
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "5d7f65b8d5132e408111dda7d05a00c80bee5bb1"
+  - AlgorithmId: sha256
+    Digest: "5edb07405e8f25edc31321321014a3cdb3dc264835dd2b76ea94848416392cab"
+  - AlgorithmId: sha384
+    Digest: "08749dcd94ec0ed4f8558679a5ee41179ecf47a44ea00b49415d1f1ca584bc1bc1001ffecf8660303009ccb88278598b"
+  EventSize: 717
+  Event:
+    String: |-
+      "grub_cmd: menuentry Ubuntu 21.04 (21.04) (on /dev/sda1) --class ubuntu --class gnu-linux --class gnu --class os --id osprober-gnulinux-simple-c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a {"
+      "\tinsmod part_gpt"
+      "\tinsmod ext2"
+      "\tset root=\'hd0,gpt1\'"
+      "\tif  x$feature_platform_search_hint = xy ; then"
+      "\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\telse"
+      "\t  search --no-floppy --fs-uuid --set=root c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\tfi"
+      "\tlinux /boot/vmlinuz-5.11.0-1007-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro scsi_mod.use_blk_mq=Y ima_hash=sha256 console=ttyS0 panic=-1"
+      "\tinitrd /boot/initrd.img-5.11.0-1007-gcp"
+      "}\0"
+- EventNum: 72
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f6f8b410d3af65f7509e9fc09356db34359500ff"
+  - AlgorithmId: sha256
+    Digest: "83f4f5f542b92465b12675543fe698418fc5fd5846abc6f94761be41514fb980"
+  - AlgorithmId: sha384
+    Digest: "4e2a4f1fd7f20ac2af06039252e8e2bdaa16b5129b0af865ae560e18bba9a28852efa6655423b6d6099c245384096047"
+  EventSize: 2574
+  Event:
+    String: |-
+      "grub_cmd: submenu Advanced options for Ubuntu 21.04 (21.04) (on /dev/sda1) --id osprober-gnulinux-advanced-c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a {"
+      "\tmenuentry \'Ubuntu (on /dev/sda1)\' --class gnu-linux --class gnu --class os $menuentry_id_option \'osprober-gnulinux-/boot/vmlinuz-5.11.0-1007-gcp--c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a\' {"
+      "\t\tinsmod part_gpt"
+      "\t\tinsmod ext2"
+      "\t\tset root=\'hd0,gpt1\'"
+      "\t\tif  x$feature_platform_search_hint = xy ; then"
+      "\t\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\telse"
+      "\t\t  search --no-floppy --fs-uuid --set=root c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\tfi"
+      "\t\tlinux /boot/vmlinuz-5.11.0-1007-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro scsi_mod.use_blk_mq=Y ima_hash=sha256 console=ttyS0 panic=-1"
+      "\t\tinitrd /boot/initrd.img-5.11.0-1007-gcp"
+      "\t}"
+      "\tmenuentry \'Ubuntu, with Linux 5.11.0-1007-gcp (on /dev/sda1)\' --class gnu-linux --class gnu --class os $menuentry_id_option \'osprober-gnulinux-/boot/vmlinuz-5.11.0-1007-gcp--c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a\' {"
+      "\t\tinsmod part_gpt"
+      "\t\tinsmod ext2"
+      "\t\tset root=\'hd0,gpt1\'"
+      "\t\tif  x$feature_platform_search_hint = xy ; then"
+      "\t\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\telse"
+      "\t\t  search --no-floppy --fs-uuid --set=root c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\tfi"
+      "\t\tlinux /boot/vmlinuz-5.11.0-1007-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro scsi_mod.use_blk_mq=Y ima_hash=sha256 console=ttyS0 panic=-1"
+      "\t\tinitrd /boot/initrd.img-5.11.0-1007-gcp"
+      "\t}"
+      "\tmenuentry \'Ubuntu, with Linux 5.11.0-1007-gcp (recovery mode) (on /dev/sda1)\' --class gnu-linux --class gnu --class os $menuentry_id_option \'osprober-gnulinux-/boot/vmlinuz-5.11.0-1007-gcp-root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro recovery nomodeset dis_ucode_ldr scsi_mod.use_blk_mq=Y ima_hash=sha256 panic=-1-c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a\' {"
+      "\t\tinsmod part_gpt"
+      "\t\tinsmod ext2"
+      "\t\tset root=\'hd0,gpt1\'"
+      "\t\tif  x$feature_platform_search_hint = xy ; then"
+      "\t\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\telse"
+      "\t\t  search --no-floppy --fs-uuid --set=root c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a"
+      "\t\tfi"
+      "\t\tlinux /boot/vmlinuz-5.11.0-1007-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro recovery nomodeset dis_ucode_ldr scsi_mod.use_blk_mq=Y ima_hash=sha256 panic=-1"
+      "\t\tinitrd /boot/initrd.img-5.11.0-1007-gcp"
+      "\t}"
+      "}\0"
+- EventNum: 73
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "c512092b0481234caa416ef7c196ab4e92b8e002"
+  - AlgorithmId: sha256
+    Digest: "1c568398cf2e4a9df58875bbd79dffe058ec45be0b74512fa919a2fe7db4a609"
+  - AlgorithmId: sha384
+    Digest: "25c0d8bcdfb40c73ce2820b8589c44b0b81b2501f7b7f9fd54585616b1b03adef28b6eb043e0ca69146a729ea029e626"
+  EventSize: 33
+  Event:
+    String: |-
+      "grub_cmd: set timeout_style=menu\0"
+- EventNum: 74
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "e8b3744ad947f0758b4486546f78fd6e5a5fad54"
+  - AlgorithmId: sha256
+    Digest: "228f734cf81b603abcdb75f8ce4631e4c1d8f377778a442bccf2ede0bb68ee01"
+  - AlgorithmId: sha384
+    Digest: "f303694e244f1e2193c193b22f5d252aadf600802004d75a1e9920922a4927f6649e83cf34e4d4bb1916d7223ba59b3a"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  0.1 = 0 \0"
+- EventNum: 75
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "3db846d3d718840d4dac10b86396a422ccd4d31f"
+  - AlgorithmId: sha256
+    Digest: "716ce335760b546fad1e7f980a68b9ab64b9e0a050f2c2da4ebddb7d3ebea559"
+  - AlgorithmId: sha384
+    Digest: "c30a0e3a9357f2867ae466fcf0d5023c62a237d41b125316aac3bf39d5f5229792d7da9b42602e4770453834fcc28bea"
+  EventSize: 75
+  Event:
+    String: |-
+      "grub_cmd: menuentry UEFI Firmware Settings --id uefi-firmware {"
+      "\tfwsetup"
+      "}\0"
+- EventNum: 76
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "273f5c80c12e935c1d37c2cfe3e161bc42d79d8e"
+  - AlgorithmId: sha256
+    Digest: "1ea37430950c837021ebcc02f98c12018c31e593e366429436e1353584c7ec72"
+  - AlgorithmId: sha384
+    Digest: "aed896a21fb16121568dd93ed2334c6a8415660b3495cd1ec9e8962e1f87639fd8cf41c94e8a48841be19a2bc103e100"
+  EventSize: 49
+  Event:
+    String: |-
+      "grub_cmd:  -f (hd0,gpt1)/boot/grub/custom.cfg \0"
+- EventNum: 77
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "a3326df3194201575e51c3b9a1c8d5d17aeff2d0"
+  - AlgorithmId: sha256
+    Digest: "d5478d9057580531bf6ff37383b01bb78e1279c20a23721aa3a67ad0d1ca35db"
+  - AlgorithmId: sha384
+    Digest: "fbb38645486103b1baa77a61576d342c27c0d02597649825cee44c16f658af2b0ad8aa4996e16b9b6c32b1e38f3bb41a"
+  EventSize: 76
+  Event:
+    String: |-
+      "grub_cmd:  -z (hd0,gpt1)/boot/grub -a -f (hd0,gpt1)/boot/grub/custom.cfg \0"
+- EventNum: 78
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "17c76a65ebda6aa310da041aabbcd6483bf00df4"
+  - AlgorithmId: sha256
+    Digest: "bf5d10a466c0f77818990a9d0fdcc8fa2c4561ba92912d5fbc9d4ac1e31a00fb"
+  - AlgorithmId: sha384
+    Digest: "a30a7be4fb9beb8b2282ff1414d0a47eb11b36471a2628d4284bd9ae8e8a74a8e15f0a1e84b413636db7692a4a60cc1a"
+  EventSize: 27
+  Event:
+    String: |-
+      "grub_cmd: setparams Ubuntu\0"
+- EventNum: 79
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "98d066f8ffd046bacb38b106188cbe7fe9ada729"
+  - AlgorithmId: sha256
+    Digest: "a57e067e286efc4eea89659d40f13a38cc1792e4277bed820ded674c94bf2ead"
+  - AlgorithmId: sha384
+    Digest: "b0bb85ff789f25dd63e341736b94f4bf3acd1cff1c1df60bd3ffca5789eb737d2817a39af66de46640134bfbbb20dad7"
+  EventSize: 21
+  Event:
+    String: |-
+      "grub_cmd: recordfail\0"
+- EventNum: 80
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "bac17085fef5043662a50cef18bf366844c074ff"
+  - AlgorithmId: sha256
+    Digest: "64bda8f65b1585d7868248a292c449660cc8f75075c10d87ae59a4db401ce119"
+  - AlgorithmId: sha384
+    Digest: "b353cf9833059be9abadf180d83abeb5eeeec00843b3f22476bb5db0ba2f4361a0260af3460aecb3c124eda90b6ca7a2"
+  EventSize: 27
+  Event:
+    String: |-
+      "grub_cmd: set recordfail=1\0"
+- EventNum: 81
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "55cfd6463ef334abb6b48080b33ec063a9c051eb"
+  - AlgorithmId: sha256
+    Digest: "cfa4676ffe751d1547e77a8d66a033b59b3eed3400d9b3a305d2601891ab0e59"
+  - AlgorithmId: sha384
+    Digest: "934aafc99cb0a7cb1ef83c5a1eb01c31d60927f08b2ff72d2c05e0b4660ed1dd1e139738b3c5630502e629e8f593d7af"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  -n true \0"
+- EventNum: 82
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d31e5f156b716d7835b261891644bb5f7f65e285"
+  - AlgorithmId: sha256
+    Digest: "4e7a22f96bae467df0f26975e0bf7614d6b92993301c65bae6a85c6530e460bf"
+  - AlgorithmId: sha384
+    Digest: "fef379383e771fed457fecfc7148e008c90234d0526b282690c57c93802cc9623c25923689de1c2fcb62669f10e3e1e1"
+  EventSize: 18
+  Event:
+    String: |-
+      "grub_cmd:  -z  \0"
+- EventNum: 83
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "925ee69b7c8ac4937cbe47d5c85351d869b4e8d7"
+  - AlgorithmId: sha256
+    Digest: "ce2cc20777ba8d3bc75b662163c3abe370344d4bae17d75fb5bd408d1fb6badf"
+  - AlgorithmId: sha384
+    Digest: "022e47c5e49bf3c934f488fcc07318489550a64db62aa07ca044c9dd9c2a0ff90637641b7c87bd77e3383e70039ea0fa"
+  EventSize: 30
+  Event:
+    String: |-
+      "grub_cmd: save_env recordfail\0"
+- EventNum: 84
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "8fe59e66d6ec198420477f24f791e929f153e144"
+  - AlgorithmId: sha256
+    Digest: "7626abd8be7442c2e575364a3e95cb3a3b533c58afbba402d2bdabdff85d29c7"
+  - AlgorithmId: sha384
+    Digest: "cbb709d13faf7d16f191751ae275f22a003503389e2e490a60cff78beb3cd546222d591904d51987487f03cdbd41e479"
+  EventSize: 21
+  Event:
+    String: |-
+      "grub_cmd: load_video\0"
+- EventNum: 85
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f5b067e59c163f67b19b836fbee9e8a487a19cdd"
+  - AlgorithmId: sha256
+    Digest: "4568361fb7581b31a42d645ab534302fb9f742adaa37b7fde152215d69e259fb"
+  - AlgorithmId: sha384
+    Digest: "10b1f8d036aefd32ce770311ea00426e147b3daee378dd0679aeda81963b2c5389178787962ce9ea08e5571701cce94a"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  xy = xy \0"
+- EventNum: 86
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "59ced343b060b7df54fa7ba251ef877940601ee4"
+  - AlgorithmId: sha256
+    Digest: "d71353f5368eb2c1280590928128979bd96ea8db1e8c81493f7878383b76ab3b"
+  - AlgorithmId: sha384
+    Digest: "147bbdcd0704d1942b2171a097e7b08384f106cac76f7d5737e5fee2bc2e38dedb821b91e09ac184b46bb4dc86b4a8af"
+  EventSize: 27
+  Event:
+    String: |-
+      "grub_cmd: insmod all_video\0"
+- EventNum: 87
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "13ad1a8ddf647c8148f1739b6081d7838816b59f"
+  - AlgorithmId: sha256
+    Digest: "2fa8065d9ee309384d35f8d530186b776d26e1bb5632f89a46d56e93b140282b"
+  - AlgorithmId: sha384
+    Digest: "f27a8ddb553135ee8002572775ae390b1bc7443ebbe11b863cd79ae66b2065cd02e98cfb170b897112986a88cd071ef8"
+  EventSize: 23
+  Event:
+    String: |-
+      "grub_cmd: gfxmode keep\0"
+- EventNum: 88
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "2e1c676ddd9b16f0d720cd5c66d85732de7b77b6"
+  - AlgorithmId: sha256
+    Digest: "15a5018b0177cf9c49c0b97911df67e7f2c193d3613e3fc4c9eb98a2b5d06fcc"
+  - AlgorithmId: sha384
+    Digest: "7c5ea1b10ba69215090e2490e10f9d2db5f6a5b0eb6e08d366cceb8acb4478857242221cf56323a493d1b3a958fa137c"
+  EventSize: 30
+  Event:
+    String: |-
+      "grub_cmd: set gfxpayload=keep\0"
+- EventNum: 89
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "5241b5dfa58679895d95f79ffa0a5f42ba4b55ea"
+  - AlgorithmId: sha256
+    Digest: "b55d84bbb0a00f175ebbc6ca167f18dd6a9cb49b141535bfcc6c4ef9c53b1866"
+  - AlgorithmId: sha384
+    Digest: "f7c74459bb0d16f8ae24911858879c7fcab3b8af909d811d945e09f7b16977bd65a819128d0b5c88ff29cb76f381bdd6"
+  EventSize: 26
+  Event:
+    String: |-
+      "grub_cmd:  keep = keep \0"
+- EventNum: 90
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "886e1d072aa199f4f6d21499067e0a148ae8046b"
+  - AlgorithmId: sha256
+    Digest: "141dcfd03b1736e86f617122e7f31cffe89f7cf0faa773f1bced28f7f0c1fa13"
+  - AlgorithmId: sha384
+    Digest: "8bc8e8c561f27f5988be9e69da2a00f626c7d3c735f599abcf27f83c02530ca76847dc5e15007f490e2f417a24b2f457"
+  EventSize: 38
+  Event:
+    String: |-
+      "grub_cmd: set vt_handoff=vt.handoff=7\0"
+- EventNum: 91
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "ba509ca38210f0683c477c9dc40e4c4f653e1dfb"
+  - AlgorithmId: sha256
+    Digest: "6c4674d4c652ee67b98a6206d7541ccbf2d5dc0a18dae31ad66e82c794c49784"
+  - AlgorithmId: sha384
+    Digest: "862ae797615324fd5c153dfbfcb226391262855ed2db2969f98456f0da17b6aa1c8aa2e2fe90bc1567295786a83c5371"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd: insmod gzio\0"
+- EventNum: 92
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "2de845dce8a51c8fddbaa04686760093325b7569"
+  - AlgorithmId: sha256
+    Digest: "18865468f2e4bd9f0cc4ffdda1335f405d06df8d6ff183b373f50e08e81f924d"
+  - AlgorithmId: sha384
+    Digest: "995dbf6286dc9d47f0eee049a465847bb1e4cb1fa91deffb00dde832d2e00b109049c0f2edd6ad66525227758138a601"
+  EventSize: 26
+  Event:
+    String: |-
+      "grub_cmd:  xefi = xxen \0"
+- EventNum: 93
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "a4e1c6f50579b47c964111d1ea2170e6f923c941"
+  - AlgorithmId: sha256
+    Digest: "62cd76d31ca3d10d742e46c6ff171046ce19dd90f361a827fec6571e59c24794"
+  - AlgorithmId: sha384
+    Digest: "cac0f0b93ee7eaa45e36cda3faf3d0a5f5fc92ec4d24c3af4ad9584669598f34b603c211b220e56be52bdbc3a2f74ffb"
+  EventSize: 26
+  Event:
+    String: |-
+      "grub_cmd: insmod part_gpt\0"
+- EventNum: 94
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "af3f07abac9e5c56b82f09ab98328905aabbf6ef"
+  - AlgorithmId: sha256
+    Digest: "b838a4d2860c81058105fbb1907a1fb7f60b65591b099b3b000d9b31d8d2fb20"
+  - AlgorithmId: sha384
+    Digest: "e142a594d988fda5a65b1424a4a48c2cf4b036dd779d4ae299af45b7d33b0bfe07a4a969d3c0da72c2ba53f9eeeaf7a6"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd: insmod ext2\0"
+- EventNum: 95
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "cbf1bcb38df72c190b4db0d27ee96eca3c7a9e44"
+  - AlgorithmId: sha256
+    Digest: "20df4eb78bbf966925af51ad614806aa3ad6f146a9a0c85ac2582a3eaa9a30ca"
+  - AlgorithmId: sha384
+    Digest: "fbcdbcd1cc73f5ff594f1c8b21ecd6f5d62a0fd2f217da2fb7bcc75887c14c1232d162c53c05c914a84152d52d9ff68e"
+  EventSize: 28
+  Event:
+    String: |-
+      "grub_cmd: set root=hd0,gpt1\0"
+- EventNum: 96
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f5b067e59c163f67b19b836fbee9e8a487a19cdd"
+  - AlgorithmId: sha256
+    Digest: "4568361fb7581b31a42d645ab534302fb9f742adaa37b7fde152215d69e259fb"
+  - AlgorithmId: sha384
+    Digest: "10b1f8d036aefd32ce770311ea00426e147b3daee378dd0679aeda81963b2c5389178787962ce9ea08e5571701cce94a"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  xy = xy \0"
+- EventNum: 97
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d9d9de0269fb4f896105cac2f61eafa5f07a3715"
+  - AlgorithmId: sha256
+    Digest: "4c6e3f3d149a959a42df7ae14e07665fc07faf0c18c54179fa9d460d54379266"
+  - AlgorithmId: sha384
+    Digest: "44d9ad511c25d0f9cc6d5afd966a01ab022e2dc4999c56f110f26cdf5abcd369681618024ab313c886662e9db6915d96"
+  EventSize: 156
+  Event:
+    String: |-
+      "grub_cmd: search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1 c73d8355-1ac9-41b4-8edf-c1c1a9d5bd6a\0"
+- EventNum: 98
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "05ba452bf00b7f880528b35d02e9077f89c08538"
+  - AlgorithmId: sha256
+    Digest: "82a4a14e43a4f76118ae63285d0af05af139f260fae57b2c20737a1c1df3382b"
+  - AlgorithmId: sha384
+    Digest: "ae1061c45b3c25c89cea3f7ddee4640f8e776086f7d62fb4b9c1d56148a1be04bf11de6a395344567b538c6df06d079e"
+  EventSize: 19
+  Event:
+    String: |-
+      "grub_cmd:   = 1 \0"
+- EventNum: 99
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "01542096822d860040cf654f637eba149752e9e2"
+  - AlgorithmId: sha256
+    Digest: "d1bbd7d573d636850a1a9efbcfac9e589f1bcd34f617b16bc7872275ea036c3d"
+  - AlgorithmId: sha384
+    Digest: "2164d946e27c14eed101898c7ed88f7699292963b92d40d8ea3085b43284a57b3f3dfb83ac0945eb28ae70dd5ffd5184"
+  EventSize: 68
+  Event:
+    String: |-
+      "grub_cmd: echo GRUB_FORCE_PARTUUID set, attempting initrdless boot.\0"
+- EventNum: 100
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "a72252f8c4a8332df162e7cd38feee3e4f17f311"
+  - AlgorithmId: sha256
+    Digest: "7b35f08bff2e48a1b53a65d899a1c435a432488bc28e37639966477af0ae2ab2"
+  - AlgorithmId: sha384
+    Digest: "c35c072afd08eabbe3acf4deed5f758d64f0c63657340d2b11991d001c8c93ce675cc3e758f41505c8ab075ca4d4dff3"
+  EventSize: 161
+  Event:
+    String: |-
+      "grub_cmd: linux /boot/vmlinuz-5.11.0-1008-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro scsi_mod.use_blk_mq=Y ima_hash=sha256 console=ttyS0 panic=-1\0"
+- EventNum: 101
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f6558a5d3c7c55b82f279124a3725991f8563c7f"
+  - AlgorithmId: sha256
+    Digest: "38c6396eb70b84aef13f06384a37b7e7bfa77a14e3bde632a76c90acb65c1d97"
+  - AlgorithmId: sha384
+    Digest: "1a09841f50d46e01e34db7db403824d2e5792411949f2ada78681c4c9b2666ec4729c4c019e69840bad921df227ba143"
+  EventSize: 30
+  Event:
+    String: |-
+      "/boot/vmlinuz-5.11.0-1008-gcp\0"
+- EventNum: 102
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "c18eca5aee83e674879191584fb45b970b9f0b56"
+  - AlgorithmId: sha256
+    Digest: "8e08c2b0645412c96b630c8273f78520ebe30be31ce7e9c92bf0e405596d134c"
+  - AlgorithmId: sha384
+    Digest: "1f192c54174eb7d21824179a6803e1cd0a0dacafe1cb8b6d885c2440141d5e3f39099c669e6c526dffc4a1d945988c4c"
+  EventSize: 161
+  Event:
+    String: |-
+      "kernel_cmdline: /boot/vmlinuz-5.11.0-1008-gcp root=PARTUUID=bf817bdf-6a3a-4221-8edb-2c1ca7c5537f ro scsi_mod.use_blk_mq=Y ima_hash=sha256 console=ttyS0 panic=-1\0"
+- EventNum: 103
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "8c6944c5ed9f1516843fd5f5bc32941b1306e7db"
+  - AlgorithmId: sha256
+    Digest: "76bc6c6d70ce34a24bda263584ed03d0fd5d94f90ca206dd5e500b0fe98b3df2"
+  - AlgorithmId: sha384
+    Digest: "73d5fcf7750e63d42ab36b31da800a479873e4383ec2d8428ed572fa08429eccfbd63ebf7d342ba19a7ee828ed33d395"
+  EventSize: 21
+  Event:
+    String: |-
+      "grub_cmd: initrdfail\0"
+- EventNum: 104
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "55cfd6463ef334abb6b48080b33ec063a9c051eb"
+  - AlgorithmId: sha256
+    Digest: "cfa4676ffe751d1547e77a8d66a033b59b3eed3400d9b3a305d2601891ab0e59"
+  - AlgorithmId: sha384
+    Digest: "934aafc99cb0a7cb1ef83c5a1eb01c31d60927f08b2ff72d2c05e0b4660ed1dd1e139738b3c5630502e629e8f593d7af"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  -n true \0"
+- EventNum: 105
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d25eda264090bec15a2bfee2a9942a2cf6404e61"
+  - AlgorithmId: sha256
+    Digest: "e997fcfc7bf155f28498714bece340531b221ca2598d7444d8dbc1aac6717deb"
+  - AlgorithmId: sha384
+    Digest: "fa49d94c3497a24eeb1184b00c8aa69659132993997da06d35f349a246245a846436f4b1df9f1e9cdee9a02f40070dc8"
+  EventSize: 54
+  Event:
+    String: |-
+      "grub_cmd:  -n bf817bdf-6a3a-4221-8edb-2c1ca7c5537f \0"
+- EventNum: 106
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d31e5f156b716d7835b261891644bb5f7f65e285"
+  - AlgorithmId: sha256
+    Digest: "4e7a22f96bae467df0f26975e0bf7614d6b92993301c65bae6a85c6530e460bf"
+  - AlgorithmId: sha384
+    Digest: "fef379383e771fed457fecfc7148e008c90234d0526b282690c57c93802cc9623c25923689de1c2fcb62669f10e3e1e1"
+  EventSize: 18
+  Event:
+    String: |-
+      "grub_cmd:  -z  \0"
+- EventNum: 107
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "701f26890cfca800349839dcb7913dc84bd57bd1"
+  - AlgorithmId: sha256
+    Digest: "6b2c97f60740ba1ed873c8a1344792aefe3ba93ed8f20db8e89193526cff5fbb"
+  - AlgorithmId: sha384
+    Digest: "c9320c7d11fa8ba02fbf8fe0e952e2bf0b98478bb278e78b32e8af5f2fcade0ef682e200818ff2e84f279bab4e22b207"
+  EventSize: 27
+  Event:
+    String: |-
+      "grub_cmd: set initrdfail=1\0"
+- EventNum: 108
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "7a86009dc1f23867d8951bb95471618bde2d1918"
+  - AlgorithmId: sha256
+    Digest: "2436afe3cb181454ab807d6ca526ed3132dc1759787f9ed3f2f148e86948e978"
+  - AlgorithmId: sha384
+    Digest: "4cf726ecd422b56df71dca2f377cb2a4ee6d9ca1f5b44096f8fc6607b73b56d0effc393100c506a93327511a72cbf707"
+  EventSize: 18
+  Event:
+    String: |-
+      "grub_cmd:  -n  \0"
+- EventNum: 109
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9f1950c2967bc0668269446aa91b2f1e2b088862"
+  - AlgorithmId: sha256
+    Digest: "a05839fd9bfebe3bde7739df6a1983a0008d37e25a47ffa6a164b4a22050c80f"
+  - AlgorithmId: sha384
+    Digest: "902625d0fdf460a02c0c993eb960c9b8ad2acd3099ea2304eb3fea5816b3263dd98955f34aa8948e0234e864b7470cad"
+  EventSize: 30
+  Event:
+    String: |-
+      "grub_cmd: save_env initrdfail\0"
+- EventNum: 110
+  PCRIndex: 5
+  EventType: EV_EFI_ACTION
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "443a6b7b82b7af564f2e393cd9d5a388b7fa4a98"
+  - AlgorithmId: sha256
+    Digest: "d8043d6b7b85ad358eb3b6ae6a873ab7ef23a26352c5dc4faa5aeedacf5eb41b"
+  - AlgorithmId: sha384
+    Digest: "214b0bef1379756011344877743fdc2a5382bac6e70362d624ccf3f654407c1b4badf7d8f9295dd3dabdef65b27677e0"
+  EventSize: 29
+  Event: |-
+    Exit Boot Services Invocation
+- EventNum: 111
+  PCRIndex: 5
+  EventType: EV_EFI_ACTION
+  DigestCount: 3
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "475545ddc978d7bfd036facc7e2e987f48189f0d"
+  - AlgorithmId: sha256
+    Digest: "b54f7542cbd872a81a9d9dea839b2b8d747c7ebd5ea6615c40f42f44a6dbeba0"
+  - AlgorithmId: sha384
+    Digest: "0a2e01c85deae718a530ad8c6d20a84009babe6c8989269e950d8cf440c6e997695e64d455c4174a652cd080f6230b74"
+  EventSize: 40
+  Event: |-
+    Exit Boot Services Returned with Success
+pcrs:
+  sha1:
+    0  : 0x0f2d3a2a1adaa479aeeca8f5df76aadc41b862ea
+    1  : 0x36c6b7436c37243c5f6744b73ced4df1287cd16a
+    2  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    3  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    4  : 0x8d9868b66afcf4039eaf8ef5228556d9f313659f
+    5  : 0xb0eaa45a496e0d933f63e97fd2362192dd48e369
+    6  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    7  : 0x777795cbdeca679f7749d8d09fc12941dcc9912a
+    8  : 0x5dfae5320ea06ddd1c62d296844a9b4b32b49972
+    9  : 0xf53869ab9015b5ad736e5f00e44fdfee2fdfde27
+    14 : 0xcd3734d2bdfcfba9e443ac02c03c812ffcceb255
+  sha256:
+    0  : 0x24af52a4f429b71a3184a6d64cddad17e54ea030e2aa6576bf3a5a3d8bd3328f
+    1  : 0xf7dab5fda6b082e0ec1a12c43dd996ee409111422cda752a784620313039db19
+    2  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    3  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    4  : 0x295aeaeacad1d507930bab18418f905eeda633ea67b2ab94c5e5fd3a4d47ac58
+    5  : 0xe4f1359accfe48b19af7d38e98a3f373116b55b7f7a6f58f826f409a91d9fd28
+    6  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    7  : 0xca37324eeffabd318d30a20f15bf27ce25dc33e2c9856279ff6c2ced58b02efa
+    8  : 0x2f2559cae74bb441d75afea5edb78d9a645db9f4bf8dea84bab0861ce6032e18
+    9  : 0x9f27883322aaaf043662c27542d9685790c687ea554e4e2ae30f0e099a2e4889
+    14 : 0x8351c65483c5419079e8c96758dd2130bee075d71fea226f68ec4eb5bfc71983
+  sha384:
+    0  : 0x8be2d39fecef6e883d467379c57847437cfa03a6f7f7f78dcb2a05a479db4b4749ececedd105b760bc8313abccf1dfb6
+    1  : 0x382f8b0c004009344620c720690011386c383af66e38437f6f44854426a8a7a1d8eb8c9ffcc5c61b9b39729446c34042
+    2  : 0x518923b0f955d08da077c96aaba522b9decede61c599cea6c41889cfbea4ae4d50529d96fe4d1afdafb65e7f95bf23c4
+    3  : 0x518923b0f955d08da077c96aaba522b9decede61c599cea6c41889cfbea4ae4d50529d96fe4d1afdafb65e7f95bf23c4
+    4  : 0x6bb9f97fa6a24844a6976c6196dcf766574c2062923d2ccbb9e04a365f36a986c798342cb9720d919b0f6a72a1aaab3e
+    5  : 0x6c1b5fbc7598002e1c48171baf44ffc24c001ba16d25356fb2c06fe8bc3aa73ca78bb658fc4eb5952d5862ee7097ea86
+    6  : 0x518923b0f955d08da077c96aaba522b9decede61c599cea6c41889cfbea4ae4d50529d96fe4d1afdafb65e7f95bf23c4
+    7  : 0x79ca6795f9f8cb4f8653f64370dcdcc845e2d7be213424c1295bb4626ec436436bcca9decd0bd989b7218ea24af40313
+    8  : 0xedf46c2b7278fb9a7e9f0f9ef4bfdcafe156ff687ce039069b9cb9c11cae76d72ad881212ef748cf868138516d22edae
+    9  : 0xb22f00a43ff104a75b333718cb822311654d33d42154b70c57a90a42c9674fff79e8ca016c2656aa7c92be41ebc57a64
+    14 : 0xb8b567350264af771620c027a7b166896385885029f5e5b2feb9a0c62b7ffdfc276b702373b26b3aa589ab675ee8654d

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-moklisttrusted.bin Added

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-moklisttrusted.bin.yaml Added

@@ -0,0 +1,1228 @@
+---
+version: 2
+events:
+- EventNum: 0
+  PCRIndex: 0
+  EventType: EV_NO_ACTION
+  Digest: "0000000000000000000000000000000000000000"
+  EventSize: 33
+  SpecID:
+  - Signature: Spec ID Event03
+    platformClass: 0
+    specVersionMinor: 0
+    specVersionMajor: 2
+    specErrata: 0
+    uintnSize: 2
+    numberOfAlgorithms: 1
+    Algorithms:
+    - Algorithm0:
+      algorithmId: sha256
+      digestSize: 32
+    vendorInfoSize: 0
+- EventNum: 1
+  PCRIndex: 0
+  EventType: EV_S_CRTM_VERSION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7"
+  EventSize: 2
+  Event: "0000"
+- EventNum: 2
+  PCRIndex: 0
+  EventType: EV_EFI_PLATFORM_FIRMWARE_BLOB
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df32b6fc4e8a153713feba580b9ca6da6efa8cb23dd907f0e543d1f4c5be3c14"
+  EventSize: 16
+  Event:
+    BlobBase: 0x820000
+    BlobLength: 0xe0000
+- EventNum: 3
+  PCRIndex: 0
+  EventType: EV_EFI_PLATFORM_FIRMWARE_BLOB
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "da36c15e1184901ad53ec231d441224d2fff5ff168d8972fe71efca4e150b502"
+  EventSize: 16
+  Event:
+    BlobBase: 0x900000
+    BlobLength: 0xc00000
+- EventNum: 4
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "ccfc4bb32888a345bc8aeadaba552b627d99348c767681ab3141f5b01e40a40e"
+  EventSize: 53
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 10
+    VariableDataLength: 1
+    UnicodeName: SecureBoot
+    VariableData:
+      Enabled: 'Yes'
+- EventNum: 5
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "36a1f8ab7581531938784aa5bf73aac6973e3ba6a60cd89f24020fcb7961fc3e"
+  EventSize: 1012
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 2
+    VariableDataLength: 976
+    UnicodeName: PK
+    VariableData:
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 976
+      SignatureHeaderSize: 0
+      SignatureSize: 948
+      Keys:
+      - SignatureOwner: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+        SignatureData: 308203a030820288a003020102020900fef588e8f396c0f1300d06092a864886f70d01010b05003051312b302906035504031322526564204861742053656375726520426f6f742028504b2f4b454b206b65792031293122302006092a864886f70d0109011613736563616c657274407265646861742e636f6d301e170d3134313033313131313533375a170d3337313032353131313533375a3051312b302906035504031322526564204861742053656375726520426f6f742028504b2f4b454b206b65792031293122302006092a864886f70d0109011613736563616c657274407265646861742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100901f847b8dbceb9726826d88ab8ac98c6870f9df4b07b237830b02c86768309ee3f0f0994ab85957c641f6388bfe664c49e93737922e98011e5b1450e6a88d250df586e6ab30cb4016ea8d8b1686704337f2cec091df71148e990e89b64c6d241e8ce42f4f25d0ba06f8c6e8191876731d816da8d805cf3ac87b28c836a3160d298c999a68dcabc04d8dbf5abb2ba9394b04971cf936bbc53a8604aeafd4827be0abde490568fcf6ae681a6c904d57193c646603f6c7529bf794cf936aa168c9aacf996bbcaa5e08e7391cf7f80fba067ef1cbe876ddfe22daad3a5e5b34eab3c9e04d04297eb860b905efb5d91758561660b93032f0364ac3f2798d124070f30203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e041604143ce960e3ff19a10a7ba342f48d422eb4d59c72ec301f0603551d230418301680143ce960e3ff19a10a7ba342f48d422eb4d59c72ec300d06092a864886f70d01010b050003820101005c4d9288b4825f1dad8b11ecdf06a67aa52b9f37550c8d6e0500adb70c418969cfd665069b5178d2adc7bf9cdc05737fe71e3913b4eab6307d4075ab9c430bdfb0c21bbf30e0f4fec0db622198f6c5afde3b4f490ae61ef986b03f0dd6d44637db54745eff11c260c67058c51c6fecb2d86e6fc3bc338738a4f344649c343b28942678279f1617e83b690a25a973367e9e375cece83fdb91f912b33dcee7dd15c3ae8c0520619b95de9baffab15c1ce597e7c3341185f58a2726a47036ec0cf6833d90f736f3f9f315d49062be53b4afd349afeff473e87b76e4442a37ba81a4990c3a312471a0e4e4b71acb47e4aa22cfef756180e343b7485773113d789b69
+- EventNum: 6
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "1c1acab9b9e89496e453e6d5a9d3ef0c3632cd99496016fcc0c1e435c62bf421"
+  EventSize: 2574
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 3
+    VariableDataLength: 2536
+    UnicodeName: KEK
+    VariableData:
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 976
+      SignatureHeaderSize: 0
+      SignatureSize: 948
+      Keys:
+      - SignatureOwner: a0baa8a3-041d-48a8-bc87-c36d121b5e3d
+        SignatureData: 308203a030820288a003020102020900fef588e8f396c0f1300d06092a864886f70d01010b05003051312b302906035504031322526564204861742053656375726520426f6f742028504b2f4b454b206b65792031293122302006092a864886f70d0109011613736563616c657274407265646861742e636f6d301e170d3134313033313131313533375a170d3337313032353131313533375a3051312b302906035504031322526564204861742053656375726520426f6f742028504b2f4b454b206b65792031293122302006092a864886f70d0109011613736563616c657274407265646861742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100901f847b8dbceb9726826d88ab8ac98c6870f9df4b07b237830b02c86768309ee3f0f0994ab85957c641f6388bfe664c49e93737922e98011e5b1450e6a88d250df586e6ab30cb4016ea8d8b1686704337f2cec091df71148e990e89b64c6d241e8ce42f4f25d0ba06f8c6e8191876731d816da8d805cf3ac87b28c836a3160d298c999a68dcabc04d8dbf5abb2ba9394b04971cf936bbc53a8604aeafd4827be0abde490568fcf6ae681a6c904d57193c646603f6c7529bf794cf936aa168c9aacf996bbcaa5e08e7391cf7f80fba067ef1cbe876ddfe22daad3a5e5b34eab3c9e04d04297eb860b905efb5d91758561660b93032f0364ac3f2798d124070f30203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e041604143ce960e3ff19a10a7ba342f48d422eb4d59c72ec301f0603551d230418301680143ce960e3ff19a10a7ba342f48d422eb4d59c72ec300d06092a864886f70d01010b050003820101005c4d9288b4825f1dad8b11ecdf06a67aa52b9f37550c8d6e0500adb70c418969cfd665069b5178d2adc7bf9cdc05737fe71e3913b4eab6307d4075ab9c430bdfb0c21bbf30e0f4fec0db622198f6c5afde3b4f490ae61ef986b03f0dd6d44637db54745eff11c260c67058c51c6fecb2d86e6fc3bc338738a4f344649c343b28942678279f1617e83b690a25a973367e9e375cece83fdb91f912b33dcee7dd15c3ae8c0520619b95de9baffab15c1ce597e7c3341185f58a2726a47036ec0cf6833d90f736f3f9f315d49062be53b4afd349afeff473e87b76e4442a37ba81a4990c3a312471a0e4e4b71acb47e4aa22cfef756180e343b7485773113d789b69
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 1560
+      SignatureHeaderSize: 0
+      SignatureSize: 1532
+      Keys:
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 308205e8308203d0a003020102020a610ad188000000000003300d06092a864886f70d01010b0500308191310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313b3039060355040313324d6963726f736f667420436f72706f726174696f6e205468697264205061727479204d61726b6574706c61636520526f6f74301e170d3131303632343230343132395a170d3236303632343230353132395a308180310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312a3028060355040313214d6963726f736f667420436f72706f726174696f6e204b454b204341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100c4e8b58abfad5726b026c3eae7fb577a44025d070dda4ae5742ae6b00fec6debec7fb9e35a63327c11174f0ee30ba73815938ec6f5e084b19a9b2ce7f5b791d609e1e2c004a8ac301cdf48f306509a64a7517fc8854f8f2086cefe2fe19fff82c0ede9cdcef4536a623a0b43b9e225fdfe05f9d4c414ab11e223898d70b7a41d4decaee59cfa16c2d7c1cbd4e8c42fe599ee248b03ec8df28beac34afb4311120b7eb547926cdce60489ebf53304eb10012a71e5f983133cff25092f687646ffba4fbedcad712a58aafb0ed2793de49b653bcc292a9ffc7259a2ebae92eff6351380c602ece45fcc9d76cdef6392c1af79408479877fe352a8e89d7b07698f150203010001a382014f3082014b301006092b06010401823715010403020100301d0603551d0e0416041462fc43cda03ea4cb6712d25bd955ac7bccb68a5f301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d2304183016801445665243e17e5811bfd64e9e2355083b3a226aa8305c0603551d1f045530533051a04fa04d864b687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e637274300d06092a864886f70d01010b05000382020100d48488f514941802ca2a3cfb2a921c0cd7a0d1f1e85266a8eea2b5757a9000aa2da4765aea79b7b9376a517b1064f6e164f20267bef7a81b78bdbace8858640cd657c819a35f05d6dbc6d069ce484b32b7eb5dd230f5c0f5b8ba7807a32bfe9bdb345684ec82caae4125709c6be9fe900fd7961fe5e7941fb22a0c8d4bff2829107bf7d77ca5d176b905c879ed0f90929cc2fedf6f7e6c0f7bd4c145dd345196390fe55e56d8180596f407a642b3a077fd0819f27156cc9f8623a487cba6fd587ed4696715917e81f27f13e50d8b8a3c8784ebe3cebd43e5ad2d84938e6a2b5a7c44fa52aa81c82d1cbbe052df0011f89a3dc160b0e133b5a388d165190a1ae7ac7ca4c182874e38b12f0dc514876ffd8d2ebc39b6e7e6c3e0e4cd2784ef9442ef298b9046413b811b67d8f9435965cb0dbcfd00924ff4753ba7a924fc50414079e02d4f0a6a27766e52ed96697baf0ff78705d045c2ad5314811ffb3004aa373661da4a691b34d868edd602cf6c940cd3cf6c2279adb1f0bc03a24660a9c407c22182f1fdf2e8793260bfd8aca522144bcac1d84beb7d3f5735b2e64f75b4b060032253ae91791dd69b411f15865470b2de0d350f7cb03472ba97603bf079eba2b21c5da216b887c5e91bf6b597256f389fe391fa8a7998c3690eb7a31c200597f8ca14ae00d7c4f3c01410756b34a01bb59960f35cb0c5574e36d23284bf9e
+- EventNum: 7
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "644aacf6f4015125233c459bc9e40f3fc82ccd14abb047dc50b7913c8095d1d7"
+  EventSize: 3179
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 2
+    VariableDataLength: 3143
+    UnicodeName: db
+    VariableData:
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 1543
+      SignatureHeaderSize: 0
+      SignatureSize: 1515
+      Keys:
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 308205d7308203bfa003020102020a61077656000000000008300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3131313031393138343134325a170d3236313031393138353134325a308184310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e20504341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100dd0cbba2e42e09e3e7c5f79669bc0021bd693333efad04cb5480ee0683bbc52084d9f7d28bf338b0aba4ad2d7c627905ffe34a3f04352070e3c4e76be09cc03675e98a31dd8d70e5dc37b5744696285b8760232cbfdc47a567f751279e72eb07a6c9b91e3b53357ce5d3ec27b9871cfeb9c923096fa84691c16e963c41d3cba33f5d026a4dec691f25285c36fffd43150a94e019b4cfdfc212e2c25b27ee2778308b5b2a096b22895360162cc0681d53baec49f39d618c85680973445d7da2542bdd79f715cf355d6c1c2b5ccebc9c238b6f6eb526d93613c34fd627aeb9323b41922ce1c7cd77e8aa544ef75c0b048765b44318a8b2e06d1977ec5a24fa48030203010001a38201433082013f301006092b06010401823715010403020100301d0603551d0e04160414a92902398e16c49778cd90f99e4f9ae17c55af53301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014d5f656cb8fe8a25c6268d13d94905bd7ce9a18c430560603551d1f044f304d304ba049a0478645687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f4365724175745f323031302d30362d32332e63726c305a06082b06010505070101044e304c304a06082b06010505073002863e687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f4365724175745f323031302d30362d32332e637274300d06092a864886f70d01010b0500038202010014fc7c7151a579c26eb2ef393ebc3c520f6e2b3f101373fea868d048a6344d8a960526ee3146906179d6ff382e456bf4c0e528b8da1d8f8adb09d71ac74c0a36666a8cec1bd70490a81817a49bb9e240323676c4c15ac6bfe404c0ea16d3acc368ef62acdd546c503058a6eb7cfe94a74e8ef4ec7c867357c2522173345af3a38a56c804da0709edf88be3cef47e8eaef0f60b8a08fb3fc91d727f53b8ebbe63e0e33d3165b081e5f2accd16a49f3da8b19bc242d090845f541dff89eaba1d47906fb0734e419f409f5fe5a12ab21191738a2128f0cede73395f3eab5c60ecdf0310a8d309e9f4f69685b67f51886647198da2b0123d812a680577bb914c627bb6c107c7ba7a8734030e4b627a99e9cafcce4a37c92da4577c1cfe3ddcb80f5afad6c4b30285023aeab3d96ee4692137de81d1f675190567d393575e291b39c8ee2de1cde445735bd0d2ce7aab1619824658d05e9d81b367af6c35f2bce53f24e235a20a7506f6185699d4782cd1051bebd088019daa10f105dfba7e2c63b7069b2321c4f9786ce2581706362b911203cca4d9f22dbaf9949d40ed1845f1ce8a5c6b3eab03d370182a0a6ae05f47d1d5630a32f2afd7361f2a705ae5425908714b57ba7e8381f0213cf41cc1c5b990930e88459386e9b12099be98cbc595a45d62d6a0630820bd7510777d3df345b99f979fcb57806f33a904cf77a4621c597e
+    - SignatureType: a5c059a1-94e4-4aa7-87b5-ab155c2bf072
+      SignatureListSize: 1600
+      SignatureHeaderSize: 0
+      SignatureSize: 1572
+      Keys:
+      - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+        SignatureData: 30820610308203f8a003020102020a6108d3c4000000000004300d06092a864886f70d01010b0500308191310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313b3039060355040313324d6963726f736f667420436f72706f726174696f6e205468697264205061727479204d61726b6574706c61636520526f6f74301e170d3131303632373231323234355a170d3236303632373231333234355a308181310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312b3029060355040313224d6963726f736f667420436f72706f726174696f6e2055454649204341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100a5086c4cc745096a4b0ca4c0877f06750c43015464e0167f07ed927d0bb273bf0c0ac64a4561a0c5162d96d3f52ba0fb4d499b4180903cb954fde6bcd19dc4a4188a7f418a5c59836832bb8c47c9ee71bc214f9a8a7cff443f8d8f32b22648ae75b5eec94c1e4a197ee4829a1d78774d0cb0bdf60fd316d3bcfa2ba551385df5fbbadb7802dbffec0a1b96d583b81913e9b6c07b407be11f2827c9faef565e1ce67e947ec0f044b27939e5dab2628b4dbf3870e2682414c933a40837d558695ed37cedc1045308e74eb02a876308616f631559eab22b79d70c61678a5bfd5ead877fba86674f71581222042222ce8bef547100ce503558769508ee6ab1a201d50203010001a382017630820172301206092b060104018237150104050203010001302306092b060104018237150204160414f8c16bb77f77534af325371d4ea1267b0f207080301d0603551d0e0416041413adbf4309bd82709c8cd54f316ed522988a1bd4301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d2304183016801445665243e17e5811bfd64e9e2355083b3a226aa8305c0603551d1f045530533051a04fa04d864b687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e637274300d06092a864886f70d01010b05000382020100350842ff30cccef7760cad1068583529463276277cef124127421b4aaa6d813848591355f3e95834a6160b82aa5dad82da808341068fb41df203b9f31a5d1bf15090f9b3558442281c20bdb2ae5114c5c0ac9795211c90db0ffc779e95739188cabdbd52b905500ddf579ea061ed0de56d25d9400f1740c8cea34ac24daf9a121d08548fbdc7bcb92b3d492b1f32fc6a21694f9bc87e4234fc3606178b8f2040c0b39a257527cdc903a3f65dd1e736547ab950b5d312d107bfbb74dfdc1e8f80d5ed18f42f14166b2fde668cb023e5c784d8edeac13382ad564b182df1689507cdcff072f0aebbdd8685982c214c332bf00f4af06887b592553275a16a826a3ca32511a4edadd704aecbd84059a084d1954c6291221a741d8c3d470e44a6e4b09b3435b1fab653a82c81eca40571c89db8bae81b4466e447540e8e567fb39f1698b286d0683e9023b52f5e8f50858dc68d825f41a1f42e0de099d26c75e4b669b52186fa07d1f6e24dd1daad2c77531e253237c76c52729586b0f135616a19f5b23b815056a6322dfea289f94286271855a182ca5a9bf830985414a64796252fc826e441941a5c023fe596e3855b3c3e3fbb47167255e22522b1d97be703062aa3f71e9046c3000dd61989e30e352762037115a6efd027a0a0593760f83894b8e07870f8ba4c868794f6e0ae0245ee65c2b6a37e69167507929bf5a6bc598358
+- EventNum: 8
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "1963d580fcc0cede165e23837b55335eebe18750c0b795883386026ea071e3c6"
+  EventSize: 114
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 3
+    VariableDataLength: 76
+    UnicodeName: dbx
+    VariableData:
+    - SignatureType: c1c41626-504c-4092-aca9-41f936934328
+      SignatureListSize: 76
+      SignatureHeaderSize: 0
+      SignatureSize: 48
+      Keys:
+      - SignatureOwner: a0baa8a3-041d-48a8-bc87-c36d121b5e3d
+        SignatureData: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+- EventNum: 9
+  PCRIndex: 7
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 10
+  PCRIndex: 2
+  EventType: EV_EFI_BOOT_SERVICES_DRIVER
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "05131aaccf79e17ce81e239ca3fd2f7706889c207abba05a7f6cbe37723b7507"
+  EventSize: 84
+  Event:
+    ImageLocationInMemory: 0x7d750018
+    ImageLengthInMemory: 169280
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 52
+    DevicePath: '02010c00d041030a0000000001010600000101010600000004081800000000000022010000000000ffa70200000000007fff0400'
+- EventNum: 11
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "8c765cd796a40f961d239dc8d469917b278e18316fe8ee9bbe2a5737e294204d"
+  EventSize: 56
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 9
+    VariableDataLength: 6
+    UnicodeName: BootOrder
+    VariableData:
+    - Boot0002
+    - Boot0001
+    - Boot0000
+- EventNum: 12
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "9192f6ceff32199e626ee22ab37b88cd5b2b74acc65134443da18e81c8ec09ff"
+  EventSize: 202
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 154
+    UnicodeName: Boot0002
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 98
+      Description: "Red Hat Enterprise Linux"
+      DevicePath: '04012a0001000000000800000000000000c0120000000000efebe332780a8740b320948b8e06b02f0202040434005c004500460049005c007200650064006800610074005c007300680069006d007800360034002e0065006600690000007fff0400'
+- EventNum: 13
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "37d0b6681d44cc3f1e28d695fe6aacbf49048712b946b9810f73b583437843ac"
+  EventSize: 132
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 84
+    UnicodeName: Boot0001
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 28
+      Description: "UEFI Misc Device"
+      DevicePath: '02010c00d041030a000000000101060003010101060000007fff04004eac0881119f594d850ee21a522c59b2'
+- EventNum: 14
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "3197be1e300fa1600d1884c3a4bd4a90a15405bfb546cf2e6cf6095f8c362a93"
+  EventSize: 110
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 62
+    UnicodeName: Boot0000
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 44
+      Description: "UiApp"
+      DevicePath: '04071400c9bdb87cebf8344faaea3ee4af6516a10406140021aa2c4614760345836e8ab6f46623317fff0400'
+- EventNum: 15
+  PCRIndex: 4
+  EventType: EV_EFI_ACTION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "3d6772b4f84ed47595d72a2c4c5ffd15f5bb72c7507fe26f2aaee2c69d5633ba"
+  EventSize: 40
+  Event: |-
+    Calling EFI Application from Boot Option
+- EventNum: 16
+  PCRIndex: 0
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 17
+  PCRIndex: 1
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 18
+  PCRIndex: 2
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 19
+  PCRIndex: 3
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 20
+  PCRIndex: 4
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 21
+  PCRIndex: 5
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 22
+  PCRIndex: 6
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 23
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_AUTHORITY
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "4d4a8e2c74133bbdc01a16eaf2dbb5d575afeb36f5d8dfcf609ae043909e2ee9"
+  EventSize: 1608
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 2
+    VariableDataLength: 1572
+    UnicodeName: db
+    VariableData:
+    - SignatureOwner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
+      SignatureData: 30820610308203f8a003020102020a6108d3c4000000000004300d06092a864886f70d01010b0500308191310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313b3039060355040313324d6963726f736f667420436f72706f726174696f6e205468697264205061727479204d61726b6574706c61636520526f6f74301e170d3131303632373231323234355a170d3236303632373231333234355a308181310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312b3029060355040313224d6963726f736f667420436f72706f726174696f6e2055454649204341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100a5086c4cc745096a4b0ca4c0877f06750c43015464e0167f07ed927d0bb273bf0c0ac64a4561a0c5162d96d3f52ba0fb4d499b4180903cb954fde6bcd19dc4a4188a7f418a5c59836832bb8c47c9ee71bc214f9a8a7cff443f8d8f32b22648ae75b5eec94c1e4a197ee4829a1d78774d0cb0bdf60fd316d3bcfa2ba551385df5fbbadb7802dbffec0a1b96d583b81913e9b6c07b407be11f2827c9faef565e1ce67e947ec0f044b27939e5dab2628b4dbf3870e2682414c933a40837d558695ed37cedc1045308e74eb02a876308616f631559eab22b79d70c61678a5bfd5ead877fba86674f71581222042222ce8bef547100ce503558769508ee6ab1a201d50203010001a382017630820172301206092b060104018237150104050203010001302306092b060104018237150204160414f8c16bb77f77534af325371d4ea1267b0f207080301d0603551d0e0416041413adbf4309bd82709c8cd54f316ed522988a1bd4301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d2304183016801445665243e17e5811bfd64e9e2355083b3a226aa8305c0603551d1f045530533051a04fa04d864b687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e637274300d06092a864886f70d01010b05000382020100350842ff30cccef7760cad1068583529463276277cef124127421b4aaa6d813848591355f3e95834a6160b82aa5dad82da808341068fb41df203b9f31a5d1bf15090f9b3558442281c20bdb2ae5114c5c0ac9795211c90db0ffc779e95739188cabdbd52b905500ddf579ea061ed0de56d25d9400f1740c8cea34ac24daf9a121d08548fbdc7bcb92b3d492b1f32fc6a21694f9bc87e4234fc3606178b8f2040c0b39a257527cdc903a3f65dd1e736547ab950b5d312d107bfbb74dfdc1e8f80d5ed18f42f14166b2fde668cb023e5c784d8edeac13382ad564b182df1689507cdcff072f0aebbdd8685982c214c332bf00f4af06887b592553275a16a826a3ca32511a4edadd704aecbd84059a084d1954c6291221a741d8c3d470e44a6e4b09b3435b1fab653a82c81eca40571c89db8bae81b4466e447540e8e567fb39f1698b286d0683e9023b52f5e8f50858dc68d825f41a1f42e0de099d26c75e4b669b52186fa07d1f6e24dd1daad2c77531e253237c76c52729586b0f135616a19f5b23b815056a6322dfea289f94286271855a182ca5a9bf830985414a64796252fc826e441941a5c023fe596e3855b3c3e3fbb47167255e22522b1d97be703062aa3f71e9046c3000dd61989e30e352762037115a6efd027a0a0593760f83894b8e07870f8ba4c868794f6e0ae0245ee65c2b6a37e69167507929bf5a6bc598358
+- EventNum: 24
+  PCRIndex: 5
+  EventType: EV_EFI_GPT_EVENT
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "b401858d924d7c9d39e32bc3a539bb79c83bfac9f4c4c8b45cc59d427e9afc19"
+  EventSize: 612
+  Event:
+    Header:
+      Signature: "EFI PART"
+      Revision: 0x10000
+      HeaderSize: 92
+      HeaderCRC32: 0xf9b92cdd
+      MyLBA: 0x1
+      AlternateLBA: 0x27fffff
+      FirstUsableLBA: 0x22
+      LastUsableLBA: 0x27fffde
+      DiskGUID: 7bb73385-40b7-462f-a5fd-4e4b67e399a3
+      PartitionEntryLBA: 0x2
+      NumberOfPartitionEntry: 128
+      SizeOfPartitionEntry: 128
+      PartitionEntryArrayCRC32: 0xe28b5e55
+    NumberOfPartitions: 4
+    Partitions:
+    - PartitionTypeGUID: c12a7328-f81f-11d2-ba4b-00a0c93ec93b
+      UniquePartitionGUID: 32e3ebef-0a78-4087-b320-948b8e06b02f
+      StartingLBA: 0x800
+      EndingLBA: 0x12c7ff
+      Attributes: 0x0
+      PartitionName: "EFI System Partition"
+    - PartitionTypeGUID: 0fc63daf-8483-4772-8e79-3d69d8477de4
+      UniquePartitionGUID: 15080006-a862-4040-9e5f-850b0c5293ff
+      StartingLBA: 0x12c800
+      EndingLBA: 0x32c7ff
+      Attributes: 0x0
+      PartitionName: ""
+    - PartitionTypeGUID: 0657fd6d-a4ab-43c4-84e5-0933c84b4f4f
+      UniquePartitionGUID: 9ab18f82-2647-4462-94ba-4a29ea3bb00e
+      StartingLBA: 0x32c800
+      EndingLBA: 0x72c7ff
+      Attributes: 0x0
+      PartitionName: ""
+    - PartitionTypeGUID: 0fc63daf-8483-4772-8e79-3d69d8477de4
+      UniquePartitionGUID: 81c10479-c5d6-4f99-9f68-5bbee604106f
+      StartingLBA: 0x72c800
+      EndingLBA: 0x27ff7ff
+      Attributes: 0x0
+      PartitionName: ""
+- EventNum: 25
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "5af24fa7419a5bb4cebe934221c3155cb3918773c5b7033d59cddda344f3ebf5"
+  EventSize: 154
+  Event:
+    ImageLocationInMemory: 0x7d0ca018
+    ImageLengthInMemory: 946736
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 122
+    DevicePath: '02010c00d041030a0000000001010600030101010600000004012a0001000000000800000000000000c0120000000000efebe332780a8740b320948b8e06b02f0202040434005c004500460049005c007200650064006800610074005c007300680069006d007800360034002e0065006600690000007fff0400'
+- EventNum: 26
+  PCRIndex: 14
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "69bbddbe5a4480b7ab2e5632638b978bba978e66d04b677b3fd4ad2e5c7e1c5b"
+  EventSize: 8
+  Event:
+    String: |-
+      "MokList\0"
+- EventNum: 27
+  PCRIndex: 14
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "8d8a3aae50d5d25838c95c034aadce7b548c9a952eb7925e366eda537c59c3b0"
+  EventSize: 9
+  Event:
+    String: |-
+      "MokListX\0"
+- EventNum: 28
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_AUTHORITY
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "922e939a5565798a5ef12fe09d8b49bf951a8e7f89a0cca7a51636693d41a34d"
+  EventSize: 68
+  Event:
+    VariableName: 605dab50-e046-4300-abb6-3dd810dd8b23
+    UnicodeNameLength: 9
+    VariableDataLength: 18
+    UnicodeName: SbatLevel
+    VariableData:
+      String: |-
+        "sbat,1,2021030218"
+- EventNum: 29
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_AUTHORITY
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "5f62a2107fa11ce0485fd252d2e6c603cb8ed075861f9513bfed0a26bf6ed62b"
+  EventSize: 61
+  Event:
+    VariableName: 605dab50-e046-4300-abb6-3dd810dd8b23
+    UnicodeNameLength: 14
+    VariableDataLength: 1
+    UnicodeName: MokListTrusted
+    VariableData:
+      Enabled: 'Yes'
+- EventNum: 30
+  PCRIndex: 14
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a"
+  EventSize: 15
+  Event:
+    String: |-
+      "MokListTrusted\0"
+- EventNum: 31
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_AUTHORITY
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "92291e21a601f9a142e256dfc85b516a43b1e929212eafda55458f6f9be7f0a1"
+  EventSize: 960
+  Event:
+    VariableName: 605dab50-e046-4300-abb6-3dd810dd8b23
+    UnicodeNameLength: 4
+    VariableDataLength: 920
+    UnicodeName: Shim
+    VariableData:
+    - SignatureOwner: 94038230-8230-7c02-a003-020102020900
+      SignatureData: 83730d2b7280d15a300d06092a864886f70d01010b0500305f31163014060355040a0c0d526564204861742c20496e632e3121301f06035504030c18526564204861742053656375726520426f6f7420434120353122302006092a864886f70d0109011613736563616c657274407265646861742e636f6d301e170d3230303630393038313533365a170d3338303131383038313533365a305f31163014060355040a0c0d526564204861742c20496e632e3121301f06035504030c18526564204861742053656375726520426f6f7420434120353122302006092a864886f70d0109011613736563616c657274407265646861742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100cebaea41171c81a18809bfa1d4a9fa532e9d9ebcfc3b289c3052a00bf4000f36c88341f6a9c915496564d5b2769e58c12e1eeacf93386b47d6ba92c5f800e777a55769df41b1c4905b2d20c174aa038680b6a459efa988445e5240d47715a104859ceff3c69ff30f0fd68446e466dc266ad6d88a6e474acae34c431574997a06328ce033bfe5f846673dea0e943bbf3ddd8bf67f308c45540ba4de23355a997305d880e765141a07302c7386b02da3a636a64d815d91a767bbea3b5b828a9ccf83da31d1543416bc1907172a944ef0cecf0dbaf4fbe4d44889238b8cdc8e4513d77aa8d5e5840313520206c2d590763ab5d7b89d7ab0c9d09869fb8e0d01f5850203010001a3533051301d0603551d0e04160414cc6fa5e72868ba494e939bbd680b9144769a9f8f301f0603551d23041830168014cc6fa5e72868ba494e939bbd680b9144769a9f8f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101001de75e426a66cc723e9b5cc9afa3ca542eed64abc0b917be27a91e58b1593c4d1174d1971a520584058ad9f085c8f5ec8f9ce9e7086dbb3acbfa6f3c33e6784d75bddfc095729f0350d2752a7cb481e08762945cefcf6bda3ae3bf6e18743455500c22518eaa5830bebd3e304db697b5131b6daf6c183b714a09a18917a7e718f56d51b1d310c80ed6e43219024b1ab2d2dc29a326951d0106e452697806d3304444b07577cc54ade46e2222ff5dff93060cf9983a9c39b70c81d0f3f807a7098b6f9c8ae1adfc419850a65f0bbaa57f1cfc838d06592e9e6ebff43ec31a746625948a5dbf21b6139b9f67f87edc421f4c0edd88737d8c95d03f77c190b864f1
+- EventNum: 32
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "a4858d1a47abce57039f498475d96b1e29c9c0489458ea45fc1c3ef2599eea16"
+  EventSize: 88
+  Event:
+    ImageLocationInMemory: 0x7cd71018
+    ImageLengthInMemory: 2524792
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 56
+    DevicePath: '040434005c004500460049005c007200650064006800610074005c0067007200750062007800360034002e0065006600690000007fff0400'
+- EventNum: 33
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "1e9dc05f52ce1ee96bfbe2c8e4a5a650a8ca7564f5ec05258e8ac7a490e5c0d6"
+  EventSize: 31
+  Event:
+    String: |-
+      "(hd0,gpt1)/EFI/redhat/grub.cfg\0"
+- EventNum: 34
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "1e9dc05f52ce1ee96bfbe2c8e4a5a650a8ca7564f5ec05258e8ac7a490e5c0d6"
+  EventSize: 31
+  Event:
+    String: |-
+      "(hd0,gpt1)/EFI/redhat/grub.cfg\0"
+- EventNum: 35
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "a449b867e6234d067b572dd6d119d7a58e9792992a5f4c65fccfd9699a6128ac"
+  EventSize: 86
+  Event:
+    String: |-
+      "grub_cmd: search --no-floppy --fs-uuid --set=dev ed5e9398-1a8f-4ae2-a8b8-c4cd677a759f\0"
+- EventNum: 36
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "8848d9559c4b88724d1ca23ace56550cf497428733fdc13462e1092e04f819b2"
+  EventSize: 38
+  Event:
+    String: |-
+      "grub_cmd: set prefix=(hd0,gpt2)/grub2\0"
+- EventNum: 37
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "ff53bb1b64407630089072060dadd651c37b29fab7eafdb6c22212104101d616"
+  EventSize: 34
+  Event:
+    String: |-
+      "grub_cmd: export (hd0,gpt2)/grub2\0"
+- EventNum: 38
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "6c37371ba140d53352f0a269edd9f4748964ffe8204f47d0155c082a0f214815"
+  EventSize: 47
+  Event:
+    String: |-
+      "grub_cmd: configfile (hd0,gpt2)/grub2/grub.cfg\0"
+- EventNum: 39
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "e406f33b6c2268c4b370a0f2445a61c40cff8f9496057056f2fe28d8bfb2a7e3"
+  EventSize: 26
+  Event:
+    String: |-
+      "(hd0,gpt2)/grub2/grub.cfg\0"
+- EventNum: 40
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "fc1ac040fc293ed95e4594b67c4378a832d67c8951a3a5e7032e919eb99c5f88"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd: set pager=1\0"
+- EventNum: 41
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "b3fa538baf79d1c124c21e7c4b7816563ad00e726d72bdf775d7d8c1171ebff2"
+  EventSize: 42
+  Event:
+    String: |-
+      "grub_cmd:  -f (hd0,gpt2)/grub2/grubenv \0"
+- EventNum: 42
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "06c0ff22313606eef3c6082214f8c0a2b813fb987dfd4c98033080276eb08745"
+  EventSize: 47
+  Event:
+    String: |-
+      "grub_cmd: load_env -f (hd0,gpt2)/grub2/grubenv\0"
+- EventNum: 43
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "b1ae111cb224346a7342648d107b5394ce808c7892c117a063a3a9a31c6ccd23"
+  EventSize: 25
+  Event:
+    String: |-
+      "(hd0,gpt2)/grub2/grubenv\0"
+- EventNum: 44
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "ce8124bc1b0fbc0cb5cd47338ca0c7d5f5446d79936e443a201d96b192a7bd65"
+  EventSize: 15
+  Event:
+    String: |-
+      "grub_cmd:   \0"
+- EventNum: 45
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "9cda6c923e6ecc7a57f10f30168810e381695d20ef53f59c04d004aaa4e46237"
+  EventSize: 77
+  Event:
+    String: |-
+      "grub_cmd: set default=54e4e23536524c529b66e491dfc77274-5.14.0-130.el9.x86_64\0"
+- EventNum: 46
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "4568361fb7581b31a42d645ab534302fb9f742adaa37b7fde152215d69e259fb"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  xy = xy \0"
+- EventNum: 47
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "09f17d4dfb4b97f16246632c21b1ac2125c95c148899eee5069fbb1b34365513"
+  EventSize: 35
+  Event:
+    String: |-
+      "grub_cmd: menuentry_id_option=--id\0"
+- EventNum: 48
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "4af0bb370c9e3b7982027d02e04c935e32d52b528007476bfc50d36d1b86815e"
+  EventSize: 37
+  Event:
+    String: |-
+      "grub_cmd: export menuentry_id_option\0"
+- EventNum: 49
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "ce8124bc1b0fbc0cb5cd47338ca0c7d5f5446d79936e443a201d96b192a7bd65"
+  EventSize: 15
+  Event:
+    String: |-
+      "grub_cmd:   \0"
+- EventNum: 50
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "1022afd472d62cf10a33afe3e9a3769af2334ada5f5ebd238b428f0d90a497aa"
+  EventSize: 32
+  Event:
+    String: |-
+      "grub_cmd: serial --speed=115200\0"
+- EventNum: 51
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "092ef58da5a532249d7ee58b0d6f0772b3cb39fb24b653ccafe3ddf50d9c49a8"
+  EventSize: 40
+  Event:
+    String: |-
+      "grub_cmd: terminal_input serial console\0"
+- EventNum: 52
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "c81593b0a6c83009cd0c757a681399d7dc491453e042b7b368b530074e5c39b9"
+  EventSize: 41
+  Event:
+    String: |-
+      "grub_cmd: terminal_output serial console\0"
+- EventNum: 53
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "4568361fb7581b31a42d645ab534302fb9f742adaa37b7fde152215d69e259fb"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  xy = xy \0"
+- EventNum: 54
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "1c568398cf2e4a9df58875bbd79dffe058ec45be0b74512fa919a2fe7db4a609"
+  EventSize: 33
+  Event:
+    String: |-
+      "grub_cmd: set timeout_style=menu\0"
+- EventNum: 55
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "71a5b3b21ac3862f40fabb745a9649c3a1d34249b9706524c90b2480c298beb0"
+  EventSize: 24
+  Event:
+    String: |-
+      "grub_cmd: set timeout=5\0"
+- EventNum: 56
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "e3b86ac73bb68db33745fd1cac2ca1d6bbbefb39ac1cca848bc9bc800114e7e5"
+  EventSize: 43
+  Event:
+    String: |-
+      "grub_cmd:  -f (hd0,gpt2)/grub2/user.cfg \0"
+- EventNum: 57
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "29b7ae3acc4da64c4380feaea03c4a761c88bfbb74b3a79ac68a4e2822bbff2f"
+  EventSize: 27
+  Event:
+    String: |-
+      "grub_cmd: insmod increment\0"
+- EventNum: 58
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "55cf6566869a451dbd91b65abbbd92b35b62e8009e9136e8df11846a287b93ae"
+  EventSize: 27
+  Event:
+    String: |-
+      "grub_cmd:  -n  -a 0 = 0 \0"
+- EventNum: 59
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "62cd76d31ca3d10d742e46c6ff171046ce19dd90f361a827fec6571e59c24794"
+  EventSize: 26
+  Event:
+    String: |-
+      "grub_cmd: insmod part_gpt\0"
+- EventNum: 60
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "39c36226c5af91f9ee4969786436cc8ad87252b22b55c006bb8ef98a0eaef85d"
+  EventSize: 21
+  Event:
+    String: |-
+      "grub_cmd: insmod xfs\0"
+- EventNum: 61
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "96d10df2fba642d434781baf243b25e910759c649db2c81fce017759a2e733f3"
+  EventSize: 87
+  Event:
+    String: |-
+      "grub_cmd: search --no-floppy --fs-uuid --set=root ed5e9398-1a8f-4ae2-a8b8-c4cd677a759f\0"
+- EventNum: 62
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "62cd76d31ca3d10d742e46c6ff171046ce19dd90f361a827fec6571e59c24794"
+  EventSize: 26
+  Event:
+    String: |-
+      "grub_cmd: insmod part_gpt\0"
+- EventNum: 63
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "c8fabb4ae6637fa9a9037444c80a55b1a2d2da2c2b9b8842b7810379877955f6"
+  EventSize: 21
+  Event:
+    String: |-
+      "grub_cmd: insmod fat\0"
+- EventNum: 64
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "839290aa76a4b0d6bfe0a8d3908116f4991e2e81c9f1ff0c395b907692944ffe"
+  EventSize: 60
+  Event:
+    String: |-
+      "grub_cmd: search --no-floppy --fs-uuid --set=boot EE2C-46E8\0"
+- EventNum: 65
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "4e7a22f96bae467df0f26975e0bf7614d6b92993301c65bae6a85c6530e460bf"
+  EventSize: 18
+  Event:
+    String: |-
+      "grub_cmd:  -z  \0"
+- EventNum: 66
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "799852ff506d6ce018c30e57166e6e04f450a16f9df958737e1e1473046fb8e0"
+  EventSize: 146
+  Event:
+    String: |-
+      "grub_cmd: set kernelopts=root=UUID=10d7f09f-7852-4b75-a2b6-2355d99b4376 ro resume=UUID=c39a47a6-aaad-45f9-87f1-26be66fe2a24 console=ttyS0,115200 \0"
+- EventNum: 67
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "822e637a86c14c686c7beda98067089103cfb97984033b6d607d9feb82f0d234"
+  EventSize: 24
+  Event:
+    String: |-
+      "grub_cmd: insmod blscfg\0"
+- EventNum: 68
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "05a5577cb6b242b7b5aff400fd90224598d1e354937fadc90f954cab3dc78519"
+  EventSize: 17
+  Event:
+    String: |-
+      "grub_cmd: blscfg\0"
+- EventNum: 69
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "ad40d8033aa535ebbb889e4cfc0b9330cb91333662df4faad83afb5a4679ff4b"
+  EventSize: 87
+  Event:
+    String: |-
+      "(hd0,gpt2)/loader/entries//54e4e23536524c529b66e491dfc77274-5.14.0-130.el9.x86_64.conf\0"
+- EventNum: 70
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "0f091ad303dc1b251381cce9debaf422871c8f57aae37f4604fe11f1a7d043c8"
+  EventSize: 74
+  Event:
+    String: |-
+      "(hd0,gpt2)/loader/entries//54e4e23536524c529b66e491dfc77274-0-rescue.conf\0"
+- EventNum: 71
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "eb866bcea8420a022810dd2c940e9647b149c7c4702755aa08dea821b5a67756"
+  EventSize: 29
+  Event:
+    String: |-
+      "grub_cmd:  0 = 1 -o 0 = 1 \0"
+- EventNum: 72
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "bc7b76a012f77212c24c2db187fb8474dbb2f6567186a64c3550b30f4ffc4363"
+  EventSize: 29
+  Event:
+    String: |-
+      "grub_cmd: set menu_hide_ok=0\0"
+- EventNum: 73
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "73685e16907fb87cb70065627b206b7142631e929ac4285418fb56399b607079"
+  EventSize: 20
+  Event:
+    String: |-
+      "grub_cmd:  0 = 1 \0"
+- EventNum: 74
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "73685e16907fb87cb70065627b206b7142631e929ac4285418fb56399b607079"
+  EventSize: 20
+  Event:
+    String: |-
+      "grub_cmd:  0 = 1 \0"
+- EventNum: 75
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "d4468e9ea1b6827517d1f626f8c34b364007a3611c2a17fbf51bc7e7eaa49138"
+  EventSize: 29
+  Event:
+    String: |-
+      "grub_cmd: set boot_success=0\0"
+- EventNum: 76
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "11ad30ffc650e4c3b13a3e434111a5bc12fb00699138c06e80d132124b61a86b"
+  EventSize: 51
+  Event:
+    String: |-
+      "grub_cmd: save_env boot_success boot_indeterminate\0"
+- EventNum: 77
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "4568361fb7581b31a42d645ab534302fb9f742adaa37b7fde152215d69e259fb"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  xy = xy \0"
+- EventNum: 78
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "ce8124bc1b0fbc0cb5cd47338ca0c7d5f5446d79936e443a201d96b192a7bd65"
+  EventSize: 15
+  Event:
+    String: |-
+      "grub_cmd:   \0"
+- EventNum: 79
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "5d487e285706b36d48eff03e56383e4692de24b867b38fcb3c5896fd222a5957"
+  EventSize: 24
+  Event:
+    String: |-
+      "grub_cmd:  efi = efi \0"
+- EventNum: 80
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "fb84aff84de5bcc528ede92bec117fa8cea46362c5d2ea946e44299a968ffac7"
+  EventSize: 77
+  Event:
+    String: |-
+      "grub_cmd: menuentry UEFI Firmware Settings --id uefi-firmware {"
+      "\t\tfwsetup"
+      "\t}\0"
+- EventNum: 81
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "2772cd3a066fe5a53ee59546d123304f52ede2f0225dfbe9e14d7d1b33f732a5"
+  EventSize: 45
+  Event:
+    String: |-
+      "grub_cmd:  -f (hd0,gpt2)/grub2/custom.cfg \0"
+- EventNum: 82
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "8b9a38d95384b44889dbcbcdb5fa13679511d4b0f69078d554e7a95ba78dcd5c"
+  EventSize: 68
+  Event:
+    String: |-
+      "grub_cmd:  -z (hd0,gpt2)/grub2 -a -f (hd0,gpt2)/grub2/custom.cfg \0"
+- EventNum: 83
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "7626abd8be7442c2e575364a3e95cb3a3b533c58afbba402d2bdabdff85d29c7"
+  EventSize: 21
+  Event:
+    String: |-
+      "grub_cmd: load_video\0"
+- EventNum: 84
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "4568361fb7581b31a42d645ab534302fb9f742adaa37b7fde152215d69e259fb"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd:  xy = xy \0"
+- EventNum: 85
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "d71353f5368eb2c1280590928128979bd96ea8db1e8c81493f7878383b76ab3b"
+  EventSize: 27
+  Event:
+    String: |-
+      "grub_cmd: insmod all_video\0"
+- EventNum: 86
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "15a5018b0177cf9c49c0b97911df67e7f2c193d3613e3fc4c9eb98a2b5d06fcc"
+  EventSize: 30
+  Event:
+    String: |-
+      "grub_cmd: set gfxpayload=keep\0"
+- EventNum: 87
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "6c4674d4c652ee67b98a6206d7541ccbf2d5dc0a18dae31ad66e82c794c49784"
+  EventSize: 22
+  Event:
+    String: |-
+      "grub_cmd: insmod gzio\0"
+- EventNum: 88
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "753adbf2c98996166c82e7834c1f7af48987739bec81e3948b2017955c50705c"
+  EventSize: 247
+  Event:
+    String: |-
+      "grub_cmd: linux (hd0,gpt2)/vmlinuz-5.14.0-130.el9.x86_64 root=UUID=10d7f09f-7852-4b75-a2b6-2355d99b4376 ro resume=UUID=c39a47a6-aaad-45f9-87f1-26be66fe2a24 console=ttyS0,115200 ima_appraise=fix ima_canonical_fmt ima_policy=tcb ima_template=ima-ng\0"
+- EventNum: 89
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "0114cf38d49a529321c6dc4cef08424418efe3384494ff0a8fde04eee9a608bd"
+  EventSize: 41
+  Event:
+    String: |-
+      "(hd0,gpt2)/vmlinuz-5.14.0-130.el9.x86_64\0"
+- EventNum: 90
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "55ca5219d41971e1dcdb75b3624e63f96f8bafd4edf57007f60343b9dec3a4da"
+  EventSize: 32
+  Event:
+    ImageLocationInMemory: 0x7a07b640
+    ImageLengthInMemory: 11302456
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 0
+    DevicePath: ''
+- EventNum: 91
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "55ca5219d41971e1dcdb75b3624e63f96f8bafd4edf57007f60343b9dec3a4da"
+  EventSize: 32
+  Event:
+    ImageLocationInMemory: 0x78b19580
+    ImageLengthInMemory: 11302456
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 0
+    DevicePath: ''
+- EventNum: 92
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "6fed7c51f16551db907d6ac192194735c33cd2aad9e80b7124dbae6c49e92fe3"
+  EventSize: 247
+  Event:
+    String: |-
+      "kernel_cmdline: (hd0,gpt2)/vmlinuz-5.14.0-130.el9.x86_64 root=UUID=10d7f09f-7852-4b75-a2b6-2355d99b4376 ro resume=UUID=c39a47a6-aaad-45f9-87f1-26be66fe2a24 console=ttyS0,115200 ima_appraise=fix ima_canonical_fmt ima_policy=tcb ima_template=ima-ng\0"
+- EventNum: 93
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "4284fb7e9806b80b5ffd8ac0db1b55806ad915e08830c08423f1dc79857ad230"
+  EventSize: 64
+  Event:
+    String: |-
+      "grub_cmd: initrd (hd0,gpt2)/initramfs-5.14.0-130.el9.x86_64.img\0"
+- EventNum: 94
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "3b88d84f382249264ef0e9c6baeed69484b163b913db7a127dd7775be146225d"
+  EventSize: 47
+  Event:
+    String: |-
+      "(hd0,gpt2)/initramfs-5.14.0-130.el9.x86_64.img\0"
+- EventNum: 95
+  PCRIndex: 5
+  EventType: EV_EFI_ACTION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "d8043d6b7b85ad358eb3b6ae6a873ab7ef23a26352c5dc4faa5aeedacf5eb41b"
+  EventSize: 29
+  Event: |-
+    Exit Boot Services Invocation
+- EventNum: 96
+  PCRIndex: 5
+  EventType: EV_EFI_ACTION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "b54f7542cbd872a81a9d9dea839b2b8d747c7ebd5ea6615c40f42f44a6dbeba0"
+  EventSize: 40
+  Event: |-
+    Exit Boot Services Returned with Success
+pcrs:
+  sha256:
+    0  : 0xfcb620568efe4ac4e15f6dcbc6431cad79bc85c7f2f592e08dde0bf37da6df39
+    1  : 0xb2eb2c29be62e89089cf14b827e4feaaf08b48d19ba69981eb2fc43c50a332b1
+    2  : 0xf12eecdb5c80b81e5b0ee1d55794a6a6ddb58b8223039b7930134a8515690a17
+    3  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    4  : 0x83210a75db8818d9c65d688ce2b8aa9b3ff6dd7b23dd8fbee0c26dd0a7744c6a
+    5  : 0x7631b54abc865ab7872445ec9cab5993504a5fc88e837eabed390048741e468d
+    6  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    7  : 0x56c7ba6010e0a8a20c92e3d08baebcf2a7e6544fed33c3ea9523eaa6cd74537a
+    8  : 0xf2e988cbd9116a83812fa6c1ce4ac70d286ea256c5d71ea15de404fa7b5ff5f1
+    9  : 0x82a2887b01c5d730c7059e677ff18d5496c646ea18ace9eb86347bb5f6eb79b9
+    14 : 0xa4dad77fb3b6cacbd20f556986c5d917f5e322c123af82d12c5e5b7ef7ae9938

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-postcode.bin Added

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-postcode.bin.yaml Added

@@ -0,0 +1,884 @@
+---
+version: 1
+events:
+- EventNum: 0
+  PCRIndex: 0
+  EventType: EV_NO_ACTION
+  Digest: "0000000000000000000000000000000000000000"
+  EventSize: 37
+  SpecID:
+  - Signature: Spec ID Event03
+    platformClass: 0
+    specVersionMinor: 0
+    specVersionMajor: 2
+    specErrata: 0
+    uintnSize: 2
+    numberOfAlgorithms: 2
+    Algorithms:
+    - Algorithm0:
+      algorithmId: sha1
+      digestSize: 20
+    - Algorithm1:
+      algorithmId: sha256
+      digestSize: 32
+    vendorInfoSize: 0
+- EventNum: 1
+  PCRIndex: 0
+  EventType: EV_S_CRTM_VERSION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "c42fedad268200cb1d15f97841c344e79dae3320"
+  - AlgorithmId: sha256
+    Digest: "d4720b4009438213b803568017f903093f6bea8ab47d283db32b6eabedbbf155"
+  EventSize: 16
+  Event: "1efb6b540c1d5540a4ad4ef4bf17b83a"
+- EventNum: 2
+  PCRIndex: 0
+  EventType: EV_POST_CODE
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "2ae338407a3d9304e82360e9891ac12b89e838a6"
+  - AlgorithmId: sha256
+    Digest: "533a706b2c32ac3b42342959d4ff906135ebe9de52ecb4b0e0804c153aedcbe4"
+  EventSize: 16
+  Event:
+    BlobBase: 0xff130000
+    BlobLength: 0xa7f000
+- EventNum: 3
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d4fdd1f14d4041494deb8fc990c45343d2277d08"
+  - AlgorithmId: sha256
+    Digest: "ccfc4bb32888a345bc8aeadaba552b627d99348c767681ab3141f5b01e40a40e"
+  EventSize: 53
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 10
+    VariableDataLength: 1
+    UnicodeName: SecureBoot
+    VariableData: "01"
+- EventNum: 4
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "74695203091adbb40c8420f1b499a6ac1a723962"
+  - AlgorithmId: sha256
+    Digest: "b161e0347f5f040997f97ff52642d43b3a87b986dae8d776d6af27e6468675e6"
+  EventSize: 1011
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 2
+    VariableDataLength: 975
+    UnicodeName: PK
+    VariableData: "a159c0a5e494a74a87b5ab155c2bf072cf03000000000000b30300005148dc265f19e14a9a19fbf883bbb35e3082039f30820287a00302010202103b98c74f9010d1a94c4383363dced485300d06092a864886f70d01010b05003072310c300a06035504061303555341310b300906035504080c0243413111300f06035504070c0853616e204a6f736531223020060355040a0c195375706572204d6963726f20436f6d707574657220496e632e311e301c06035504030c1553555045524d4943524f20504b2043412032303138301e170d3138313232303031343630345a170d3333313232303031353630335a3072310c300a06035504061303555341310b300906035504080c0243413111300f06035504070c0853616e204a6f736531223020060355040a0c195375706572204d6963726f20436f6d707574657220496e632e311e301c06035504030c1553555045524d4943524f20504b204341203230313830820122300d06092a864886f70d01010105000382010f003082010a0282010100b398bfed1fc069518e4daa9129ce319e1b628e022a15e4271bdace95eae234b9f35d5f41aef62b1d04655206371b2b10ad6a750efaee87d6785755c579986e3936a4eb1769eee7335bc2f0f9e596fbc7ee21db41f5a48a621983a3cb16ab74142c0b586272d0f9e2c95b3176ea0659ba37e43bca8f58b115f9a6cb718cb92269483f735763d5ca54e9ae894b3c4bb7b81ad666d88eee177cd96826d2b4721ccdcb3abd2e14a1941a0be7543b17eb944be4a23490939e50aa5e4dfb1f3491d4506f13a0a5104980cd9b8e452b7ec1b49285c768b2652f58287ccb95090810370a8cb5b5c41840a7ad87b2efa5c29404858802e7fa2be41707b5557e312a65fbad0203010001a331302f300e0603551d0f0101ff040403020186301d0603551d0e041604142f7f6b38d83ab463442ae8edd4f1ceba35688388300d06092a864886f70d01010b050003820101002ae10c936dc7137242fa482ffaef28320b39dd00e43e962a31fa33561b615bf80c7df84d18dbfacca8726595a214cb906028dc0a5b723a9d0e9c6583482224498930b40bf39eafbd5b938db74dec4ab46fe5a435e1f57841181d600b7dfc79de431bf9e916de1e22cd627781759bc07de67c1fab878cf7b978678697c47e2c32f2a273d650cbc446a93a18aa3a1e61086034c58cebb61ccf2081ab7bfcb0d8a582dda9139765e08e62004caa252afd665dedda4e47c29dd5fc69f1aaa6b32d66e0e70b98621e3f0c8f2c665355a987fbbf5f1c0e474c8af8d13d1e87c0ffc64ef39a03995e519fbd84f0760e1ae0973b8cf010386b4bca17fc1105b3b8b2c305"
+- EventNum: 5
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "13f02fbc7383ed7c89017e0b32f60e38e282056c"
+  - AlgorithmId: sha256
+    Digest: "63c0ee78eb49b91ac213b03768a827ebf9b12370f65851b19a883bf32eaf2a14"
+  EventSize: 1598
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 3
+    VariableDataLength: 1560
+    UnicodeName: KEK
+    VariableData: "a159c0a5e494a74a87b5ab155c2bf0721806000000000000fc050000bd9afa775903324dbd6028f4e78f784b308205e8308203d0a003020102020a610ad188000000000003300d06092a864886f70d01010b0500308191310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313b3039060355040313324d6963726f736f667420436f72706f726174696f6e205468697264205061727479204d61726b6574706c61636520526f6f74301e170d3131303632343230343132395a170d3236303632343230353132395a308180310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312a3028060355040313214d6963726f736f667420436f72706f726174696f6e204b454b204341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100c4e8b58abfad5726b026c3eae7fb577a44025d070dda4ae5742ae6b00fec6debec7fb9e35a63327c11174f0ee30ba73815938ec6f5e084b19a9b2ce7f5b791d609e1e2c004a8ac301cdf48f306509a64a7517fc8854f8f2086cefe2fe19fff82c0ede9cdcef4536a623a0b43b9e225fdfe05f9d4c414ab11e223898d70b7a41d4decaee59cfa16c2d7c1cbd4e8c42fe599ee248b03ec8df28beac34afb4311120b7eb547926cdce60489ebf53304eb10012a71e5f983133cff25092f687646ffba4fbedcad712a58aafb0ed2793de49b653bcc292a9ffc7259a2ebae92eff6351380c602ece45fcc9d76cdef6392c1af79408479877fe352a8e89d7b07698f150203010001a382014f3082014b301006092b06010401823715010403020100301d0603551d0e0416041462fc43cda03ea4cb6712d25bd955ac7bccb68a5f301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d2304183016801445665243e17e5811bfd64e9e2355083b3a226aa8305c0603551d1f045530533051a04fa04d864b687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e637274300d06092a864886f70d01010b05000382020100d48488f514941802ca2a3cfb2a921c0cd7a0d1f1e85266a8eea2b5757a9000aa2da4765aea79b7b9376a517b1064f6e164f20267bef7a81b78bdbace8858640cd657c819a35f05d6dbc6d069ce484b32b7eb5dd230f5c0f5b8ba7807a32bfe9bdb345684ec82caae4125709c6be9fe900fd7961fe5e7941fb22a0c8d4bff2829107bf7d77ca5d176b905c879ed0f90929cc2fedf6f7e6c0f7bd4c145dd345196390fe55e56d8180596f407a642b3a077fd0819f27156cc9f8623a487cba6fd587ed4696715917e81f27f13e50d8b8a3c8784ebe3cebd43e5ad2d84938e6a2b5a7c44fa52aa81c82d1cbbe052df0011f89a3dc160b0e133b5a388d165190a1ae7ac7ca4c182874e38b12f0dc514876ffd8d2ebc39b6e7e6c3e0e4cd2784ef9442ef298b9046413b811b67d8f9435965cb0dbcfd00924ff4753ba7a924fc50414079e02d4f0a6a27766e52ed96697baf0ff78705d045c2ad5314811ffb3004aa373661da4a691b34d868edd602cf6c940cd3cf6c2279adb1f0bc03a24660a9c407c22182f1fdf2e8793260bfd8aca522144bcac1d84beb7d3f5735b2e64f75b4b060032253ae91791dd69b411f15865470b2de0d350f7cb03472ba97603bf079eba2b21c5da216b887c5e91bf6b597256f389fe391fa8a7998c3690eb7a31c200597f8ca14ae00d7c4f3c01410756b34a01bb59960f35cb0c5574e36d23284bf9e"
+- EventNum: 6
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "b0a330783903281d43a79ddc6b6bf7aceb3b10fa"
+  - AlgorithmId: sha256
+    Digest: "a70c57a09bd713fa74a267c2fe5e5553c6c832d330fffaa12c3323c60b016048"
+  EventSize: 5223
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 2
+    VariableDataLength: 5187
+    UnicodeName: db
+    VariableData: "a159c0a5e494a74a87b5ab155c2bf072400600000000000024060000bd9afa775903324dbd6028f4e78f784b30820610308203f8a003020102020a6108d3c4000000000004300d06092a864886f70d01010b0500308191310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313b3039060355040313324d6963726f736f667420436f72706f726174696f6e205468697264205061727479204d61726b6574706c61636520526f6f74301e170d3131303632373231323234355a170d3236303632373231333234355a308181310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312b3029060355040313224d6963726f736f667420436f72706f726174696f6e2055454649204341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100a5086c4cc745096a4b0ca4c0877f06750c43015464e0167f07ed927d0bb273bf0c0ac64a4561a0c5162d96d3f52ba0fb4d499b4180903cb954fde6bcd19dc4a4188a7f418a5c59836832bb8c47c9ee71bc214f9a8a7cff443f8d8f32b22648ae75b5eec94c1e4a197ee4829a1d78774d0cb0bdf60fd316d3bcfa2ba551385df5fbbadb7802dbffec0a1b96d583b81913e9b6c07b407be11f2827c9faef565e1ce67e947ec0f044b27939e5dab2628b4dbf3870e2682414c933a40837d558695ed37cedc1045308e74eb02a876308616f631559eab22b79d70c61678a5bfd5ead877fba86674f71581222042222ce8bef547100ce503558769508ee6ab1a201d50203010001a382017630820172301206092b060104018237150104050203010001302306092b060104018237150204160414f8c16bb77f77534af325371d4ea1267b0f207080301d0603551d0e0416041413adbf4309bd82709c8cd54f316ed522988a1bd4301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d2304183016801445665243e17e5811bfd64e9e2355083b3a226aa8305c0603551d1f045530533051a04fa04d864b687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e637274300d06092a864886f70d01010b05000382020100350842ff30cccef7760cad1068583529463276277cef124127421b4aaa6d813848591355f3e95834a6160b82aa5dad82da808341068fb41df203b9f31a5d1bf15090f9b3558442281c20bdb2ae5114c5c0ac9795211c90db0ffc779e95739188cabdbd52b905500ddf579ea061ed0de56d25d9400f1740c8cea34ac24daf9a121d08548fbdc7bcb92b3d492b1f32fc6a21694f9bc87e4234fc3606178b8f2040c0b39a257527cdc903a3f65dd1e736547ab950b5d312d107bfbb74dfdc1e8f80d5ed18f42f14166b2fde668cb023e5c784d8edeac13382ad564b182df1689507cdcff072f0aebbdd8685982c214c332bf00f4af06887b592553275a16a826a3ca32511a4edadd704aecbd84059a084d1954c6291221a741d8c3d470e44a6e4b09b3435b1fab653a82c81eca40571c89db8bae81b4466e447540e8e567fb39f1698b286d0683e9023b52f5e8f50858dc68d825f41a1f42e0de099d26c75e4b669b52186fa07d1f6e24dd1daad2c77531e253237c76c52729586b0f135616a19f5b23b815056a6322dfea289f94286271855a182ca5a9bf830985414a64796252fc826e441941a5c023fe596e3855b3c3e3fbb47167255e22522b1d97be703062aa3f71e9046c3000dd61989e30e352762037115a6efd027a0a0593760f83894b8e07870f8ba4c868794f6e0ae0245ee65c2b6a37e69167507929bf5a6bc598358a159c0a5e494a74a87b5ab155c2bf0720706000000000000eb050000bd9afa775903324dbd6028f4e78f784b308205d7308203bfa003020102020a61077656000000000008300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3131313031393138343134325a170d3236313031393138353134325a308184310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e20504341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100dd0cbba2e42e09e3e7c5f79669bc0021bd693333efad04cb5480ee0683bbc52084d9f7d28bf338b0aba4ad2d7c627905ffe34a3f04352070e3c4e76be09cc03675e98a31dd8d70e5dc37b5744696285b8760232cbfdc47a567f751279e72eb07a6c9b91e3b53357ce5d3ec27b9871cfeb9c923096fa84691c16e963c41d3cba33f5d026a4dec691f25285c36fffd43150a94e019b4cfdfc212e2c25b27ee2778308b5b2a096b22895360162cc0681d53baec49f39d618c85680973445d7da2542bdd79f715cf355d6c1c2b5ccebc9c238b6f6eb526d93613c34fd627aeb9323b41922ce1c7cd77e8aa544ef75c0b048765b44318a8b2e06d1977ec5a24fa48030203010001a38201433082013f301006092b06010401823715010403020100301d0603551d0e04160414a92902398e16c49778cd90f99e4f9ae17c55af53301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014d5f656cb8fe8a25c6268d13d94905bd7ce9a18c430560603551d1f044f304d304ba049a0478645687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f4365724175745f323031302d30362d32332e63726c305a06082b06010505070101044e304c304a06082b06010505073002863e687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f4365724175745f323031302d30362d32332e637274300d06092a864886f70d01010b0500038202010014fc7c7151a579c26eb2ef393ebc3c520f6e2b3f101373fea868d048a6344d8a960526ee3146906179d6ff382e456bf4c0e528b8da1d8f8adb09d71ac74c0a36666a8cec1bd70490a81817a49bb9e240323676c4c15ac6bfe404c0ea16d3acc368ef62acdd546c503058a6eb7cfe94a74e8ef4ec7c867357c2522173345af3a38a56c804da0709edf88be3cef47e8eaef0f60b8a08fb3fc91d727f53b8ebbe63e0e33d3165b081e5f2accd16a49f3da8b19bc242d090845f541dff89eaba1d47906fb0734e419f409f5fe5a12ab21191738a2128f0cede73395f3eab5c60ecdf0310a8d309e9f4f69685b67f51886647198da2b0123d812a680577bb914c627bb6c107c7ba7a8734030e4b627a99e9cafcce4a37c92da4577c1cfe3ddcb80f5afad6c4b30285023aeab3d96ee4692137de81d1f675190567d393575e291b39c8ee2de1cde445735bd0d2ce7aab1619824658d05e9d81b367af6c35f2bce53f24e235a20a7506f6185699d4782cd1051bebd088019daa10f105dfba7e2c63b7069b2321c4f9786ce2581706362b911203cca4d9f22dbaf9949d40ed1845f1ce8a5c6b3eab03d370182a0a6ae05f47d1d5630a32f2afd7361f2a705ae5425908714b57ba7e8381f0213cf41cc1c5b990930e88459386e9b12099be98cbc595a45d62d6a0630820bd7510777d3df345b99f979fcb57806f33a904cf77a4621c597ea159c0a5e494a74a87b5ab155c2bf07296030000000000007a0300005148dc265f19e14a9a19fbf883bbb35e308203663082024ea003020102020100300d06092a864886f70d01010b05003072310c300a06035504061303555341310b300906035504080c0243413111300f06035504070c0853616e204a6f736531223020060355040a0c195375706572204d6963726f20436f6d707574657220496e632e311e301c06035504030c1553555045524d4943524f20504b2043412032303138301e170d3138313231393030303030305a170d3333313231393030303030305a3077310c300a06035504061303555341310b300906035504080c0243413111300f06035504070c0853616e204a6f736531223020060355040a0c195375706572204d6963726f20436f6d707574657220496e632e3123302106035504030c1a53555045524d4943524f2050726f64756374204341203230313830820122300d06092a864886f70d01010105000382010f003082010a0282010100f1ca4d346a9b816d3f5852e7e7dae114ca309ea8c44f0d6ae069084d3d3539e4592d43d9289d0adc7033a28722aee91892d0dbe605a59f16af74a39b33eea1d2839a958c0b45f6b51c4af9182fc950ec9dec100be8e56e6fb89df08ab2ee123b9cc79046fbb257f1479e2657eaed1ee805397540096043ddec5bd238967d9069e7d3ad39ecebf45507976221a529bfbedf62ec1b1a00065b6c8541ab3f5055024ade1ee1d0a78b94cdb335c6e7de860c813f73296730ce16017b2e958fc69de3930f0c8018f71694aa60791df6094b9e1bf1d33fcc427256d2980629c1fefa5e0f38a557a663f30e6814a57f1cd9f5f553edfed1f6865320013e21a27c6f80070203010001a3023000300d06092a864886f70d01010b05000382010100365dc9c0f57f682738cbc02e279b0851975849d81cfa211fac7bc2c0bffad57bb9c8ca546507292146fc487dfaf3845b647d8671964e16bb8ea59ccb654462ecccba42b68bd8a4db98269ae408a70cdac93b80d363901e64a104127cc21a8de9def4f2d74067e5bad76d6e08c2355f1fdbab5d8ee0a17fd225aaa91a6f31c3a5c0e8f2a3b3475a6958383aa7bb64cc692710a2c40e7295e17e54e95be90cdd71adffb4b0b4280b485c0229942a589a2fb7623e3e1738361441483027642756a121da62b3efc0cbbe8d0267dcc866f2af1c4c4349052389c7628fc66aaf159a8cead746733b30b2a9fcb0737fd33b7cc7791a872b9dcc9498ac300a04259fe31aa159c0a5e494a74a87b5ab155c2bf07266040000000000004a0400005148dc265f19e14a9a19fbf883bbb35e308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604"
+- EventNum: 7
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9e04b683b1ade74270dc6083dd716acc63a33310"
+  - AlgorithmId: sha256
+    Digest: "a044b4ce4a4dca9af312c897dc56ee1727c385eb88f7cfb9092b8265029d5b1e"
+  EventSize: 3762
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 3
+    VariableDataLength: 3724
+    UnicodeName: dbx
+    VariableData: "2616c4c14c509240aca941f9369343288c0e00000000000030000000bd9afa775903324dbd6028f4e78f784b80b4d96931bf0d02fd91a61e19d14f1da452e66db2408ca8604d411f92659f0abd9afa775903324dbd6028f4e78f784bf52f83a3fa9cfbd6920f722824dbe4034534d25b8507246b3b957dac6e1bce7abd9afa775903324dbd6028f4e78f784bc5d9d8a186e2c82d09afaa2a6f7f2e73870d3e64f72c4e08ef67796a840f0fbdbd9afa775903324dbd6028f4e78f784b363384d14d1f2e0b7815626484c459ad57a318ef4396266048d058c5a19bbf76bd9afa775903324dbd6028f4e78f784b1aec84b84b6c65a51220a9be7181965230210d62d6d33c48999c6b295a2b0a06bd9afa775903324dbd6028f4e78f784be6ca68e94146629af03f69c2f86e6bef62f930b37c6fbcc878b78df98c0334e5bd9afa775903324dbd6028f4e78f784bc3a99a460da464a057c3586d83cef5f4ae08b7103979ed8932742df0ed530c66bd9afa775903324dbd6028f4e78f784b58fb941aef95a25943b3fb5f2510a0df3fe44c58c95e0ab80487297568ab9771bd9afa775903324dbd6028f4e78f784b5391c3a2fb112102a6aa1edc25ae77e19f5d6f09cd09eeb2509922bfcd5992eabd9afa775903324dbd6028f4e78f784bd626157e1d6a718bc124ab8da27cbb65072ca03a7b6b257dbdcbbd60f65ef3d1bd9afa775903324dbd6028f4e78f784bd063ec28f67eba53f1642dbf7dff33c6a32add869f6013fe162e2c32f1cbe56dbd9afa775903324dbd6028f4e78f784b29c6eb52b43c3aa18b2cd8ed6ea8607cef3cfae1bafe1165755cf2e614844a44bd9afa775903324dbd6028f4e78f784b90fbe70e69d633408d3e170c6832dbb2d209e0272527dfb63d49d29572a6f44cbd9afa775903324dbd6028f4e78f784b075eea060589548ba060b2feed10da3c20c7fe9b17cd026b94e8a683b8115238bd9afa775903324dbd6028f4e78f784b07e6c6a858646fb1efc67903fe28b116011f2367fe92e6be2b36999eff39d09ebd9afa775903324dbd6028f4e78f784b09df5f4e511208ec78b96d12d08125fdb603868de39f6f72927852599b659c26bd9afa775903324dbd6028f4e78f784b0bbb4392daac7ab89b30a4ac657531b97bfaab04f90b0dafe5f9b6eb90a06374bd9afa775903324dbd6028f4e78f784b0c189339762df336ab3dd006a463df715a39cfb0f492465c600e6c6bd7bd898cbd9afa775903324dbd6028f4e78f784b0d0dbeca6f29eca06f331a7d72e4884b12097fb348983a2a14a0d73f4f10140fbd9afa775903324dbd6028f4e78f784b0dc9f3fb99962148c3ca833632758d3ed4fc8d0b0007b95b31e6528f2acd5bfcbd9afa775903324dbd6028f4e78f784b106faceacfecfd4e303b74f480a08098e2d0802b936f8ec774ce21f31686689cbd9afa775903324dbd6028f4e78f784b174e3a0b5b43c6a607bbd3404f05341e3dcf396267ce94f8b50e2e23a9da920cbd9afa775903324dbd6028f4e78f784b18333429ff0562ed9f97033e1148dceee52dbe2e496d5410b5cfd6c864d2d10fbd9afa775903324dbd6028f4e78f784b2b99cf26422e92fe365fbf4bc30d27086c9ee14b7a6fff44fb2f6b9001699939bd9afa775903324dbd6028f4e78f784b2bbf2ca7b8f1d91f27ee52b6fb2a5dd049b85a2b9b529c5d6662068104b055f8bd9afa775903324dbd6028f4e78f784b2c73d93325ba6dcbe589d4a4c63c5b935559ef92fbf050ed50c4e2085206f17dbd9afa775903324dbd6028f4e78f784b2e70916786a6f773511fa7181fab0f1d70b557c6322ea923b2a8d3b92b51af7dbd9afa775903324dbd6028f4e78f784b306628fa5477305728ba4a467de7d0387a54f569d3769fce5e75ec89d28d1593bd9afa775903324dbd6028f4e78f784b3608edbaf5ad0f41a414a1777abf2faf5e670334675ec3995e6935829e0caad2bd9afa775903324dbd6028f4e78f784b3841d221368d1583d75c0a02e62160394d6c4e0a6760b6f607b90362bc855b02bd9afa775903324dbd6028f4e78f784b3fce9b9fdf3ef09d5452b0f95ee481c2b7f06d743a737971558e70136ace3e73bd9afa775903324dbd6028f4e78f784b4397daca839e7f63077cb50c92df43bc2d2fb2a8f59f26fc7a0e4bd4d9751692bd9afa775903324dbd6028f4e78f784b47cc086127e2069a86e03a6bef2cd410f8c55a6d6bdb362168c31b2ce32a5adfbd9afa775903324dbd6028f4e78f784b518831fe7382b514d03e15c621228b8ab65479bd0cbfa3c5c1d0f48d9c306135bd9afa775903324dbd6028f4e78f784b5ae949ea8855eb93e439dbc65bda2e42852c2fdf6789fa146736e3c3410f2b5cbd9afa775903324dbd6028f4e78f784b6b1d138078e4418aa68deb7bb35e066092cf479eeb8ce4cd12e7d072ccb42f66bd9afa775903324dbd6028f4e78f784b6c8854478dd559e29351b826c06cb8bfef2b94ad3538358772d193f82ed1ca11bd9afa775903324dbd6028f4e78f784b6f1428ff71c9db0ed5af1f2e7bbfcbab647cc265ddf5b293cdb626f50a3a785ebd9afa775903324dbd6028f4e78f784b71f2906fd222497e54a34662ab2497fcc81020770ff51368e9e3d9bfcbfd6375bd9afa775903324dbd6028f4e78f784b726b3eb654046a30f3f83d9b96ce03f670e9a806d1708a0371e62dc49d2c23c1bd9afa775903324dbd6028f4e78f784b72e0bd1867cf5d9d56ab158adf3bddbc82bf32a8d8aa1d8c5e2f6df29428d6d8bd9afa775903324dbd6028f4e78f784b7827af99362cfaf0717dade4b1bfe0438ad171c15addc248b75bf8caa44bb2c5bd9afa775903324dbd6028f4e78f784b81a8b965bb84d3876b9429a95481cc955318cfaa1412d808c8a33bfd33fff0e4bd9afa775903324dbd6028f4e78f784b82db3bceb4f60843ce9d97c3d187cd9b5941cd3de8100e586f2bda5637575f67bd9afa775903324dbd6028f4e78f784b895a9785f617ca1d7ed44fc1a1470b71f3f1223862d9ff9dcc3ae2df92163dafbd9afa775903324dbd6028f4e78f784b8ad64859f195b5f58dafaa940b6a6167acd67a886e8f469364177221c55945b9bd9afa775903324dbd6028f4e78f784b8bf434b49e00ccf71502a2cd900865cb01ec3b3da03c35be505fdf7bd563f521bd9afa775903324dbd6028f4e78f784b8d8ea289cfe70a1c07ab7365cb28ee51edd33cf2506de888fbadd60ebf80481cbd9afa775903324dbd6028f4e78f784b9998d363c491be16bd74ba10b94d9291001611736fdca643a36664bc0f315a42bd9afa775903324dbd6028f4e78f784b9e4a69173161682e55fde8fef560eb88ec1ffedcaf04001f66c0caf707b2b734bd9afa775903324dbd6028f4e78f784ba6b5151f3655d3a2af0d472759796be4a4200e5495a7d869754c4848857408a7bd9afa775903324dbd6028f4e78f784ba7f32f508d4eb0fead9a087ef94ed1ba0aec5de6f7ef6ff0a62b93bedf5d458dbd9afa775903324dbd6028f4e78f784bad6826e1946d26d3eaf3685c88d97d85de3b4dcb3d0ee2ae81c70560d13c5720bd9afa775903324dbd6028f4e78f784baeebae3151271273ed95aa2e671139ed31a98567303a332298f83709a9d55aa1bd9afa775903324dbd6028f4e78f784bafe2030afb7d2cda13f9fa333a02e34f6751afec11b010dbcd441fdf4c4002b3bd9afa775903324dbd6028f4e78f784bb54f1ee636631fad68058d3b0937031ac1b90ccb17062a391cca68afdbe40d55bd9afa775903324dbd6028f4e78f784bb8f078d983a24ac433216393883514cd932c33af18e7dd70884c8235f4275736bd9afa775903324dbd6028f4e78f784bb97a0889059c035ff1d54b6db53b11b9766668d9f955247c028b2837d7a04cd9bd9afa775903324dbd6028f4e78f784bbc87a668e81966489cb508ee805183c19e6acd24cf17799ca062d2e384da0ea7bd9afa775903324dbd6028f4e78f784bc409bdac4775add8db92aa22b5b718fb8c94a1462c1fe9a416b95d8a3388c2fcbd9afa775903324dbd6028f4e78f784bc617c1a8b1ee2a811c28b5a81b4c83d7c98b5b0c27281d610207ebe692c2967fbd9afa775903324dbd6028f4e78f784bc90f336617b8e7f983975413c997f10b73eb267fd8a10cb9e3bdbfc667abdb8bbd9afa775903324dbd6028f4e78f784bcb6b858b40d3a098765815b592c1514a49604fafd60819da88d7a76e9778fef7bd9afa775903324dbd6028f4e78f784bce3bfabe59d67ce8ac8dfd4a16f7c43ef9c224513fbc655957d735fa29f540cebd9afa775903324dbd6028f4e78f784bd8cbeb9735f5672b367e4f96cdc74969615d17074ae96c724d42ce0216f8f3fabd9afa775903324dbd6028f4e78f784be92c22eb3b5642d65c1ec2caf247d2594738eebb7fb3841a44956f59e2b0d1fabd9afa775903324dbd6028f4e78f784bfddd6e3d29ea84c7743dad4a1bdbc700b5fec1b391f932409086acc71dd6dbd8bd9afa775903324dbd6028f4e78f784bfe63a84f782cc9d3fcf2ccf9fc11fbd03760878758d26285ed12669bdc6e6d01bd9afa775903324dbd6028f4e78f784bfecfb232d12e994b6d485d2c7167728aa5525984ad5ca61e7516221f079a1436bd9afa775903324dbd6028f4e78f784bca171d614a8d7e121c93948cd0fe55d39981f9d11aa96e03450a415227c2c65bbd9afa775903324dbd6028f4e78f784b55b99b0de53dbcfe485aa9c737cf3fb616ef3d91fab599aa7cab19eda763b5babd9afa775903324dbd6028f4e78f784b77dd190fa30d88ff5e3b011a0ae61e6209780c130b535ecb87e6f0888a0b6b2fbd9afa775903324dbd6028f4e78f784bc83cb13922ad99f560744675dd37cc94dcad5a1fcba6472fee341171d939e884bd9afa775903324dbd6028f4e78f784b3b0287533e0cc3d0ec1aa823cbf0a941aad8721579d1c499802dd1c3a636b8a9bd9afa775903324dbd6028f4e78f784b939aeef4f5fa51e23340c3f2e49048ce8872526afdf752c3a7f3a3f2bc9f6049bd9afa775903324dbd6028f4e78f784b64575bd912789a2e14ad56f6341f52af6bf80cf94400785975e9f04e2d64d745bd9afa775903324dbd6028f4e78f784b45c7c8ae750acfbb48fc37527d6412dd644daed8913ccd8a24c94d856967df8e"
+- EventNum: 8
+  PCRIndex: 7
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 9
+  PCRIndex: 2
+  EventType: EV_EFI_BOOT_SERVICES_DRIVER
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "1ed5faf8fa9dad50d625e1a6074768bf9a84310a"
+  - AlgorithmId: sha256
+    Digest: "5e289969ac801159131e1f597da9e097abf0539692cb1b1b6199f4609ca81cac"
+  EventSize: 84
+  Event:
+    ImageLocationInMemory: 0x64024018
+    ImageLengthInMemory: 824656
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 52
+    DevicePath: '02010c00d041030a0100000001010600000001010600000004081800000000003846020000000000ff450600000000007fff0400'
+- EventNum: 10
+  PCRIndex: 2
+  EventType: EV_EFI_BOOT_SERVICES_DRIVER
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "1ed5faf8fa9dad50d625e1a6074768bf9a84310a"
+  - AlgorithmId: sha256
+    Digest: "5e289969ac801159131e1f597da9e097abf0539692cb1b1b6199f4609ca81cac"
+  EventSize: 84
+  Event:
+    ImageLocationInMemory: 0x63f5a018
+    ImageLengthInMemory: 824656
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 52
+    DevicePath: '02010c00d041030a0100000001010600000001010600010004081800000000003846020000000000ff450600000000007fff0400'
+- EventNum: 11
+  PCRIndex: 2
+  EventType: EV_EFI_BOOT_SERVICES_DRIVER
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "1ed5faf8fa9dad50d625e1a6074768bf9a84310a"
+  - AlgorithmId: sha256
+    Digest: "5e289969ac801159131e1f597da9e097abf0539692cb1b1b6199f4609ca81cac"
+  EventSize: 84
+  Event:
+    ImageLocationInMemory: 0x63e8f018
+    ImageLengthInMemory: 824656
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 52
+    DevicePath: '02010c00d041030a0700000001010600000001010600000004081800000000003846020000000000ff450600000000007fff0400'
+- EventNum: 12
+  PCRIndex: 2
+  EventType: EV_EFI_BOOT_SERVICES_DRIVER
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "1ed5faf8fa9dad50d625e1a6074768bf9a84310a"
+  - AlgorithmId: sha256
+    Digest: "5e289969ac801159131e1f597da9e097abf0539692cb1b1b6199f4609ca81cac"
+  EventSize: 84
+  Event:
+    ImageLocationInMemory: 0x63dc4018
+    ImageLengthInMemory: 824656
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 52
+    DevicePath: '02010c00d041030a0700000001010600000001010600010004081800000000003846020000000000ff450600000000007fff0400'
+- EventNum: 13
+  PCRIndex: 0
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 14
+  PCRIndex: 1
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 15
+  PCRIndex: 2
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 16
+  PCRIndex: 3
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 17
+  PCRIndex: 4
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 18
+  PCRIndex: 5
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 19
+  PCRIndex: 6
+  EventType: EV_SEPARATOR
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 20
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "3fbcdfed545f8a229ff7ab955838c216bc73226e"
+  - AlgorithmId: sha256
+    Digest: "81c2bf2cd2e222b0c5f8a78c860f1a94a4ae9683fc8bf1cc4ccd1ac95c3ec1f1"
+  EventSize: 82
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 9
+    VariableDataLength: 32
+    UnicodeName: BootOrder
+    VariableData: "03000400050006000700080009000a000b000c000d000e000f00100011001200"
+- EventNum: 21
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "ab8f235cfec34cb945db379107964afb766d63a0"
+  - AlgorithmId: sha256
+    Digest: "fea5577091d37bed72a87bb407cb56033c6e01d326fd6abc5e0e34e6f18ef669"
+  EventSize: 412
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 364
+    UnicodeName: Boot0003
+    VariableData: "01000000d60055004500460049003a0020005000580045002000490050003400200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0020002d002000300043004300340037004100460046003600300031004300000002010c00d041030a03000000010106000000010106000000030b25000cc47aff601c000000000000000000000000000000000000000000000000000001030c1b0000000000000000000000000000000000000000000000007fff040001047600ef47642dc93ba041ac194d51d01b4ce65000580045002000490050003400200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0000007fff04000000424f"
+- EventNum: 22
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "a283f8148c1a2274d20ae232774e0d49d86352bb"
+  - AlgorithmId: sha256
+    Digest: "bd7135d4382ec425c4bcd2883b4c3158e614b2fe6c34772b827908d645608e54"
+  EventSize: 412
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 364
+    UnicodeName: Boot0004
+    VariableData: "01000000d60055004500460049003a0020005000580045002000490050003400200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0020002d002000300043004300340037004100460046003600300031004400000002010c00d041030a03000000010106000000010106000100030b25000cc47aff601d000000000000000000000000000000000000000000000000000001030c1b0000000000000000000000000000000000000000000000007fff040001047600ef47642dc93ba041ac194d51d01b4ce65000580045002000490050003400200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0000007fff04000000424f"
+- EventNum: 23
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "6079de507c12a31a519f0d6b2d8523a009939479"
+  - AlgorithmId: sha256
+    Digest: "9e6f529175c70959d5fb6cd20e581c50a073b2706a84f8f6e0047e268c859a1f"
+  EventSize: 412
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 364
+    UnicodeName: Boot0005
+    VariableData: "01000000d60055004500460049003a0020005000580045002000490050003400200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0020002d002000300043004300340037004100460046003600300031004500000002010c00d041030a03000000010106000000010106000200030b25000cc47aff601e000000000000000000000000000000000000000000000000000001030c1b0000000000000000000000000000000000000000000000007fff040001047600ef47642dc93ba041ac194d51d01b4ce65000580045002000490050003400200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0000007fff04000000424f"
+- EventNum: 24
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "491c47728c2a764a713ca293dd86a3bcc6574acd"
+  - AlgorithmId: sha256
+    Digest: "e1164ad4c9a72c7461b52147d07a919239f6cd3060371030147ea22d2f295e8b"
+  EventSize: 412
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 364
+    UnicodeName: Boot0006
+    VariableData: "01000000d60055004500460049003a0020005000580045002000490050003400200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0020002d002000300043004300340037004100460046003600300031004600000002010c00d041030a03000000010106000000010106000300030b25000cc47aff601f000000000000000000000000000000000000000000000000000001030c1b0000000000000000000000000000000000000000000000007fff040001047600ef47642dc93ba041ac194d51d01b4ce65000580045002000490050003400200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0000007fff04000000424f"
+- EventNum: 25
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "cccd72d0384c263c30083350e922cd88455ae4af"
+  - AlgorithmId: sha256
+    Digest: "d9166803ad7ec9bf31c784603e67d1871a8e78fdb731aa307a6a784f7247e210"
+  EventSize: 445
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 397
+    UnicodeName: Boot0007
+    VariableData: "01000000f70055004500460049003a0020005000580045002000490050003600200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0020002d002000300043004300340037004100460046003600300031004300000002010c00d041030a03000000010106000000010106000000030b25000cc47aff601c000000000000000000000000000000000000000000000000000001030d3c0000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000007fff040001047600ef47642dc93ba041ac194d51d01b4ce65000580045002000490050003600200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0000007fff04000000424f"
+- EventNum: 26
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "40799f11371d4622bdc9dc56df37275232198cdd"
+  - AlgorithmId: sha256
+    Digest: "1a596869d57e235fc7ec6d1f6acd1bd1cbd2f9ec3440d6b3487bd324aaa19201"
+  EventSize: 445
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 397
+    UnicodeName: Boot0008
+    VariableData: "01000000f70055004500460049003a0020005000580045002000490050003600200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0020002d002000300043004300340037004100460046003600300031004400000002010c00d041030a03000000010106000000010106000100030b25000cc47aff601d000000000000000000000000000000000000000000000000000001030d3c0000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000007fff040001047600ef47642dc93ba041ac194d51d01b4ce65000580045002000490050003600200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0000007fff04000000424f"
+- EventNum: 27
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "27c7946f5b4dfed6d0eed64012ee65c2cad395c1"
+  - AlgorithmId: sha256
+    Digest: "619b3c339875dd903a0421c4074391eca096aa640d73fc6c54a3dc37634d176d"
+  EventSize: 445
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 397
+    UnicodeName: Boot0009
+    VariableData: "01000000f70055004500460049003a0020005000580045002000490050003600200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0020002d002000300043004300340037004100460046003600300031004500000002010c00d041030a03000000010106000000010106000200030b25000cc47aff601e000000000000000000000000000000000000000000000000000001030d3c0000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000007fff040001047600ef47642dc93ba041ac194d51d01b4ce65000580045002000490050003600200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0000007fff04000000424f"
+- EventNum: 28
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9f65926fbb5e7aa9178e7184a0fa8213225ad8e0"
+  - AlgorithmId: sha256
+    Digest: "6e11a6a0b05f717762254ffefa804f3891935e2718171cb808083ffb4d420910"
+  EventSize: 445
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 397
+    UnicodeName: Boot000A
+    VariableData: "01000000f70055004500460049003a0020005000580045002000490050003600200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0020002d002000300043004300340037004100460046003600300031004600000002010c00d041030a03000000010106000000010106000300030b25000cc47aff601f000000000000000000000000000000000000000000000000000001030d3c0000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000007fff040001047600ef47642dc93ba041ac194d51d01b4ce65000580045002000490050003600200049006e00740065006c00280052002900200049003300350030002000470069006700610062006900740020004e006500740077006f0072006b00200043006f006e006e0065006300740069006f006e0000007fff04000000424f"
+- EventNum: 29
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "43b8993cc724aef0ff74266de7f418afe4869af1"
+  - AlgorithmId: sha256
+    Digest: "1a111c5eefbe71a0b88d3b4e3faea54e244b436efc17cee609c23f933cfdb928"
+  EventSize: 428
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 380
+    UnicodeName: Boot000B
+    VariableData: "01000000de0055004500460049003a002000500058004500200049005000340020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380035003a00310033003a004200320020002d002000390038003000330039004200380035003100330042003200000002010c00d041030a01000000010106000000010106000000030b250098039b8513b2000000000000000000000000000000000000000000000000000001030c1b0000000000000000000000000000000000000000000000007fff040001047e00ef47642dc93ba041ac194d51d01b4ce6500058004500200049005000340020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380035003a00310033003a004200320000007fff04000000424f"
+- EventNum: 30
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "a0a104cc409220ad2ce2a1b62059524ae3aff0fe"
+  - AlgorithmId: sha256
+    Digest: "46939493ec49f3e48eb0343f41f7398d650b3c7f8a7786977fd0a0250bec3a34"
+  EventSize: 428
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 380
+    UnicodeName: Boot000C
+    VariableData: "01000000de0055004500460049003a002000500058004500200049005000340020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380035003a00310033003a004200330020002d002000390038003000330039004200380035003100330042003300000002010c00d041030a01000000010106000000010106000100030b250098039b8513b3000000000000000000000000000000000000000000000000000001030c1b0000000000000000000000000000000000000000000000007fff040001047e00ef47642dc93ba041ac194d51d01b4ce6500058004500200049005000340020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380035003a00310033003a004200330000007fff04000000424f"
+- EventNum: 31
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "60fe0bf01ce026034c6b8118ebeea0c475a540f2"
+  - AlgorithmId: sha256
+    Digest: "3931124f8b48fee5d7ecd2aad1bd1ef5b5f963b82533540fbe613093941feb6d"
+  EventSize: 428
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 380
+    UnicodeName: Boot000D
+    VariableData: "01000000de0055004500460049003a002000500058004500200049005000340020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380034003a00420033003a004100450020002d002000390038003000330039004200380034004200330041004500000002010c00d041030a07000000010106000000010106000000030b250098039b84b3ae000000000000000000000000000000000000000000000000000001030c1b0000000000000000000000000000000000000000000000007fff040001047e00ef47642dc93ba041ac194d51d01b4ce6500058004500200049005000340020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380034003a00420033003a004100450000007fff04000000424f"
+- EventNum: 32
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "65c18f85c810ce0ad60ef430a52720afb5bab9ce"
+  - AlgorithmId: sha256
+    Digest: "74c91d245d5eaf3f0f90632ddf130b761e2eb0e32f1f9e7ded3dea1077b62b45"
+  EventSize: 428
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 380
+    UnicodeName: Boot000E
+    VariableData: "01000000de0055004500460049003a002000500058004500200049005000340020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380034003a00420033003a004100460020002d002000390038003000330039004200380034004200330041004600000002010c00d041030a07000000010106000000010106000100030b250098039b84b3af000000000000000000000000000000000000000000000000000001030c1b0000000000000000000000000000000000000000000000007fff040001047e00ef47642dc93ba041ac194d51d01b4ce6500058004500200049005000340020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380034003a00420033003a004100460000007fff04000000424f"
+- EventNum: 33
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f09ac7d0f63fabb71a6e07f42ccb8b33f6eda18c"
+  - AlgorithmId: sha256
+    Digest: "13538ae1f5d103bf4cb869a03af4ea3f4e519c72d2ce03c746b69d70b01b01b7"
+  EventSize: 461
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 413
+    UnicodeName: Boot000F
+    VariableData: "01000000ff0055004500460049003a002000500058004500200049005000360020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380035003a00310033003a004200320020002d002000390038003000330039004200380035003100330042003200000002010c00d041030a01000000010106000000010106000000030b250098039b8513b2000000000000000000000000000000000000000000000000000001030d3c0000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000007fff040001047e00ef47642dc93ba041ac194d51d01b4ce6500058004500200049005000360020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380035003a00310033003a004200320000007fff04000000424f"
+- EventNum: 34
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "193d033d6ab3c90a60a36aff76b9b7dfd907a35c"
+  - AlgorithmId: sha256
+    Digest: "c446edae2ef61641940b7b7327727f46d6949976e01bce7d9be6f59a61c8e5c6"
+  EventSize: 461
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 413
+    UnicodeName: Boot0010
+    VariableData: "01000000ff0055004500460049003a002000500058004500200049005000360020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380035003a00310033003a004200330020002d002000390038003000330039004200380035003100330042003300000002010c00d041030a01000000010106000000010106000100030b250098039b8513b3000000000000000000000000000000000000000000000000000001030d3c0000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000007fff040001047e00ef47642dc93ba041ac194d51d01b4ce6500058004500200049005000360020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380035003a00310033003a004200330000007fff04000000424f"
+- EventNum: 35
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "c0b3116068d56a56863a02bc9db22056473610b2"
+  - AlgorithmId: sha256
+    Digest: "b647961910b82cd63606cafd5308b071d70470d215dd8df122323bda413a7549"
+  EventSize: 461
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 413
+    UnicodeName: Boot0011
+    VariableData: "01000000ff0055004500460049003a002000500058004500200049005000360020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380034003a00420033003a004100450020002d002000390038003000330039004200380034004200330041004500000002010c00d041030a07000000010106000000010106000000030b250098039b84b3ae000000000000000000000000000000000000000000000000000001030d3c0000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000007fff040001047e00ef47642dc93ba041ac194d51d01b4ce6500058004500200049005000360020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380034003a00420033003a004100450000007fff04000000424f"
+- EventNum: 36
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "03fc508b0686f5b664f10096d0e0a79c149ad04a"
+  - AlgorithmId: sha256
+    Digest: "f0da5d94cd5a4bd61074301f7d97559ed9299a3d11abfdddb597d4c9116fc28b"
+  EventSize: 461
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 413
+    UnicodeName: Boot0012
+    VariableData: "01000000ff0055004500460049003a002000500058004500200049005000360020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380034003a00420033003a004100460020002d002000390038003000330039004200380034004200330041004600000002010c00d041030a07000000010106000000010106000100030b250098039b84b3af000000000000000000000000000000000000000000000000000001030d3c0000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000007fff040001047e00ef47642dc93ba041ac194d51d01b4ce6500058004500200049005000360020004d0065006c006c0061006e006f00780020004e006500740077006f0072006b002000410064006100700074006500720020002d002000390038003a00300033003a00390042003a00380034003a00420033003a004100460000007fff04000000424f"
+- EventNum: 37
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_AUTHORITY
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "8b5866854c0b829dd967a1d9f100a3920d412792"
+  - AlgorithmId: sha256
+    Digest: "4d4a8e2c74133bbdc01a16eaf2dbb5d575afeb36f5d8dfcf609ae043909e2ee9"
+  EventSize: 1608
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 2
+    VariableDataLength: 1572
+    UnicodeName: db
+    VariableData: "bd9afa775903324dbd6028f4e78f784b30820610308203f8a003020102020a6108d3c4000000000004300d06092a864886f70d01010b0500308191310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313b3039060355040313324d6963726f736f667420436f72706f726174696f6e205468697264205061727479204d61726b6574706c61636520526f6f74301e170d3131303632373231323234355a170d3236303632373231333234355a308181310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312b3029060355040313224d6963726f736f667420436f72706f726174696f6e2055454649204341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100a5086c4cc745096a4b0ca4c0877f06750c43015464e0167f07ed927d0bb273bf0c0ac64a4561a0c5162d96d3f52ba0fb4d499b4180903cb954fde6bcd19dc4a4188a7f418a5c59836832bb8c47c9ee71bc214f9a8a7cff443f8d8f32b22648ae75b5eec94c1e4a197ee4829a1d78774d0cb0bdf60fd316d3bcfa2ba551385df5fbbadb7802dbffec0a1b96d583b81913e9b6c07b407be11f2827c9faef565e1ce67e947ec0f044b27939e5dab2628b4dbf3870e2682414c933a40837d558695ed37cedc1045308e74eb02a876308616f631559eab22b79d70c61678a5bfd5ead877fba86674f71581222042222ce8bef547100ce503558769508ee6ab1a201d50203010001a382017630820172301206092b060104018237150104050203010001302306092b060104018237150204160414f8c16bb77f77534af325371d4ea1267b0f207080301d0603551d0e0416041413adbf4309bd82709c8cd54f316ed522988a1bd4301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d2304183016801445665243e17e5811bfd64e9e2355083b3a226aa8305c0603551d1f045530533051a04fa04d864b687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e637274300d06092a864886f70d01010b05000382020100350842ff30cccef7760cad1068583529463276277cef124127421b4aaa6d813848591355f3e95834a6160b82aa5dad82da808341068fb41df203b9f31a5d1bf15090f9b3558442281c20bdb2ae5114c5c0ac9795211c90db0ffc779e95739188cabdbd52b905500ddf579ea061ed0de56d25d9400f1740c8cea34ac24daf9a121d08548fbdc7bcb92b3d492b1f32fc6a21694f9bc87e4234fc3606178b8f2040c0b39a257527cdc903a3f65dd1e736547ab950b5d312d107bfbb74dfdc1e8f80d5ed18f42f14166b2fde668cb023e5c784d8edeac13382ad564b182df1689507cdcff072f0aebbdd8685982c214c332bf00f4af06887b592553275a16a826a3ca32511a4edadd704aecbd84059a084d1954c6291221a741d8c3d470e44a6e4b09b3435b1fab653a82c81eca40571c89db8bae81b4466e447540e8e567fb39f1698b286d0683e9023b52f5e8f50858dc68d825f41a1f42e0de099d26c75e4b669b52186fa07d1f6e24dd1daad2c77531e253237c76c52729586b0f135616a19f5b23b815056a6322dfea289f94286271855a182ca5a9bf830985414a64796252fc826e441941a5c023fe596e3855b3c3e3fbb47167255e22522b1d97be703062aa3f71e9046c3000dd61989e30e352762037115a6efd027a0a0593760f83894b8e07870f8ba4c868794f6e0ae0245ee65c2b6a37e69167507929bf5a6bc598358"
+- EventNum: 38
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d0e6f939f1304a83975f34ff678da573ae2b3ee5"
+  - AlgorithmId: sha256
+    Digest: "007f4c95125713b112093e21663e2d23e3c1ae9ce4b5de0d58a297332336a2d8"
+  EventSize: 124
+  Event:
+    ImageLocationInMemory: 0x6202f018
+    ImageLengthInMemory: 1334816
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 92
+    DevicePath: '02010c00d041030a03000000010106000000010106000000030b25000cc47aff601c000000000000000000000000000000000000000000000000000001030c1b0000000000000000000000000000000000000000000000007fff0400'
+- EventNum: 39
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "55bff7d9ff94e4b2bd103689efdc8ae260671a05"
+  - AlgorithmId: sha256
+    Digest: "aa1bfb5a9f43668a5dcea2d1af0b7d9535c45c7cd63cc990d3148b76e5360e63"
+  EventSize: 41
+  Event:
+    ImageLocationInMemory: 0x0
+    ImageLengthInMemory: 0
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 0
+    DevicePath: '00b0150000c01500af'
+- EventNum: 40
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_AUTHORITY
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "185db6197a44b1f2e728982752efbd86ee6cb5df"
+  - AlgorithmId: sha256
+    Digest: "70f0dca0fd93403e2ed2e7106781db1e002b1cbae77ff3a2e23cab46eb6349d2"
+  EventSize: 1126
+  Event:
+    VariableName: 605dab50-e046-4300-abb6-3dd810dd8b23
+    UnicodeNameLength: 4
+    VariableDataLength: 1080
+    UnicodeName: Shim
+    VariableData: "308204343082031ca003020102020900b94124a0182c9267300d06092a864886f70d01010b0500308184310b30090603550406130247423114301206035504080c0b49736c65206f66204d616e3110300e06035504070c07446f75676c617331173015060355040a0c0e43616e6f6e6963616c204c74642e3134303206035504030c2b43616e6f6e6963616c204c74642e204d617374657220436572746966696361746520417574686f72697479301e170d3132303431323131313235315a170d3432303431313131313235315a308184310b30090603550406130247423114301206035504080c0b49736c65206f66204d616e3110300e06035504070c07446f75676c617331173015060355040a0c0e43616e6f6e6963616c204c74642e3134303206035504030c2b43616e6f6e6963616c204c74642e204d617374657220436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100bf5b3a1674ee215dae61ed9d56acbddede72f3dd7e2d4c620facc06d480811cf8d8bfb611f27cc116ed9553d3954eb403bb1bbe2853479caf77bbfba7ac8102d197dad59cfa6d4e94e0fdaae52ea4c9e90cec6990d4e6765785df9d1d5384a4a7a8f939c7f1aa385dbcefa8bf7c2a2212d9b5441351057138d6cbc2906504a7eea99a968a73bc7071b329ea019870e79bb68992d7e9352e5f6ebc99bf92bedb86849bcd99550405bc5b271aaeb5c57de71f9400add5bac1e842d501a52d6e1f36b6e90644f5bb4eb20e46110da5af0eae442d701c4fe211fd9b9c05495428152721f49647ac86c24f108700b4da5a032d1a01c57a84de3afa58e05053e1043a10203010001a381a63081a3301d0603551d0e04160414ad91990bc22ab1f517048c23b6655a268e345a63301f0603551d23041830168014ad91990bc22ab1f517048c23b6655a268e345a63300f0603551d130101ff040530030101ff300b0603551d0f04040302018630430603551d1f043c303a3038a036a0348632687474703a2f2f7777772e63616e6f6e6963616c2e636f6d2f7365637572652d626f6f742d6d61737465722d63612e63726c300d06092a864886f70d01010b050003820101003f7df676a5b383b42b7ad06d521a0383c412a7509c4792ccc0947782d2ae57b39904f5323ac6551d07db12a956fad8d47620ebe4c351db9a5c9c923f1873da946aa199388ca4886dc1fc3971d0747616033e562335d555475b1a1d41c2d3124cdcffae0a929c620a17019c73e05eb1fdbcd6b519117a7ecd3e037e66db5ba8c9394851ff53e19c3153911b3b10750317bae681028094704c46b794b03d15cd1f8e02e068028ffbf9471d7da201c60751c49accedddcfa35ded92bbbed1fde6ec1f33517304be3c72b07d08f801ff987dcb9ce069397725477188b18d27a52ea8f73f5f8069973ea9f49914dbce030e0b66c41c6dbdb82777c14294bdfc6a0abc"
+- EventNum: 41
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "1bdd2d91eb90e0994dd7c665f0bf723dec5c157e"
+  - AlgorithmId: sha256
+    Digest: "88f548359c31bb4694f1cc1adfab640b2029b6b0e36fb0f0dbd536f6a67d8303"
+  EventSize: 63
+  Event:
+    String: |-
+      "grub_cmd:  -e (tftp,192.168.0.141)/grub/x86_64-efi/grub.cfg \0"
+- EventNum: 42
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "06e3f9ed5c9c31597b78acf87952c85e32b92140"
+  - AlgorithmId: sha256
+    Digest: "6446c28b60e77f34a8179eb81c80f9f62e0f9715db2c5bcff0f17a6297d683e9"
+  EventSize: 52
+  Event:
+    String: |-
+      "grub_cmd: source (tftp,192.168.0.141)/grub/grub.cfg\0"
+- EventNum: 43
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "92611a41b323df54a007d06aad1364ff9f38ec38"
+  - AlgorithmId: sha256
+    Digest: "4bdd31ce57984441a126b501f74994482d7ad8929b7e2ed6c0371aeeca81ccd7"
+  EventSize: 35
+  Event:
+    String: |-
+      "(tftp,192.168.0.141)/grub/grub.cfg\0"
+- EventNum: 44
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9a4012c67699622cf0e3ad17d2b8193bbef96da5"
+  - AlgorithmId: sha256
+    Digest: "60415688e1c91b8b66b7453a895281506a1ff292093e4d3648fba6e7215d0e5b"
+  EventSize: 63
+  Event:
+    String: |-
+      "grub_cmd: configfile /boot/grub2/grub.cfg-01-0c:c4:7a:ff:60:1c\0"
+- EventNum: 45
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "ab17c9d242ec3b97277d8ccff1d60040bd58c1ea"
+  - AlgorithmId: sha256
+    Digest: "befbf1d7af3da4279cafb9f5104ff24cb3f029c7401cd03d50549f24241d0649"
+  EventSize: 42
+  Event:
+    String: |-
+      "/boot/grub2/grub.cfg-01-0c:c4:7a:ff:60:1c\0"
+- EventNum: 46
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "732c713a6f4c3a388ee1b46624b7c3fe34d59d50"
+  - AlgorithmId: sha256
+    Digest: "71a5b3b21ac3862f40fabb745a9649c3a1d34249b9706524c90b2480c298beb0"
+  EventSize: 24
+  Event:
+    String: |-
+      "grub_cmd: set timeout=5\0"
+- EventNum: 47
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "067c1a87d082adda86e3e67c203723a43e4a6521"
+  - AlgorithmId: sha256
+    Digest: "428ed11d62fff908eb26e85f2f36e59afa4234021664362aab1e5cd4e47081a7"
+  EventSize: 55
+  Event:
+    String: |-
+      "grub_cmd: set default=xCAT OS Deployment, ugly GA hack\0"
+- EventNum: 48
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f35488600a1319bb1ead72da6b55dceac2f8b5d5"
+  - AlgorithmId: sha256
+    Digest: "aa151571c8d7ca866db234cfa68de48ea496d7222eadefdd261a15d7a9bdb861"
+  EventSize: 466
+  Event:
+    String: |-
+      "grub_cmd: menuentry xCAT OS Deployment, ugly GA hack {"
+      "    echo "Loading VEHV kernel ...""
+      "    linux /xcat/osimage/ubuntu18.04-x86_64-netboot-vgen/kernel imgurl=http://192.168.0.141//install/netboot/ubuntu18.04/x86_64/vgen/rootimg.tar.gz XCAT=192.168.0.141:3001 console=tty0 console=ttyS0,115200 biosdevname=0 net.ifnames=0  BOOTIF=01-$net_default_mac"
+      "    echo "Loading VEHV ramdisk ...""
+      "    initrd /xcat/osimage/ubuntu18.04-x86_64-netboot-vgen/initrd-stateless.gz"
+      "}\0"
+- EventNum: 49
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "ac5dcc7ddd86999727f50debc576e3d946f49dec"
+  - AlgorithmId: sha256
+    Digest: "78a5cbf6ecba75a2900414314c4e2f9e3fd584ea8adc3876bace146679a03e8e"
+  EventSize: 53
+  Event:
+    String: |-
+      "grub_cmd: setparams xCAT OS Deployment, ugly GA hack\0"
+- EventNum: 50
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "30e89627e89f64dd128b48ff07e6604b7ecb10f3"
+  - AlgorithmId: sha256
+    Digest: "bde7442e3918d9117eae0ebeab987d68b157f67b6ab47241651fe2d52db6fa1d"
+  EventSize: 39
+  Event:
+    String: |-
+      "grub_cmd: echo Loading VEHV kernel ...\0"
+- EventNum: 51
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "7db0ad939a4643bc2bd1ba334d13ad4ab8958af0"
+  - AlgorithmId: sha256
+    Digest: "39b1815072ffc4dc737aa771781840f6534784a606de47026bbbb1e1283033e3"
+  EventSize: 267
+  Event:
+    String: |-
+      "grub_cmd: linux /xcat/osimage/ubuntu18.04-x86_64-netboot-vgen/kernel imgurl=http://192.168.0.141//install/netboot/ubuntu18.04/x86_64/vgen/rootimg.tar.gz XCAT=192.168.0.141:3001 console=tty0 console=ttyS0,115200 biosdevname=0 net.ifnames=0 BOOTIF=01-0c:c4:7a:ff:60:1c\0"
+- EventNum: 52
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "52fa768d85240139c2d78d385b8cf19198f29ddf"
+  - AlgorithmId: sha256
+    Digest: "5d8a44f7a785a2cb018cdfa2d29a6952e64739b2436e1ca33871d2af6a66e49e"
+  EventSize: 53
+  Event:
+    String: |-
+      "/xcat/osimage/ubuntu18.04-x86_64-netboot-vgen/kernel\0"
+- EventNum: 53
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "a4a911e25729725d9896fdf1bd3c21280f0b39fd"
+  - AlgorithmId: sha256
+    Digest: "b0a2cdff7294f3831689383d895a90fc4ff6dacde3878e3c8bb28055ba0051ab"
+  EventSize: 41
+  Event:
+    ImageLocationInMemory: 0x0
+    ImageLengthInMemory: 0
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 0
+    DevicePath: '80e9ad0080ebad00af'
+- EventNum: 54
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_AUTHORITY
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "185db6197a44b1f2e728982752efbd86ee6cb5df"
+  - AlgorithmId: sha256
+    Digest: "70f0dca0fd93403e2ed2e7106781db1e002b1cbae77ff3a2e23cab46eb6349d2"
+  EventSize: 1126
+  Event:
+    VariableName: 605dab50-e046-4300-abb6-3dd810dd8b23
+    UnicodeNameLength: 4
+    VariableDataLength: 1080
+    UnicodeName: Shim
+    VariableData: "308204343082031ca003020102020900b94124a0182c9267300d06092a864886f70d01010b0500308184310b30090603550406130247423114301206035504080c0b49736c65206f66204d616e3110300e06035504070c07446f75676c617331173015060355040a0c0e43616e6f6e6963616c204c74642e3134303206035504030c2b43616e6f6e6963616c204c74642e204d617374657220436572746966696361746520417574686f72697479301e170d3132303431323131313235315a170d3432303431313131313235315a308184310b30090603550406130247423114301206035504080c0b49736c65206f66204d616e3110300e06035504070c07446f75676c617331173015060355040a0c0e43616e6f6e6963616c204c74642e3134303206035504030c2b43616e6f6e6963616c204c74642e204d617374657220436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100bf5b3a1674ee215dae61ed9d56acbddede72f3dd7e2d4c620facc06d480811cf8d8bfb611f27cc116ed9553d3954eb403bb1bbe2853479caf77bbfba7ac8102d197dad59cfa6d4e94e0fdaae52ea4c9e90cec6990d4e6765785df9d1d5384a4a7a8f939c7f1aa385dbcefa8bf7c2a2212d9b5441351057138d6cbc2906504a7eea99a968a73bc7071b329ea019870e79bb68992d7e9352e5f6ebc99bf92bedb86849bcd99550405bc5b271aaeb5c57de71f9400add5bac1e842d501a52d6e1f36b6e90644f5bb4eb20e46110da5af0eae442d701c4fe211fd9b9c05495428152721f49647ac86c24f108700b4da5a032d1a01c57a84de3afa58e05053e1043a10203010001a381a63081a3301d0603551d0e04160414ad91990bc22ab1f517048c23b6655a268e345a63301f0603551d23041830168014ad91990bc22ab1f517048c23b6655a268e345a63300f0603551d130101ff040530030101ff300b0603551d0f04040302018630430603551d1f043c303a3038a036a0348632687474703a2f2f7777772e63616e6f6e6963616c2e636f6d2f7365637572652d626f6f742d6d61737465722d63612e63726c300d06092a864886f70d01010b050003820101003f7df676a5b383b42b7ad06d521a0383c412a7509c4792ccc0947782d2ae57b39904f5323ac6551d07db12a956fad8d47620ebe4c351db9a5c9c923f1873da946aa199388ca4886dc1fc3971d0747616033e562335d555475b1a1d41c2d3124cdcffae0a929c620a17019c73e05eb1fdbcd6b519117a7ecd3e037e66db5ba8c9394851ff53e19c3153911b3b10750317bae681028094704c46b794b03d15cd1f8e02e068028ffbf9471d7da201c60751c49accedddcfa35ded92bbbed1fde6ec1f33517304be3c72b07d08f801ff987dcb9ce069397725477188b18d27a52ea8f73f5f8069973ea9f49914dbce030e0b66c41c6dbdb82777c14294bdfc6a0abc"
+- EventNum: 55
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "b84ea12d849d71d1777287b791d0eaf5be331c5e"
+  - AlgorithmId: sha256
+    Digest: "2a4dcb8a22ce5ce97d674fb86f7e94a3f8c71f264803edb6c871c8c675eb744b"
+  EventSize: 267
+  Event:
+    String: |-
+      "kernel_cmdline: /xcat/osimage/ubuntu18.04-x86_64-netboot-vgen/kernel imgurl=http://192.168.0.141//install/netboot/ubuntu18.04/x86_64/vgen/rootimg.tar.gz XCAT=192.168.0.141:3001 console=tty0 console=ttyS0,115200 biosdevname=0 net.ifnames=0 BOOTIF=01-0c:c4:7a:ff:60:1c\0"
+- EventNum: 56
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "1e3a4b1eba1da6d04ed5902a3abb2e6357859bec"
+  - AlgorithmId: sha256
+    Digest: "bb67e049956aba1e2bdac24fe084d847cf6df4d0a83c04827cf7b0d7a6c41e3f"
+  EventSize: 40
+  Event:
+    String: |-
+      "grub_cmd: echo Loading VEHV ramdisk ...\0"
+- EventNum: 57
+  PCRIndex: 8
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d4fe7b7837332820493b3a17ba489170944b9c08"
+  - AlgorithmId: sha256
+    Digest: "20171c421048f16cd0cf462605f3cfb4a7848ac7a17ff5e11edf2d36cc59bb5a"
+  EventSize: 83
+  Event:
+    String: |-
+      "grub_cmd: initrd /xcat/osimage/ubuntu18.04-x86_64-netboot-vgen/initrd-stateless.gz\0"
+- EventNum: 58
+  PCRIndex: 9
+  EventType: EV_IPL
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "12283aac809935035a801c143f752fbdd17453db"
+  - AlgorithmId: sha256
+    Digest: "2c9d05e2b84937893f7a6ea92446d1ca0b1619ef28118d218649e1421872c9eb"
+  EventSize: 66
+  Event:
+    String: |-
+      "/xcat/osimage/ubuntu18.04-x86_64-netboot-vgen/initrd-stateless.gz\0"
+pcrs:
+  sha1:
+    0  : 0x60804a728ca0af13e14fea8e79effe33ea3eec7b
+    1  : 0x5d5a7b88403fb38f1cbcf98e40cae566bbd0ba02
+    2  : 0x3710d4c00ed56d2193577ee94e988cd8657a77cf
+    3  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    4  : 0x7c937577b58c20b73bf7449ba67963df26fd2644
+    5  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    6  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    7  : 0xe8145f6a55372158d87f55c33b17abe7c35987ef
+    8  : 0x7874ccfdc068f8ef34efc127a963e71004fc8014
+    9  : 0xa6bb02edd825c9e2bcd807c197fcfb456a266080
+  sha256:
+    0  : 0xd60c30777ea9cad0ac8868eda11a00608a26f0a2f9b5d5fbdd4a84d7884ea946
+    1  : 0x65457318495b52f2d4100cafa00d7b57880eb20361e5e8e8d29166cc67c0890c
+    2  : 0x15d60806b60f715cdd94e624f27854f608bbcd26000f39fa7f0ec0db7a8ba5c8
+    3  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    4  : 0x227d8b3b8294223f6d0065582b015ac31c5da2dd391000d87141e38ec03e77a8
+    5  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    6  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    7  : 0xcea0b7475867ab2ced4f6a278530c0a57e0f826cfefdf747c0e670ca09140ea5
+    8  : 0xd17f57b88d4f1ec2e52551c1be47bd2d9f3d83f6aa330e26218147b32054b237
+    9  : 0xfa774bed1acc7f2c6c4f0457bd33d8f584d018f9d8563463f308d2990453f492

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-sd-boot-fedora37.bin Added

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-sd-boot-fedora37.bin.yaml Added

@@ -0,0 +1,358 @@
+---
+version: 2
+events:
+- EventNum: 0
+  PCRIndex: 0
+  EventType: EV_NO_ACTION
+  Digest: "0000000000000000000000000000000000000000"
+  EventSize: 33
+  SpecID:
+  - Signature: Spec ID Event03
+    platformClass: 0
+    specVersionMinor: 0
+    specVersionMajor: 2
+    specErrata: 0
+    uintnSize: 2
+    numberOfAlgorithms: 1
+    Algorithms:
+    - Algorithm0:
+      algorithmId: sha256
+      digestSize: 32
+    vendorInfoSize: 0
+- EventNum: 1
+  PCRIndex: 0
+  EventType: EV_S_CRTM_VERSION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7"
+  EventSize: 2
+  Event: "0000"
+- EventNum: 2
+  PCRIndex: 0
+  EventType: EV_EFI_PLATFORM_FIRMWARE_BLOB
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "a4bec904c70ae2e4b214fb4ecbe44a09e1054ca45dd4c084d6ba4c1f44b566a2"
+  EventSize: 16
+  Event:
+    BlobBase: 0x820000
+    BlobLength: 0xe0000
+- EventNum: 3
+  PCRIndex: 0
+  EventType: EV_EFI_PLATFORM_FIRMWARE_BLOB
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "c386b9c16c7996c14603618b59f9531fac5ccf756a74a52a37feea7ade2cf0b0"
+  EventSize: 16
+  Event:
+    BlobBase: 0x900000
+    BlobLength: 0xc00000
+- EventNum: 4
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "ce9ce386b52e099f3019e512a0d6062d6b560efe4ff3e5661c7525e2f9c263df"
+  EventSize: 52
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 10
+    VariableDataLength: 0
+    UnicodeName: SecureBoot
+    VariableData:
+      Enabled: 'No'
+- EventNum: 5
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "dea7b80ab53a3daaa24d5cc46c64e1fa9ffd03739f90aadbd8c0867c4a5b4890"
+  EventSize: 36
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 2
+    VariableDataLength: 0
+    UnicodeName: PK
+    VariableData:
+- EventNum: 6
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "e670e121fcebd473b8bc41bb801301fc1d9afa33904f06f7149b74f12c47a68f"
+  EventSize: 38
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 3
+    VariableDataLength: 0
+    UnicodeName: KEK
+    VariableData:
+- EventNum: 7
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "baf89a3ccace52750c5f0128351e0422a41597a1adfd50822aa363b9d124ea7c"
+  EventSize: 36
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 2
+    VariableDataLength: 0
+    UnicodeName: db
+    VariableData:
+- EventNum: 8
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "9f75b6823bff6af1024a4e2036719cdd548d3cbc2bf1de8e7ef4d0ed01f94bf9"
+  EventSize: 38
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 3
+    VariableDataLength: 0
+    UnicodeName: dbx
+    VariableData:
+- EventNum: 9
+  PCRIndex: 7
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 10
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "4aeac5098a0d2c1e5b6a2f798da8dac8475773fa1c82ae51a23273f5d4cc817d"
+  EventSize: 58
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 9
+    VariableDataLength: 8
+    UnicodeName: BootOrder
+    VariableData:
+    - Boot0001
+    - Boot0002
+    - Boot0000
+    - Boot0003
+- EventNum: 11
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "7e60091524677af24f9f43cf8b45dcd0e245a90de21d0c9c06318500eb366dd8"
+  EventSize: 208
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 160
+    UnicodeName: Boot0001
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 116
+      Description: "Linux Boot Manager"
+      DevicePath: '04012a0001000000000800000000000000001000000000003c64b93c086ce54f852d17e1ae7011580202040446005c004500460049005c00730079007300740065006d0064005c00730079007300740065006d0064002d0062006f006f0074007800360034002e0065006600690000007fff0400'
+- EventNum: 12
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "d470a39c5bb66a4e44cbdae7b992c6a26f48334d4a8d0914b8ca3babe8419e5c"
+  EventSize: 132
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 84
+    UnicodeName: Boot0002
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 28
+      Description: "UEFI Misc Device"
+      DevicePath: '02010c00d041030a000000000101060003020101060000007fff04004eac0881119f594d850ee21a522c59b2'
+- EventNum: 13
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "3197be1e300fa1600d1884c3a4bd4a90a15405bfb546cf2e6cf6095f8c362a93"
+  EventSize: 110
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 62
+    UnicodeName: Boot0000
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 44
+      Description: "UiApp"
+      DevicePath: '04071400c9bdb87cebf8344faaea3ee4af6516a10406140021aa2c4614760345836e8ab6f46623317fff0400'
+- EventNum: 14
+  PCRIndex: 1
+  EventType: EV_EFI_VARIABLE_BOOT
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "4d387b02d63b2f4cd7f667feb0a387fe47a10a3e26bf3533ddd001c605f3dec5"
+  EventSize: 136
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 8
+    VariableDataLength: 88
+    UnicodeName: Boot0003
+    VariableData:
+      Enabled: 'Yes'
+      FilePathListLength: 44
+      Description: "EFI Internal Shell"
+      DevicePath: '04071400c9bdb87cebf8344faaea3ee4af6516a10406140083a5047c3e9e1c4fad65e05268d0b4d17fff0400'
+- EventNum: 15
+  PCRIndex: 4
+  EventType: EV_EFI_ACTION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "3d6772b4f84ed47595d72a2c4c5ffd15f5bb72c7507fe26f2aaee2c69d5633ba"
+  EventSize: 40
+  Event: |-
+    Calling EFI Application from Boot Option
+- EventNum: 16
+  PCRIndex: 0
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 17
+  PCRIndex: 1
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 18
+  PCRIndex: 2
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 19
+  PCRIndex: 3
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 20
+  PCRIndex: 4
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 21
+  PCRIndex: 5
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 22
+  PCRIndex: 6
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+  EventSize: 4
+  Event: "00000000"
+- EventNum: 23
+  PCRIndex: 12
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "62cc3c5f754ef8711f11140d0ed199e1b36b9bdac7df0c261498f2b07d0f91eb"
+  EventSize: 78
+  Event:
+    String: |-
+      " \0c\0o\0n\0s\0o\0l\0e\0=\0t\0t\0y\0S\00\0 \0c\0o\0n\0s\0o\0l\0e\0=\0t\0t\0y\00\0 \0e\0f\0i\0=\0d\0e\0b\0u\0g\0 \0\0\0"
+- EventNum: 24
+  PCRIndex: 12
+  EventType: EV_IPL
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "62cc3c5f754ef8711f11140d0ed199e1b36b9bdac7df0c261498f2b07d0f91eb"
+  EventSize: 78
+  Event:
+    String: |-
+      " \0c\0o\0n\0s\0o\0l\0e\0=\0t\0t\0y\0S\00\0 \0c\0o\0n\0s\0o\0l\0e\0=\0t\0t\0y\00\0 \0e\0f\0i\0=\0d\0e\0b\0u\0g\0 \0\0\0"
+- EventNum: 25
+  PCRIndex: 9
+  EventType: EV_EVENT_TAG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "643eefa7b731b03df94952db67a4f4774575692fe929c39815c2553f17c0609e"
+  EventSize: 21
+  Event: "ec223b8f0d0000004c696e757820696e6974726400"
+- EventNum: 26
+  PCRIndex: 5
+  EventType: EV_EFI_ACTION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "d8043d6b7b85ad358eb3b6ae6a873ab7ef23a26352c5dc4faa5aeedacf5eb41b"
+  EventSize: 29
+  Event: |-
+    Exit Boot Services Invocation
+- EventNum: 27
+  PCRIndex: 5
+  EventType: EV_EFI_ACTION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha256
+    Digest: "b54f7542cbd872a81a9d9dea839b2b8d747c7ebd5ea6615c40f42f44a6dbeba0"
+  EventSize: 40
+  Event: |-
+    Exit Boot Services Returned with Success
+pcrs:
+  sha256:
+    0  : 0x464a812afa3f88d8a5f1fe7e71df41951435ebd05edb742db8c2c0d67d62c0d1
+    1  : 0xf2c3a5ab1fcdec7c70d0e6af47304e9d2a4aa939874a69fbb84f786ff4b2f63f
+    2  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    3  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    4  : 0x7a94ffe8a7729a566d3d3c577fcb4b6b1e671f31540375f80eae6382ab785e35
+    5  : 0xa5ceb755d043f32431d63e39f5161464620a3437280494b5850dc1b47cc074e0
+    6  : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+    7  : 0xb5710bf57d25623e4019027da116821fa99f5c81e9e38b87671cc574f9281439
+    9  : 0x2913f6478fa2d1954ece3b40efc111c18f3feb29204e49f627aa0ca493801eeb
+    12 : 0x73b2090e3e72430531e7bc7d63e88826891ef4e04d6c1e250dc5c52db24f2f48

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-uefi-sha1-log.bin.yaml Added

@@ -0,0 +1,182 @@
+---
+version: 1
+events:
+  PCRIndex: 0
+  EventType: EV_S_CRTM_VERSION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "c42fedad268200cb1d15f97841c344e79dae3320"
+  EventSize: 16
+  Event: "1efb6b540c1d5540a4ad4ef4bf17b83a"
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "2f20112a3f55398b208e0c42681389b4cb5b1823"
+  EventSize: 52
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 10
+    VariableDataLength: 0
+    UnicodeName: SecureBoot
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9b1387306ebb7ff8e795e7be77563666bbf4516e"
+  EventSize: 36
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 2
+    VariableDataLength: 0
+    UnicodeName: PK
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "13f02fbc7383ed7c89017e0b32f60e38e282056c"
+  EventSize: 1598
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 3
+    VariableDataLength: 1560
+    UnicodeName: KEK
+    VariableData: "a159c0a5e494a74a87b5ab155c2bf0721806000000000000fc050000bd9afa775903324dbd6028f4e78f784b308205e8308203d0a003020102020a610ad188000000000003300d06092a864886f70d01010b0500308191310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313b3039060355040313324d6963726f736f667420436f72706f726174696f6e205468697264205061727479204d61726b6574706c61636520526f6f74301e170d3131303632343230343132395a170d3236303632343230353132395a308180310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312a3028060355040313214d6963726f736f667420436f72706f726174696f6e204b454b204341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100c4e8b58abfad5726b026c3eae7fb577a44025d070dda4ae5742ae6b00fec6debec7fb9e35a63327c11174f0ee30ba73815938ec6f5e084b19a9b2ce7f5b791d609e1e2c004a8ac301cdf48f306509a64a7517fc8854f8f2086cefe2fe19fff82c0ede9cdcef4536a623a0b43b9e225fdfe05f9d4c414ab11e223898d70b7a41d4decaee59cfa16c2d7c1cbd4e8c42fe599ee248b03ec8df28beac34afb4311120b7eb547926cdce60489ebf53304eb10012a71e5f983133cff25092f687646ffba4fbedcad712a58aafb0ed2793de49b653bcc292a9ffc7259a2ebae92eff6351380c602ece45fcc9d76cdef6392c1af79408479877fe352a8e89d7b07698f150203010001a382014f3082014b301006092b06010401823715010403020100301d0603551d0e0416041462fc43cda03ea4cb6712d25bd955ac7bccb68a5f301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d2304183016801445665243e17e5811bfd64e9e2355083b3a226aa8305c0603551d1f045530533051a04fa04d864b687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e637274300d06092a864886f70d01010b05000382020100d48488f514941802ca2a3cfb2a921c0cd7a0d1f1e85266a8eea2b5757a9000aa2da4765aea79b7b9376a517b1064f6e164f20267bef7a81b78bdbace8858640cd657c819a35f05d6dbc6d069ce484b32b7eb5dd230f5c0f5b8ba7807a32bfe9bdb345684ec82caae4125709c6be9fe900fd7961fe5e7941fb22a0c8d4bff2829107bf7d77ca5d176b905c879ed0f90929cc2fedf6f7e6c0f7bd4c145dd345196390fe55e56d8180596f407a642b3a077fd0819f27156cc9f8623a487cba6fd587ed4696715917e81f27f13e50d8b8a3c8784ebe3cebd43e5ad2d84938e6a2b5a7c44fa52aa81c82d1cbbe052df0011f89a3dc160b0e133b5a388d165190a1ae7ac7ca4c182874e38b12f0dc514876ffd8d2ebc39b6e7e6c3e0e4cd2784ef9442ef298b9046413b811b67d8f9435965cb0dbcfd00924ff4753ba7a924fc50414079e02d4f0a6a27766e52ed96697baf0ff78705d045c2ad5314811ffb3004aa373661da4a691b34d868edd602cf6c940cd3cf6c2279adb1f0bc03a24660a9c407c22182f1fdf2e8793260bfd8aca522144bcac1d84beb7d3f5735b2e64f75b4b060032253ae91791dd69b411f15865470b2de0d350f7cb03472ba97603bf079eba2b21c5da216b887c5e91bf6b597256f389fe391fa8a7998c3690eb7a31c200597f8ca14ae00d7c4f3c01410756b34a01bb59960f35cb0c5574e36d23284bf9e"
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "a233adbc63e3fdc5f73693a3cc4a27041714383f"
+  EventSize: 3179
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 2
+    VariableDataLength: 3143
+    UnicodeName: db
+    VariableData: "a159c0a5e494a74a87b5ab155c2bf0720706000000000000eb050000bd9afa775903324dbd6028f4e78f784b308205d7308203bfa003020102020a61077656000000000008300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3131313031393138343134325a170d3236313031393138353134325a308184310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e20504341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100dd0cbba2e42e09e3e7c5f79669bc0021bd693333efad04cb5480ee0683bbc52084d9f7d28bf338b0aba4ad2d7c627905ffe34a3f04352070e3c4e76be09cc03675e98a31dd8d70e5dc37b5744696285b8760232cbfdc47a567f751279e72eb07a6c9b91e3b53357ce5d3ec27b9871cfeb9c923096fa84691c16e963c41d3cba33f5d026a4dec691f25285c36fffd43150a94e019b4cfdfc212e2c25b27ee2778308b5b2a096b22895360162cc0681d53baec49f39d618c85680973445d7da2542bdd79f715cf355d6c1c2b5ccebc9c238b6f6eb526d93613c34fd627aeb9323b41922ce1c7cd77e8aa544ef75c0b048765b44318a8b2e06d1977ec5a24fa48030203010001a38201433082013f301006092b06010401823715010403020100301d0603551d0e04160414a92902398e16c49778cd90f99e4f9ae17c55af53301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014d5f656cb8fe8a25c6268d13d94905bd7ce9a18c430560603551d1f044f304d304ba049a0478645687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f4365724175745f323031302d30362d32332e63726c305a06082b06010505070101044e304c304a06082b06010505073002863e687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f4365724175745f323031302d30362d32332e637274300d06092a864886f70d01010b0500038202010014fc7c7151a579c26eb2ef393ebc3c520f6e2b3f101373fea868d048a6344d8a960526ee3146906179d6ff382e456bf4c0e528b8da1d8f8adb09d71ac74c0a36666a8cec1bd70490a81817a49bb9e240323676c4c15ac6bfe404c0ea16d3acc368ef62acdd546c503058a6eb7cfe94a74e8ef4ec7c867357c2522173345af3a38a56c804da0709edf88be3cef47e8eaef0f60b8a08fb3fc91d727f53b8ebbe63e0e33d3165b081e5f2accd16a49f3da8b19bc242d090845f541dff89eaba1d47906fb0734e419f409f5fe5a12ab21191738a2128f0cede73395f3eab5c60ecdf0310a8d309e9f4f69685b67f51886647198da2b0123d812a680577bb914c627bb6c107c7ba7a8734030e4b627a99e9cafcce4a37c92da4577c1cfe3ddcb80f5afad6c4b30285023aeab3d96ee4692137de81d1f675190567d393575e291b39c8ee2de1cde445735bd0d2ce7aab1619824658d05e9d81b367af6c35f2bce53f24e235a20a7506f6185699d4782cd1051bebd088019daa10f105dfba7e2c63b7069b2321c4f9786ce2581706362b911203cca4d9f22dbaf9949d40ed1845f1ce8a5c6b3eab03d370182a0a6ae05f47d1d5630a32f2afd7361f2a705ae5425908714b57ba7e8381f0213cf41cc1c5b990930e88459386e9b12099be98cbc595a45d62d6a0630820bd7510777d3df345b99f979fcb57806f33a904cf77a4621c597ea159c0a5e494a74a87b5ab155c2bf072400600000000000024060000bd9afa775903324dbd6028f4e78f784b30820610308203f8a003020102020a6108d3c4000000000004300d06092a864886f70d01010b0500308191310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313b3039060355040313324d6963726f736f667420436f72706f726174696f6e205468697264205061727479204d61726b6574706c61636520526f6f74301e170d3131303632373231323234355a170d3236303632373231333234355a308181310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312b3029060355040313224d6963726f736f667420436f72706f726174696f6e2055454649204341203230313130820122300d06092a864886f70d01010105000382010f003082010a0282010100a5086c4cc745096a4b0ca4c0877f06750c43015464e0167f07ed927d0bb273bf0c0ac64a4561a0c5162d96d3f52ba0fb4d499b4180903cb954fde6bcd19dc4a4188a7f418a5c59836832bb8c47c9ee71bc214f9a8a7cff443f8d8f32b22648ae75b5eec94c1e4a197ee4829a1d78774d0cb0bdf60fd316d3bcfa2ba551385df5fbbadb7802dbffec0a1b96d583b81913e9b6c07b407be11f2827c9faef565e1ce67e947ec0f044b27939e5dab2628b4dbf3870e2682414c933a40837d558695ed37cedc1045308e74eb02a876308616f631559eab22b79d70c61678a5bfd5ead877fba86674f71581222042222ce8bef547100ce503558769508ee6ab1a201d50203010001a382017630820172301206092b060104018237150104050203010001302306092b060104018237150204160414f8c16bb77f77534af325371d4ea1267b0f207080301d0603551d0e0416041413adbf4309bd82709c8cd54f316ed522988a1bd4301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d2304183016801445665243e17e5811bfd64e9e2355083b3a226aa8305c0603551d1f045530533051a04fa04d864b687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963436f725468695061724d6172526f6f5f323031302d31302d30352e637274300d06092a864886f70d01010b05000382020100350842ff30cccef7760cad1068583529463276277cef124127421b4aaa6d813848591355f3e95834a6160b82aa5dad82da808341068fb41df203b9f31a5d1bf15090f9b3558442281c20bdb2ae5114c5c0ac9795211c90db0ffc779e95739188cabdbd52b905500ddf579ea061ed0de56d25d9400f1740c8cea34ac24daf9a121d08548fbdc7bcb92b3d492b1f32fc6a21694f9bc87e4234fc3606178b8f2040c0b39a257527cdc903a3f65dd1e736547ab950b5d312d107bfbb74dfdc1e8f80d5ed18f42f14166b2fde668cb023e5c784d8edeac13382ad564b182df1689507cdcff072f0aebbdd8685982c214c332bf00f4af06887b592553275a16a826a3ca32511a4edadd704aecbd84059a084d1954c6291221a741d8c3d470e44a6e4b09b3435b1fab653a82c81eca40571c89db8bae81b4466e447540e8e567fb39f1698b286d0683e9023b52f5e8f50858dc68d825f41a1f42e0de099d26c75e4b669b52186fa07d1f6e24dd1daad2c77531e253237c76c52729586b0f135616a19f5b23b815056a6322dfea289f94286271855a182ca5a9bf830985414a64796252fc826e441941a5c023fe596e3855b3c3e3fbb47167255e22522b1d97be703062aa3f71e9046c3000dd61989e30e352762037115a6efd027a0a0593760f83894b8e07870f8ba4c868794f6e0ae0245ee65c2b6a37e69167507929bf5a6bc598358"
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "67e48e759954349537ed4902ba1a8eef74dbd1b5"
+  EventSize: 3838
+  Event:
+    VariableName: d719b2cb-3d3a-4596-a3bc-dad00e67656f
+    UnicodeNameLength: 3
+    VariableDataLength: 3800
+    UnicodeName: dbx
+    VariableData: "2616c4c14c509240aca941f9369343284c0000000000000030000000000000000000000000000000000000006e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d2616c4c14c509240aca941f9369343288c0e00000000000030000000bd9afa775903324dbd6028f4e78f784b80b4d96931bf0d02fd91a61e19d14f1da452e66db2408ca8604d411f92659f0abd9afa775903324dbd6028f4e78f784bf52f83a3fa9cfbd6920f722824dbe4034534d25b8507246b3b957dac6e1bce7abd9afa775903324dbd6028f4e78f784bc5d9d8a186e2c82d09afaa2a6f7f2e73870d3e64f72c4e08ef67796a840f0fbdbd9afa775903324dbd6028f4e78f784b363384d14d1f2e0b7815626484c459ad57a318ef4396266048d058c5a19bbf76bd9afa775903324dbd6028f4e78f784b1aec84b84b6c65a51220a9be7181965230210d62d6d33c48999c6b295a2b0a06bd9afa775903324dbd6028f4e78f784be6ca68e94146629af03f69c2f86e6bef62f930b37c6fbcc878b78df98c0334e5bd9afa775903324dbd6028f4e78f784bc3a99a460da464a057c3586d83cef5f4ae08b7103979ed8932742df0ed530c66bd9afa775903324dbd6028f4e78f784b58fb941aef95a25943b3fb5f2510a0df3fe44c58c95e0ab80487297568ab9771bd9afa775903324dbd6028f4e78f784b5391c3a2fb112102a6aa1edc25ae77e19f5d6f09cd09eeb2509922bfcd5992eabd9afa775903324dbd6028f4e78f784bd626157e1d6a718bc124ab8da27cbb65072ca03a7b6b257dbdcbbd60f65ef3d1bd9afa775903324dbd6028f4e78f784bd063ec28f67eba53f1642dbf7dff33c6a32add869f6013fe162e2c32f1cbe56dbd9afa775903324dbd6028f4e78f784b29c6eb52b43c3aa18b2cd8ed6ea8607cef3cfae1bafe1165755cf2e614844a44bd9afa775903324dbd6028f4e78f784b90fbe70e69d633408d3e170c6832dbb2d209e0272527dfb63d49d29572a6f44cbd9afa775903324dbd6028f4e78f784b075eea060589548ba060b2feed10da3c20c7fe9b17cd026b94e8a683b8115238bd9afa775903324dbd6028f4e78f784b07e6c6a858646fb1efc67903fe28b116011f2367fe92e6be2b36999eff39d09ebd9afa775903324dbd6028f4e78f784b09df5f4e511208ec78b96d12d08125fdb603868de39f6f72927852599b659c26bd9afa775903324dbd6028f4e78f784b0bbb4392daac7ab89b30a4ac657531b97bfaab04f90b0dafe5f9b6eb90a06374bd9afa775903324dbd6028f4e78f784b0c189339762df336ab3dd006a463df715a39cfb0f492465c600e6c6bd7bd898cbd9afa775903324dbd6028f4e78f784b0d0dbeca6f29eca06f331a7d72e4884b12097fb348983a2a14a0d73f4f10140fbd9afa775903324dbd6028f4e78f784b0dc9f3fb99962148c3ca833632758d3ed4fc8d0b0007b95b31e6528f2acd5bfcbd9afa775903324dbd6028f4e78f784b106faceacfecfd4e303b74f480a08098e2d0802b936f8ec774ce21f31686689cbd9afa775903324dbd6028f4e78f784b174e3a0b5b43c6a607bbd3404f05341e3dcf396267ce94f8b50e2e23a9da920cbd9afa775903324dbd6028f4e78f784b18333429ff0562ed9f97033e1148dceee52dbe2e496d5410b5cfd6c864d2d10fbd9afa775903324dbd6028f4e78f784b2b99cf26422e92fe365fbf4bc30d27086c9ee14b7a6fff44fb2f6b9001699939bd9afa775903324dbd6028f4e78f784b2bbf2ca7b8f1d91f27ee52b6fb2a5dd049b85a2b9b529c5d6662068104b055f8bd9afa775903324dbd6028f4e78f784b2c73d93325ba6dcbe589d4a4c63c5b935559ef92fbf050ed50c4e2085206f17dbd9afa775903324dbd6028f4e78f784b2e70916786a6f773511fa7181fab0f1d70b557c6322ea923b2a8d3b92b51af7dbd9afa775903324dbd6028f4e78f784b306628fa5477305728ba4a467de7d0387a54f569d3769fce5e75ec89d28d1593bd9afa775903324dbd6028f4e78f784b3608edbaf5ad0f41a414a1777abf2faf5e670334675ec3995e6935829e0caad2bd9afa775903324dbd6028f4e78f784b3841d221368d1583d75c0a02e62160394d6c4e0a6760b6f607b90362bc855b02bd9afa775903324dbd6028f4e78f784b3fce9b9fdf3ef09d5452b0f95ee481c2b7f06d743a737971558e70136ace3e73bd9afa775903324dbd6028f4e78f784b4397daca839e7f63077cb50c92df43bc2d2fb2a8f59f26fc7a0e4bd4d9751692bd9afa775903324dbd6028f4e78f784b47cc086127e2069a86e03a6bef2cd410f8c55a6d6bdb362168c31b2ce32a5adfbd9afa775903324dbd6028f4e78f784b518831fe7382b514d03e15c621228b8ab65479bd0cbfa3c5c1d0f48d9c306135bd9afa775903324dbd6028f4e78f784b5ae949ea8855eb93e439dbc65bda2e42852c2fdf6789fa146736e3c3410f2b5cbd9afa775903324dbd6028f4e78f784b6b1d138078e4418aa68deb7bb35e066092cf479eeb8ce4cd12e7d072ccb42f66bd9afa775903324dbd6028f4e78f784b6c8854478dd559e29351b826c06cb8bfef2b94ad3538358772d193f82ed1ca11bd9afa775903324dbd6028f4e78f784b6f1428ff71c9db0ed5af1f2e7bbfcbab647cc265ddf5b293cdb626f50a3a785ebd9afa775903324dbd6028f4e78f784b71f2906fd222497e54a34662ab2497fcc81020770ff51368e9e3d9bfcbfd6375bd9afa775903324dbd6028f4e78f784b726b3eb654046a30f3f83d9b96ce03f670e9a806d1708a0371e62dc49d2c23c1bd9afa775903324dbd6028f4e78f784b72e0bd1867cf5d9d56ab158adf3bddbc82bf32a8d8aa1d8c5e2f6df29428d6d8bd9afa775903324dbd6028f4e78f784b7827af99362cfaf0717dade4b1bfe0438ad171c15addc248b75bf8caa44bb2c5bd9afa775903324dbd6028f4e78f784b81a8b965bb84d3876b9429a95481cc955318cfaa1412d808c8a33bfd33fff0e4bd9afa775903324dbd6028f4e78f784b82db3bceb4f60843ce9d97c3d187cd9b5941cd3de8100e586f2bda5637575f67bd9afa775903324dbd6028f4e78f784b895a9785f617ca1d7ed44fc1a1470b71f3f1223862d9ff9dcc3ae2df92163dafbd9afa775903324dbd6028f4e78f784b8ad64859f195b5f58dafaa940b6a6167acd67a886e8f469364177221c55945b9bd9afa775903324dbd6028f4e78f784b8bf434b49e00ccf71502a2cd900865cb01ec3b3da03c35be505fdf7bd563f521bd9afa775903324dbd6028f4e78f784b8d8ea289cfe70a1c07ab7365cb28ee51edd33cf2506de888fbadd60ebf80481cbd9afa775903324dbd6028f4e78f784b9998d363c491be16bd74ba10b94d9291001611736fdca643a36664bc0f315a42bd9afa775903324dbd6028f4e78f784b9e4a69173161682e55fde8fef560eb88ec1ffedcaf04001f66c0caf707b2b734bd9afa775903324dbd6028f4e78f784ba6b5151f3655d3a2af0d472759796be4a4200e5495a7d869754c4848857408a7bd9afa775903324dbd6028f4e78f784ba7f32f508d4eb0fead9a087ef94ed1ba0aec5de6f7ef6ff0a62b93bedf5d458dbd9afa775903324dbd6028f4e78f784bad6826e1946d26d3eaf3685c88d97d85de3b4dcb3d0ee2ae81c70560d13c5720bd9afa775903324dbd6028f4e78f784baeebae3151271273ed95aa2e671139ed31a98567303a332298f83709a9d55aa1bd9afa775903324dbd6028f4e78f784bafe2030afb7d2cda13f9fa333a02e34f6751afec11b010dbcd441fdf4c4002b3bd9afa775903324dbd6028f4e78f784bb54f1ee636631fad68058d3b0937031ac1b90ccb17062a391cca68afdbe40d55bd9afa775903324dbd6028f4e78f784bb8f078d983a24ac433216393883514cd932c33af18e7dd70884c8235f4275736bd9afa775903324dbd6028f4e78f784bb97a0889059c035ff1d54b6db53b11b9766668d9f955247c028b2837d7a04cd9bd9afa775903324dbd6028f4e78f784bbc87a668e81966489cb508ee805183c19e6acd24cf17799ca062d2e384da0ea7bd9afa775903324dbd6028f4e78f784bc409bdac4775add8db92aa22b5b718fb8c94a1462c1fe9a416b95d8a3388c2fcbd9afa775903324dbd6028f4e78f784bc617c1a8b1ee2a811c28b5a81b4c83d7c98b5b0c27281d610207ebe692c2967fbd9afa775903324dbd6028f4e78f784bc90f336617b8e7f983975413c997f10b73eb267fd8a10cb9e3bdbfc667abdb8bbd9afa775903324dbd6028f4e78f784bcb6b858b40d3a098765815b592c1514a49604fafd60819da88d7a76e9778fef7bd9afa775903324dbd6028f4e78f784bce3bfabe59d67ce8ac8dfd4a16f7c43ef9c224513fbc655957d735fa29f540cebd9afa775903324dbd6028f4e78f784bd8cbeb9735f5672b367e4f96cdc74969615d17074ae96c724d42ce0216f8f3fabd9afa775903324dbd6028f4e78f784be92c22eb3b5642d65c1ec2caf247d2594738eebb7fb3841a44956f59e2b0d1fabd9afa775903324dbd6028f4e78f784bfddd6e3d29ea84c7743dad4a1bdbc700b5fec1b391f932409086acc71dd6dbd8bd9afa775903324dbd6028f4e78f784bfe63a84f782cc9d3fcf2ccf9fc11fbd03760878758d26285ed12669bdc6e6d01bd9afa775903324dbd6028f4e78f784bfecfb232d12e994b6d485d2c7167728aa5525984ad5ca61e7516221f079a1436bd9afa775903324dbd6028f4e78f784bca171d614a8d7e121c93948cd0fe55d39981f9d11aa96e03450a415227c2c65bbd9afa775903324dbd6028f4e78f784b55b99b0de53dbcfe485aa9c737cf3fb616ef3d91fab599aa7cab19eda763b5babd9afa775903324dbd6028f4e78f784b77dd190fa30d88ff5e3b011a0ae61e6209780c130b535ecb87e6f0888a0b6b2fbd9afa775903324dbd6028f4e78f784bc83cb13922ad99f560744675dd37cc94dcad5a1fcba6472fee341171d939e884bd9afa775903324dbd6028f4e78f784b3b0287533e0cc3d0ec1aa823cbf0a941aad8721579d1c499802dd1c3a636b8a9bd9afa775903324dbd6028f4e78f784b939aeef4f5fa51e23340c3f2e49048ce8872526afdf752c3a7f3a3f2bc9f6049bd9afa775903324dbd6028f4e78f784b64575bd912789a2e14ad56f6341f52af6bf80cf94400785975e9f04e2d64d745bd9afa775903324dbd6028f4e78f784b45c7c8ae750acfbb48fc37527d6412dd644daed8913ccd8a24c94d856967df8e"
+  PCRIndex: 0
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  EventSize: 4
+  Event: "00000000"
+  PCRIndex: 1
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  EventSize: 4
+  Event: "00000000"
+  PCRIndex: 2
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  EventSize: 4
+  Event: "00000000"
+  PCRIndex: 3
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  EventSize: 4
+  Event: "00000000"
+  PCRIndex: 4
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  EventSize: 4
+  Event: "00000000"
+  PCRIndex: 5
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  EventSize: 4
+  Event: "00000000"
+  PCRIndex: 6
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  EventSize: 4
+  Event: "00000000"
+  PCRIndex: 7
+  EventType: EV_SEPARATOR
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
+  EventSize: 4
+  Event: "00000000"
+  PCRIndex: 5
+  EventType: EV_EFI_GPT_EVENT
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "f8830f40b14064e7cc4e800898afb946ad865edd"
+  EventSize: 356
+  Event: "4546492050415254000001005c000000c0d1261e000000000100000000000000ff7f5a07000000002200000000000000de7f5a0700000000c7f0a9872aedfe47862ef307c41758410200000000000000800000008000000050d75786020000000000000028732ac11ff8d211ba4b00a0c93ec93b948fabe36694cc429b81ebb7969bb28a0008000000000000ff0710000000000000000000000000004500460049002000530079007300740065006d00200050006100720074006900740069006f006e000000000000000000000000000000000000000000000000000000000000000000af3dc60f838472478e793d69d8477de4426b1bcd7a6eb645b9cf431b6df6c1860008100000000000ff775a07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d0e6f939f1304a83975f34ff678da573ae2b3ee5"
+  EventSize: 178
+  Event:
+    ImageLocationInMemory: 0x9f64d018
+    ImageLengthInMemory: 1334816
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 146
+    DevicePath: '02010c00d041030a00000000010106000014030506000b0002010c00d041030a00000000010106000014030506000b0004012a000100000000080000000000000000100000000000948fabe36694cc429b81ebb7969bb28a0202040434005c004500460049005c007500620075006e00740075005c007300680069006d007800360034002e0065006600690000007fff0400'
+  PCRIndex: 4
+  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
+  DigestCount: 1
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "5b135351ac81e93f17c43ec65ec0e4755ec29e45"
+  EventSize: 41
+  Event:
+    ImageLocationInMemory: 0x0
+    ImageLengthInMemory: 0
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 0
+    DevicePath: '00081100000c1100cc'
+pcrs:
+  sha1:
+    0  : 0x3dcaea25dc86554d94b94aa5bc8f735a49212af8
+    1  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    2  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    3  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    4  : 0x59955b8e6e01b21ba7ccbbdecdeaa8ae6770caa1
+    5  : 0xd8949f1020f3344daf7aa87717ae58d6498731e4
+    6  : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
+    7  : 0x9216fc0727c344b355a90a3f34f357e4362d51bb

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-uefiaction.bin.yaml Added

@@ -0,0 +1,47 @@
+---
+version: 1
+events:
+- EventNum: 0
+  PCRIndex: 0
+  EventType: EV_NO_ACTION
+  Digest: "0000000000000000000000000000000000000000"
+  EventSize: 45
+  SpecID:
+  - Signature: Spec ID Event03
+    platformClass: 0
+    specVersionMinor: 0
+    specVersionMajor: 2
+    specErrata: 0
+    uintnSize: 2
+    numberOfAlgorithms: 4
+    Algorithms:
+    - Algorithm0:
+      algorithmId: sha1
+      digestSize: 20
+    - Algorithm1:
+      algorithmId: sha256
+      digestSize: 32
+    - Algorithm2:
+      algorithmId: sha384
+      digestSize: 48
+    - Algorithm3:
+      algorithmId: sha512
+      digestSize: 64
+    vendorInfoSize: 0
+- EventNum: 1
+  PCRIndex: 4
+  EventType: EV_EFI_ACTION
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "cd0fdb4531a6ec41be2753ba042637d6e5f7f256"
+  - AlgorithmId: sha256
+    Digest: "3d6772b4f84ed47595d72a2c4c5ffd15f5bb72c7507fe26f2aaee2c69d5633ba"
+  EventSize: 40
+  Event: |-
+    Calling EFI Application from Boot Option
+pcrs:
+  sha1:
+    4  : 0xee01a03529a6b38b5ded18ab6ae8d771aaac1925
+  sha256:
+    4  : 0x3f263b96ccbc33bb53d808771f9ab1e02d4dec8854f9530f749cde853a723273

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-uefiservices.bin.yaml Added

@@ -0,0 +1,45 @@
+---
+version: 1
+events:
+- EventNum: 0
+  PCRIndex: 0
+  EventType: EV_NO_ACTION
+  Digest: "0000000000000000000000000000000000000000"
+  EventSize: 37
+  SpecID:
+  - Signature: Spec ID Event03
+    platformClass: 0
+    specVersionMinor: 0
+    specVersionMajor: 2
+    specErrata: 0
+    uintnSize: 2
+    numberOfAlgorithms: 2
+    Algorithms:
+    - Algorithm0:
+      algorithmId: sha1
+      digestSize: 20
+    - Algorithm1:
+      algorithmId: sha256
+      digestSize: 32
+    vendorInfoSize: 0
+- EventNum: 1
+  PCRIndex: 2
+  EventType: EV_EFI_BOOT_SERVICES_DRIVER
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "855685b4dbd4b67d50e0594571055054cfe2b1e9"
+  - AlgorithmId: sha256
+    Digest: "dd8576b4ff346c19c56c3e4f97ce55c5afa646f9c669be0a7cdd05057a0ecdf3"
+  EventSize: 84
+  Event:
+    ImageLocationInMemory: 0x7dcf6018
+    ImageLengthInMemory: 171464
+    ImageLinkTimeAddress: 0x0
+    LengthOfDevicePath: 52
+    DevicePath: '02010c00d041030a0000000001010600000201010600000004081800000000000026010000000000ffc30300000000007fff0400'
+pcrs:
+  sha1:
+    2  : 0x5b5f4d5c31664f01670a98a5796a36473671befc
+  sha256:
+    2  : 0x35fcf9d737c52c971f7c74058d36937dbd7824177fa0f1de3eba3934fcb83b9d

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event-uefivar.bin.yaml Added

@@ -0,0 +1,51 @@
+---
+version: 1
+events:
+- EventNum: 0
+  PCRIndex: 0
+  EventType: EV_NO_ACTION
+  Digest: "0000000000000000000000000000000000000000"
+  EventSize: 45
+  SpecID:
+  - Signature: Spec ID Event03
+    platformClass: 0
+    specVersionMinor: 0
+    specVersionMajor: 2
+    specErrata: 0
+    uintnSize: 2
+    numberOfAlgorithms: 4
+    Algorithms:
+    - Algorithm0:
+      algorithmId: sha1
+      digestSize: 20
+    - Algorithm1:
+      algorithmId: sha256
+      digestSize: 32
+    - Algorithm2:
+      algorithmId: sha384
+      digestSize: 48
+    - Algorithm3:
+      algorithmId: sha512
+      digestSize: 64
+    vendorInfoSize: 0
+- EventNum: 1
+  PCRIndex: 7
+  EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
+  DigestCount: 2
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d4fdd1f14d4041494deb8fc990c45343d2277d08"
+  - AlgorithmId: sha256
+    Digest: "ccfc4bb32888a345bc8aeadaba552b627d99348c767681ab3141f5b01e40a40e"
+  EventSize: 53
+  Event:
+    VariableName: 8be4df61-93ca-11d2-aa0d-00e098032b8c
+    UnicodeNameLength: 10
+    VariableDataLength: 1
+    UnicodeName: SecureBoot
+    VariableData: "01"
+pcrs:
+  sha1:
+    7  : 0x3a1ea200b8fafe60c290e903c5e6443cfef67f04
+  sha256:
+    7  : 0xe58ada1ba75f2e4722b539824598ad5e10c55f2e4aeab2033f3b0a8ee3f3eca6

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/event.bin.yaml Added

@@ -0,0 +1,56 @@
+---
+version: 1
+events:
+- EventNum: 0
+  PCRIndex: 0
+  EventType: EV_NO_ACTION
+  Digest: "0000000000000000000000000000000000000000"
+  EventSize: 45
+  SpecID:
+  - Signature: Spec ID Event03
+    platformClass: 0
+    specVersionMinor: 0
+    specVersionMajor: 2
+    specErrata: 0
+    uintnSize: 2
+    numberOfAlgorithms: 4
+    Algorithms:
+    - Algorithm0:
+      algorithmId: sha1
+      digestSize: 20
+    - Algorithm1:
+      algorithmId: sha256
+      digestSize: 32
+    - Algorithm2:
+      algorithmId: sha384
+      digestSize: 48
+    - Algorithm3:
+      algorithmId: sha512
+      digestSize: 64
+    vendorInfoSize: 0
+- EventNum: 1
+  PCRIndex: 0
+  EventType: EV_EFI_PLATFORM_FIRMWARE_BLOB
+  DigestCount: 4
+  Digests:
+  - AlgorithmId: sha1
+    Digest: "d1ee7e857e2ae54671be58f83f3b0355c4c929f1"
+  - AlgorithmId: sha256
+    Digest: "660375b3c94d47f04e30912dd931b28532d313271d1ae1bdead0a1b8f1276ed1"
+  - AlgorithmId: sha384
+    Digest: "160222ca09aba572bbe7316db5762c91a41cff111c7e0f58ae6ca6581b898fcd16c422a2aca960d72562faf617a916c0"
+  - AlgorithmId: sha512
+    Digest: "4daf4fc3dec73df75580a48c7c69de2db465b594c953250630c396ebc53f8f44ee2edb025e1b34805cdd76ee43dca8e513555369fe8f0b3a6395f366540680d1"
+  EventSize: 16
+  Event:
+    BlobBase: 0x900000
+    BlobLength: 0xb00000
+pcrs:
+  sha1:
+    0  : 0x543c314066a9cd7a6b6aa53f56b38e814a76efe7
+  sha256:
+    0  : 0x118bdc4043596f8d6b7813438131959961f6abba29bab0075d16ca39664f5862
+  sha384:
+    0  : 0x8ce4f7fcd5eaae9df051f735b0e5a37f836d54352e2efafc930fa69a28cd7c8d07014fd54c477a5dc46a0ff8c4ecaf07
+  sha512:
+    0  : 0x2b39e8bfcb64133066c8939231a424cd0a2f3ceaf21b182e82b826916b5826fa3f98fcf1333a2948947ea52f03959e7737800e49722c972e5444f7be6aa9a431

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/fixtures/specid-vendordata.bin.yaml Added

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/helpers.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/helpers.sh Changed

@@ -1,6 +1,11 @@
 # SPDX-License-Identifier: BSD-3-Clause
 
 set -E
+shopt -s expand_aliases
+
+# We get what python interpreter to run from configure, so alias python here
+# to make subordiante scripts work.
+alias python=${PYTHON:-python}
 
 # Return 0 if run by a TPM simulator, return 1 otherwise
 is_simulator() {
@@ -225,8 +230,9 @@
     a="$a""export TPM2TOOLS_TEST_TCTI=\"$TPM2TOOLS_TEST_TCTI\"\n"
     a="$a""export TPM2TOOLS_TEST_PERSISTENT=\"$TPM2TOOLS_TEST_PERSISTENT\"\n"
     a="$a""export PATH=\"$PATH\"\n"
-    a="$a""TPM2_SIM_NV_CHIP=\"$TPM2_SIM_NV_CHIP\"\n"
-    a="$a""TPM2_TOOLS_TEST_FIXTURES=\"$TPM2_TOOLS_TEST_FIXTURES\"\n"
+    a="$a""export srcdir=\"$srcdir\"\n"
+    a="$a""export abs_srcdir=\"$abs_srcdir\"\n"
+    a="$a""export abs_builddir=\"$abs_builddir\"\n"
     echo "#!/usr/bin/env bash"
     echo -e "$a"
     local script="$tpm2_test_original_cwd""/""$0"
@@ -283,7 +289,14 @@
         fi
         tpm2_sim_cmd_port=$((tpm2_sim_port + 1))
         echo "Attempting to start simulator on port: $tpm2_sim_port"
-        $TPM2_SIM -port $tpm2_sim_port &
+        case "$TPM2_SIM" in
+            *swtpm) "$TPM2_SIM" socket --tpm2 --server port="$tpm2_sim_port" \
+                                       --ctrl type=tcp,port="$tpm2_sim_cmd_port" \
+                                       --seccomp action="none" \
+                                       --flags not-need-init --tpmstate dir="$PWD" &;;
+            *tpm_server) "$TPM2_SIM" -port "$tpm2_sim_port" &;;
+            *) echo "Unknown TPM simulator $TPM2_SIM"; return 1;;
+        esac
         tpm2_sim_pid=$!
         sleep 1
 
@@ -295,8 +308,11 @@
         if  $tpm2_sim_port_rc -eq 0  &&  $tpm2_sim_cmd_port_rc -eq 0 ; then
             echo "Started simulator on port $tpm2_sim_port in dir \"$PWD\""
             TPM2_SIMPORT=$tpm2_sim_port
-            # set a possible tools tcti to use mssim
-            tpm2tools_tcti="mssim:host=localhost,port=$TPM2_SIMPORT"
+            case "$TPM2_SIM" in
+                *swtpm) tpm2tools_tcti="swtpm:host=localhost,port=$TPM2_SIMPORT";;
+                *tpm_server) tpm2tools_tcti="mssim:host=localhost,port=$TPM2_SIMPORT";;
+                *) echo "Unknown TPM simulator $TPM2_SIM"; return 1;;
+            esac
             echo "tpm2tools_tcti=\"$tpm2tools_tcti\""
             return 0
         else
@@ -326,7 +342,12 @@
 
             # TCTI information for use with ABRMD
             local name="com.intel.tss2.Tabrmd${TPM2_SIMPORT}"
-            tpm2_tabrmd_opts="--session --dbus-name=$name --tcti=mssim:port=$TPM2_SIMPORT"
+            tpm2_tabrmd_opts="--session --dbus-name=$name"
+            case "$TPM2_SIM" in
+                *swtpm) tpm2_tabrmd_opts="$tpm2_tabrmd_opts --tcti=swtpm:port=$TPM2_SIMPORT";;
+                *tpm_server) tpm2_tabrmd_opts="$tpm2_tabrmd_opts --tcti=mssim:port=$TPM2_SIMPORT";;
+                *) echo "Unknown TPM simulator $TPM2_SIM"; return 1;;
+            esac
             echo "TPM2ABRMD_TCTI=\"$tpm2_tabrmd_opts\""
             TPM2ABRMD_TCTI="$tpm2_tabrmd_opts"
         fi
@@ -536,8 +557,6 @@
 
     SANITIZER_FILTER="*"AddressSanitizer"*"
 
-    PATH=${BUILDDIR}/tools/fapi:$PATH
-
     setup_profiles $tempdir
     setup_policies $tempdir
     resetPCR16

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/abrmd_extended-sessions.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/abrmd_extended-sessions.sh Changed

@@ -111,4 +111,55 @@
     true
 fi
 
+# Test bounded sessions work with bind entities with auth
+tpm2 createprimary -Q -C o -c prim.ctx -p primepass
+## Test with bounded and salted session
+tpm2 startauthsession -S session.ctx --hmac-session --tpmkey-context prim.ctx \
+--bind-context prim.ctx --bind-auth primepass
+tpm2 sessionconfig session.ctx --enable-encrypt --enable-decrypt
+tpm2 getrandom 8 -S session.ctx
+tpm2 flushcontext session.ctx
+## Test with bounded only session
+tpm2 startauthsession -S session.ctx --hmac-session \
+--bind-context prim.ctx  --bind-auth primepass
+tpm2 sessionconfig session.ctx --enable-encrypt --enable-decrypt
+tpm2 getrandom 8 -S session.ctx
+tpm2 flushcontext session.ctx
+## Test with salted only session
+tpm2 startauthsession -S session.ctx --hmac-session \
+--tpmkey-context prim.ctx
+tpm2 sessionconfig session.ctx --enable-encrypt --enable-decrypt
+tpm2 getrandom 8 -S session.ctx
+tpm2 flushcontext session.ctx
+
+# test that name verification works
+tpm2 evictcontrol -c prim.ctx 0x81000000
+tpm2 readpublic -c prim.ctx -n name.bin
+tpm2 startauthsession -S session.ctx --policy-session \
+  --tpmkey-context 0x81000000 -n name.bin
+# verify -c works
+tpm2 startauthsession -S session.ctx --policy-session \
+  -c 0x81000000 -n name.bin
+
+# test if name is bad, generate a random name of of the same size
+# Note FreeBSD stat has no printf and wc prints spaces hence the sed.
+size=$(wc -c < name.bin | sed 's/ //g')
+dd if=/dev/urandom bs=${size} count=1 of=name2.bin
+
+if tpm2 startauthsession -S session.ctx --policy-session \
+  --tpmkey-context 0x81000000 -n name2.bin 2>/dev/null; then
+    echo "Expected tpm2 startauthsession to fail with bad name"
+    exit 1
+else
+    true
+fi
+
+if tpm2 startauthsession -S session.ctx --policy-session \
+  -c 0x81000000 -n name2.bin 2>/dev/null; then
+    echo "Expected tpm2 startauthsession to fail with bad name"
+    exit 1
+else
+    true
+fi
+
 exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/abrmd_policyauthorize.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/abrmd_policyauthorize.sh Changed

@@ -41,6 +41,28 @@
     rm $file_session_file
 }
 
+test_cphash () {
+## Check cpHash output for TPM2_PolicyAuthorize
+tpm2 startauthsession -Q -S session.ctx
+tpm2 policyauthorize -S session.ctx -n $file_verifying_key_name \
+    --cphash cp.hash
+
+TPM2_CC_PolicyAuthorize="0000016a"
+approvedPolicy="0000"
+nonce="0000"
+policySession=$(tpm2 sessionconfig session.ctx | grep Session-Handle | \
+    awk -F ' 0x' '{print $2}')
+file_size=$(printf "%04x" $(ls -l $file_verifying_key_name | awk {'print $5'}))
+file_data=`cat $file_verifying_key_name | xxd -p -c $file_size`
+keySign=$file_size$file_data
+checkTicket="8022400000010000"
+
+echo -ne $TPM2_CC_PolicyAuthorize$policySession$approvedPolicy$nonce$keySign$checkTicket | xxd -r -p | \
+openssl dgst -sha256 -binary -out test.bin
+cmp cp.hash test.bin 2
+tpm2 flushcontext session.ctx
+}
+
 openssl genrsa -out $file_private_key 2048 2>/dev/null
 openssl rsa -in $file_private_key -out $file_public_key -pubout 2>/dev/null
 tpm2 loadexternal -G rsa -C n -u $file_public_key -c $file_verifying_key_ctx \
@@ -73,4 +95,6 @@
 
 diff $file_authorized_policy_1 $file_authorized_policy_2
 
+test_cphash
+
 exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/abrmd_policyauthvalue.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/abrmd_policyauthvalue.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/abrmd_policycommandcode.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/abrmd_policycommandcode.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/abrmd_policycountertimer.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/abrmd_policycountertimer.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/abrmd_policycphash.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/abrmd_policycphash.sh Changed

@@ -23,7 +23,7 @@
 
 generate_policycphash() {
     tpm2 startauthsession -S session.ctx -g sha256
-    tpm2 policycphash -S session.ctx -L policy.cphash --cphash cp.hash
+    tpm2 policycphash -S session.ctx -L policy.cphash --cphash-input cp.hash
     tpm2 flushcontext session.ctx
     rm session.ctx
 }
@@ -38,7 +38,7 @@
 
 setup_authorized_policycphash() {
     tpm2 startauthsession -S session.ctx --policy-session -g sha256
-    tpm2 policycphash -S session.ctx --cphash cp.hash
+    tpm2 policycphash -S session.ctx --cphash-input cp.hash
     tpm2 policyauthorize -S session.ctx -i policy.cphash -n signing_key.name \
     -t verification.tkt
 }
@@ -46,12 +46,18 @@
 setup_owner_policy() {
     tpm2 setprimarypolicy -C o -L policy.cphash -g sha256
     tpm2 startauthsession -S session.ctx --policy-session -g sha256
-    tpm2 policycphash -S session.ctx --cphash cp.hash
+    tpm2 policycphash -S session.ctx --cphash-input cp.hash
+}
+
+setup_platform_policy() {
+    tpm2 setprimarypolicy -C p -L policy.cphash -g sha256
+    tpm2 startauthsession -S session.ctx --policy-session -g sha256
+    tpm2 policycphash -S session.ctx --cphash-input cp.hash
 }
 
 start_policy_cphash() {
     tpm2 startauthsession -S session.ctx --policy-session -g sha256
-    tpm2 policycphash -S session.ctx --cphash cp.hash
+    tpm2 policycphash -S session.ctx --cphash-input cp.hash
 }
 
 create_authorized_policy() {
@@ -69,11 +75,23 @@
 # Restrict the value that can be set through tpm2 nvsetbits.
 create_authorized_policy
 tpm2 nvdefine 1 -a "policywrite|authwrite|ownerread|nt=bits" -L authorized.policy
+NV_INDEX_NAME=$(tpm2 nvreadpublic | grep name | awk {'print $2'})
+#
+# Suppose TPM2_NVDefine was not run and the name was entirely created external
+# to the TPM. Note: This support still needs to be added.
+#
+# To emulate the absence of NV index while calculating the cpHash of NV_SetBits,
+# let's Undefine the NV index and define it later.
+#
+tpm2 nvundefine 1 -C o
+# (1) Calculate the cpHash
+tpm2 nvsetbits 1 -i 1 --cphash cp.hash -n $NV_INDEX_NAME --tcti=none
 ## Create policycphash
-tpm2 nvsetbits 1 -i 1 --cphash cp.hash
 generate_policycphash
 ## Sign and verify policycphash
 sign_and_verify_policycphash
+# (3) Define the NV index and write some NV index data
+tpm2 nvdefine 1 -a "policywrite|authwrite|ownerread|nt=bits" -L authorized.policy
 ## Satisfy policycphash and execute nvsetbits
 setup_authorized_policycphash
 tpm2 nvsetbits 1 -i 1 -P "session:session.ctx"
@@ -93,9 +111,24 @@
 # Test tpm2 nvextend
 create_authorized_policy
 tpm2 nvdefine 1 -a "nt=extend|ownerread|policywrite" -L authorized.policy
-echo "foo" | tpm2 nvextend -i- 1 --cphash cp.hash
+NV_INDEX_NAME=$(tpm2 nvreadpublic | grep name | awk {'print $2'})
+#
+# Suppose TPM2_NVDefine was not run and the name was entirely created external
+# to the TPM. Note: This support still needs to be added.
+#
+# To emulate the absence of NV index while calculating the cpHash of NV_SetBits,
+# let's Undefine the NV index and define it later.
+#
+tpm2 nvundefine 1 -C o
+# (1) Calculate the cpHash
+echo "foo" | tpm2 nvextend -i- 1 --cphash cp.hash -n $NV_INDEX_NAME --tcti=none
+## Create policycphash
 generate_policycphash
+## Sign and verify policycphash
 sign_and_verify_policycphash
+# (3) Define the NV index
+tpm2 nvdefine 1 -a "nt=extend|ownerread|policywrite" -L authorized.policy
+## Satisfy policycphash and execute nvsetbits
 setup_authorized_policycphash
 echo "foo" | tpm2 nvextend -i- 1 -P "session:session.ctx"
 tpm2 flushcontext session.ctx
@@ -114,42 +147,82 @@
 # Test tpm2 nvincrement
 create_authorized_policy
 tpm2 nvdefine 1 -s 8 -a "nt=counter|ownerread|policywrite" -L authorized.policy
-tpm2 nvincrement 1 --cphash cp.hash
+NV_INDEX_NAME=$(tpm2 nvreadpublic | grep name | awk {'print $2'})
+#
+# Suppose TPM2_NVDefine was not run and the name was entirely created external
+# to the TPM. Note: This support still needs to be added.
+#
+# To emulate the absence of NV index while calculating the cpHash of NVRead,
+# let's Undefine the NV index and define it later.
+#
+tpm2 nvundefine 1 -C o
+tpm2 nvincrement 1 --cphash cp.hash -n $NV_INDEX_NAME --tcti=none
 generate_policycphash
 sign_and_verify_policycphash
+
+tpm2 nvdefine 1 -s 8 -a "nt=counter|ownerread|policywrite" -L authorized.policy
 setup_authorized_policycphash
+
 tpm2 nvincrement 1 -P "session:session.ctx"
 tpm2 flushcontext session.ctx
 tpm2 nvundefine 1
 
 # Test tpm2 nvread
 create_authorized_policy
-tpm2 nvdefine 1 -s 8 -a "ownerwrite|policyread" -L authorized.policy
-echo "foo" | tpm2 nvwrite 1 -i- -C o
-tpm2 nvread 1 -s 8 --cphash cp.hash
+tpm2 nvdefine 1 -a "ownerwrite|policyread" -L authorized.policy
+echo "some nv data" | tpm2 nvwrite 1 -i- -C o
+NV_INDEX_NAME=$(tpm2 nvreadpublic | grep name | awk {'print $2'})
+#
+# Suppose TPM2_NVDefine was not run and the name was entirely created external
+# to the TPM. Note: This support still needs to be added.
+#
+# To emulate the absence of NV index while calculating the cpHash of NVRead,
+# let's Undefine the NV index and define it later.
+#
+tpm2 nvundefine 1 -C o
+# (1) Calculate the cpHash
+tpm2 nvread 1 -s 4 --cphash cp.hash -n $NV_INDEX_NAME --tcti=none
+# (2) Calculate the policycphash
 generate_policycphash
 sign_and_verify_policycphash
+# (3) Define the NV index and write some NV index data
+tpm2 nvdefine 1 -a "ownerwrite|policyread" -L authorized.policy
+echo "some nv data" | tpm2 nvwrite 1 -i- -C o
+# (4)
 setup_authorized_policycphash
-tpm2 nvread 1 -s 8 -P "session:session.ctx" | xxd -p
+tpm2 nvread 1 -s 4 -P "session:session.ctx"
+tpm2 flushcontext session.ctx
 ## test the failing scenario
 setup_authorized_policycphash
 trap - ERR
-tpm2 nvread 1 -s 7 --offset 1 -P "session:session.ctx"
+tpm2 nvread 1 -s 8 --offset 1 -P "session:session.ctx"
 if  $? == 0 ;then
   echo "ERROR: nvread must fail!"
   exit 1
 fi
 trap onerror ERR
 tpm2 flushcontext session.ctx
-tpm2 nvundefine 1
+tpm2 nvundefine 1 -C o
 
 # Test tpm2 nvreadlock
 create_authorized_policy
 tpm2 nvdefine 1 -C o -s 32 -a "policyread|policywrite|read_stclear" \
 -L authorized.policy
-tpm2 nvreadlock 1 -C 0x01000001 --cphash cp.hash
+NV_INDEX_NAME=$(tpm2 nvreadpublic | grep name | awk {'print $2'})
+#
+# Suppose TPM2_NVDefine was not run and the name was entirely created external
+# to the TPM. Note: This support still needs to be added.
+#
+# To emulate the absence of NV index while calculating the cpHash of NVRead,
+# let's Undefine the NV index and define it later.
+#
+tpm2 nvundefine 1 -C o
+tpm2 nvreadlock 1 -C 0x01000001 --cphash cp.hash -n $NV_INDEX_NAME --tcti=none
 generate_policycphash
 sign_and_verify_policycphash
+
+tpm2 nvdefine 1 -C o -s 32 -a "policyread|policywrite|read_stclear" \
+-L authorized.policy
 setup_authorized_policycphash
 tpm2 nvreadlock 1 -C 0x01000001 -P "session:session.ctx"
 tpm2 flushcontext session.ctx
@@ -159,24 +232,49 @@
 create_authorized_policy
 tpm2 nvdefine 1 -C o -s 32 -a "policyread|policywrite|writedefine" \
 -L authorized.policy
-tpm2 nvwritelock 1 -C 0x01000001 --cphash cp.hash
+NV_INDEX_NAME=$(tpm2 nvreadpublic | grep name | awk {'print $2'})
+#
+# Suppose TPM2_NVDefine was not run and the name was entirely created external
+# to the TPM. Note: This support still needs to be added.
+#
+# To emulate the absence of NV index while calculating the cpHash of NVRead,
+# let's Undefine the NV index and define it later.
+#
+tpm2 nvundefine 1 -C o
+tpm2 nvwritelock 1 -C 0x01000001 --cphash cp.hash -n $NV_INDEX_NAME --tcti=none
 generate_policycphash
 sign_and_verify_policycphash
+
+tpm2 nvdefine 1 -C o -s 32 -a "policyread|policywrite|writedefine" \
+-L authorized.policy
 setup_authorized_policycphash
 tpm2 nvwritelock 1 -C 0x01000001 -P "session:session.ctx"
 tpm2 flushcontext session.ctx
 tpm2 nvundefine 1
+
 ## attempt with globallock attribute set
 tpm2 nvdefine 1 -C o -s 32 -a "ownerread|ownerwrite|globallock"
-tpm2 nvwritelock --global -C o --cphash cp.hash
+NV_INDEX_NAME=$(tpm2 nvreadpublic | grep name | awk {'print $2'})
+#
+# Suppose TPM2_NVDefine was not run and the name was entirely created external
+# to the TPM. Note: This support still needs to be added.
+#
+# To emulate the absence of NV index while calculating the cpHash of NVRead,
+# let's Undefine the NV index and define it later.
+#
+tpm2 nvundefine 1 -C o
+tpm2 nvwritelock --global -C o --cphash cp.hash --tcti=none
 generate_policycphash
 setup_owner_policy
+
+tpm2 nvdefine 1 -C o -s 32 -a "ownerread|ownerwrite|globallock"
 tpm2 nvwritelock --global -C o -P "session:session.ctx"
 tpm2 flushcontext session.ctx
 tpm2 nvundefine 1
 
 # Test tpm2 nvdefine
-tpm2 nvdefine 1 -C o -s 32 -a "ownerread|ownerwrite" --cphash cp.hash
+tpm2 nvdefine 1 -C o -s 32 -a "ownerread|ownerwrite" --cphash cp.hash \
+  --tcti=none
 generate_policycphash
 setup_owner_policy
 tpm2 nvdefine 1 -C o -s 32 -a "ownerread|ownerwrite" -P "session:session.ctx"
@@ -195,9 +293,12 @@
 
 # Test tpm2 nvundefine
 tpm2 nvdefine 1
-tpm2 nvundefine 1 --cphash cp.hash
+NV_INDEX_NAME=$(tpm2 nvreadpublic | grep name | awk {'print $2'})
+tpm2 nvundefine 1
+tpm2 nvundefine 1 --cphash cp.hash --tcti=none -n $NV_INDEX_NAME
 generate_policycphash
 setup_owner_policy
+tpm2 nvdefine 1
 tpm2 nvundefine 1 -P "session:session.ctx"
 tpm2 flushcontext session.ctx
 ## attempt failing scenario
@@ -213,6 +314,41 @@
 tpm2 flushcontext session.ctx
 tpm2 nvundefine -C p 2
 
+# Test tpm2 nvundefine - spacespecial
+#
+# Get NV index name
+#
+tpm2 startauthsession -S special_session.ctx --policy-session
+tpm2 policycommandcode -S special_session.ctx TPM2_CC_NV_UndefineSpaceSpecial \
+-L special_policy.digest
+tpm2 nvdefine 1 -C p -s 32 -a "authread|authwrite|policydelete|platformcreate" \
+-L special_policy.digest
+NV_INDEX_NAME=$(tpm2 nvreadpublic | grep name | awk {'print $2'})
+tpm2 nvundefine 1 -S special_session.ctx -C p
+tpm2 flushcontext special_session.ctx
+#
+# Get cpHash with tcti=none
+#
+tpm2 nvundefine 1 -n $NV_INDEX_NAME --with-policydelete --cphash cp.hash \
+--tcti=none
+generate_policycphash
+setup_platform_policy
+#
+# Change platform auth to ensure using auth policy for authentication.
+#
+tpm2 nvdefine 1 -C p -s 32 -a "authread|authwrite|policydelete|platformcreate" \
+-L special_policy.digest
+tpm2 startauthsession -S special_session.ctx --policy-session
+tpm2 policycommandcode -S special_session.ctx TPM2_CC_NV_UndefineSpaceSpecial
+#
+# Auth platform with auth session this time
+#
+tpm2 changeauth -c p platformauth
+tpm2 nvundefine 1 -S special_session.ctx -P session:session.ctx
+tpm2 flushcontext session.ctx
+tpm2 flushcontext special_session.ctx
+tpm2 changeauth -c p -p platformauth
+
 #Test tpm2 nvcertify
 tpm2 createprimary -C o -c primary.ctx -Q
 tpm2 create -G rsa -u signing_key.pub -r signing_key.priv -C primary.ctx \
@@ -220,8 +356,12 @@
 tpm2 readpublic -c signing_key.ctx -f pem -o sslpub.pem -Q
 tpm2 nvdefine -s 32 -C o -a "ownerread|ownerwrite|authread|authwrite" 1
 dd if=/dev/urandom bs=1 count=32 status=none| tpm2 nvwrite 1 -i-
-tpm2 nvcertify -C signing_key.ctx -g sha256 -f plain -s rsassa \
--o signature.bin --attestation attestation.bin --size 32 1 -c o --cphash cp.hash
+
+NV_INDEX_NAME=$(tpm2 nvreadpublic | grep name | awk {'print $2'})
+SIGNER_NAME=$(tpm2 readpublic -c signing_key.ctx | grep name | grep -v -e q -e g | awk {'print $2'})
+
+tpm2 nvcertify -s rsassa -g sha256 --size 32 1 --cphash cp.hash --tcti none \
+--name $NV_INDEX_NAME --signer-name $SIGNER_NAME -c o
 generate_policycphash
 setup_owner_policy
 tpm2 nvcertify -C signing_key.ctx -g sha256 -f plain -s rsassa \
@@ -320,7 +460,7 @@
 trap onerror ERR
 tpm2 flushcontext session.ctx
 
-# Test tpm2 activatecredential
+# Test tpm2 activatecredential (using legacy option --cphash)
 create_authorized_policy
 tpm2 createprimary -C o -c prim.ctx -G rsa
 tpm2 readpublic -c prim.ctx -o prim.pub
@@ -394,12 +534,12 @@
 tpm2 duplicate -C new_parent.ctx -c duplicable_key.ctx -G aes \
 -i sym_key_in.bin -r dupprv.bin -s dupseed.dat --cphash cp.hash
 tpm2 startauthsession -S session.ctx -g sha256
-tpm2 policycphash -S session.ctx --cphash cp.hash
+tpm2 policycphash -S session.ctx --cphash-input cp.hash
 tpm2 policycommandcode -S session.ctx -L policy.cphash TPM2_CC_Duplicate
 tpm2 flushcontext session.ctx
 sign_and_verify_policycphash
 tpm2 startauthsession --policy-session -S session.ctx -g sha256
-tpm2 policycphash -S session.ctx --cphash cp.hash
+tpm2 policycphash -S session.ctx --cphash-input cp.hash
 tpm2 policycommandcode -S session.ctx TPM2_CC_Duplicate
 tpm2 policyauthorize -S session.ctx -i policy.cphash -n signing_key.name \
 -t verification.tkt
@@ -409,7 +549,7 @@
 ## attempt failing scenario
 dd if=/dev/urandom of=sym_key_in.bin bs=1 count=16 status=none
 tpm2 startauthsession --policy-session -S session.ctx -g sha256
-tpm2 policycphash -S session.ctx --cphash cp.hash
+tpm2 policycphash -S session.ctx --cphash-input cp.hash
 tpm2 policycommandcode -S session.ctx TPM2_CC_Duplicate
 tpm2 policyauthorize -S session.ctx -i policy.cphash -n signing_key.name \
 -t verification.tkt
@@ -480,12 +620,12 @@
 -L authorized.policy -P primarypass
 tpm2 certify -c prim.ctx -C key.ctx -g sha256 --cphash cp.hash
 tpm2 startauthsession -S session.ctx -g sha256
-tpm2 policycphash -S session.ctx --cphash cp.hash
+tpm2 policycphash -S session.ctx --cphash-input cp.hash
 tpm2 policycommandcode -S session.ctx -L policy.cphash TPM2_CC_Certify
 tpm2 flushcontext session.ctx
 sign_and_verify_policycphash
 tpm2 startauthsession --policy-session -S session.ctx -g sha256
-tpm2 policycphash -S session.ctx --cphash cp.hash
+tpm2 policycphash -S session.ctx --cphash-input cp.hash
 tpm2 policycommandcode -S session.ctx TPM2_CC_Certify
 tpm2 policyauthorize -S session.ctx -i policy.cphash -n signing_key.name \
 -t verification.tkt
@@ -563,7 +703,7 @@
 generate_policycphash
 tpm2 setprimarypolicy -C p -L policy.cphash -g sha256
 tpm2 startauthsession -S session.ctx --policy-session -g sha256
-tpm2 policycphash -S session.ctx --cphash cp.hash
+tpm2 policycphash -S session.ctx --cphash-input cp.hash
 tpm2 hierarchycontrol -C p shEnable clear -P "session:session.ctx"
 tpm2 flushcontext session.ctx
 
@@ -586,7 +726,7 @@
 generate_policycphash
 tpm2 setprimarypolicy -C l -L policy.cphash -g sha256
 tpm2 startauthsession -S session.ctx --policy-session -g sha256
-tpm2 policycphash -S session.ctx --cphash cp.hash
+tpm2 policycphash -S session.ctx --cphash-input cp.hash
 tpm2 clear -c l "session:session.ctx"
 tpm2 flushcontext session.ctx
 
@@ -596,7 +736,7 @@
 generate_policycphash
 tpm2 setprimarypolicy -C l -L policy.cphash -g sha256
 tpm2 startauthsession -S session.ctx --policy-session -g sha256
-tpm2 policycphash -S session.ctx --cphash cp.hash
+tpm2 policycphash -S session.ctx --cphash-input cp.hash
 tpm2 clearcontrol -C l s -P "session:session.ctx"
 tpm2 flushcontext session.ctx
 
@@ -607,7 +747,7 @@
 generate_policycphash
 tpm2 setprimarypolicy -C l -L policy.cphash -g sha256
 tpm2 startauthsession -S session.ctx --policy-session -g sha256
-tpm2 policycphash -S session.ctx --cphash cp.hash
+tpm2 policycphash -S session.ctx --cphash-input cp.hash
 tpm2 dictionarylockout -s -n 5 -t 6 -l 7 --cphash cp.hash -p "session:session.ctx"
 tpm2 flushcontext session.ctx
 
@@ -638,17 +778,28 @@
 tpm2 flushcontext session.ctx
 
 # Test nvwrite
- create_authorized_policy
- tpm2 nvdefine 1 -s 8 -a "ownerread|authwrite|policywrite" -L authorized.policy
- echo "foo" | tpm2 nvwrite 1 -i- --cphash cp.hash
- xxd -p cp.hash
- generate_policycphash
- sign_and_verify_policycphash
- setup_authorized_policycphash
- echo "foo" | tpm2 nvwrite 1 -i- -P "session:session.ctx"
- tpm2 flushcontext session.ctx
-
- # Test encryptdecrypt
+create_authorized_policy
+tpm2 nvdefine 1 -s 8 -a "ownerread|authwrite|policywrite" -L authorized.policy
+
+NV_INDEX_NAME=$(tpm2 nvreadpublic | grep name | awk {'print $2'})
+#
+# Suppose TPM2_NVDefine was not run and the name was entirely created external
+# to the TPM. Note: This support still needs to be added.
+#
+# To emulate the absence of NV index while calculating the cpHash of NVRead,
+# let's Undefine the NV index and define it later.
+#
+tpm2 nvundefine 1 -C o
+echo "foo" | tpm2 nvwrite 1 -i- -n $NV_INDEX_NAME --cphash cp.hash --tcti=none
+
+generate_policycphash
+sign_and_verify_policycphash
+tpm2 nvdefine 1 -s 8 -a "ownerread|authwrite|policywrite" -L authorized.policy
+setup_authorized_policycphash
+echo "foo" | tpm2 nvwrite 1 -i- -P "session:session.ctx"
+tpm2 flushcontext session.ctx
+
+# Test encryptdecrypt
 create_authorized_policy
 tpm2 createprimary -Q -C e -g sha1 -G rsa -c primary.ctx
 tpm2 create -Q -g sha256 -G aes -u key.pub -r key.priv -C primary.ctx \
@@ -676,4 +827,45 @@
 tpm2 hmac -c key.ctx plain.txt -o hmac.bin -p "session:session.ctx"
 tpm2 flushcontext session.ctx
 
+# Test if specifying the <halg>: in the cphash path has effect on cphash alg
+TPM2_ALG_SHA256_SZ=34
+TPM2_ALG_SHA1_SZ=22
+
+## Default must be sha256
+expected_hash_len=$TPM2_ALG_SHA256_SZ
+tpm2 getrandom 8 --cphash cp.hash
+file_size=`ls -l cp.hash | awk {'print $5'}`
+test $file_size -eq $expected_hash_len
+
+## Check if a specific hash can be enforced with <halg>:
+expected_hash_len=$TPM2_ALG_SHA1_SZ
+tpm2 getrandom 8 --cphash sha1:cp.hash
+file_size=`ls -l cp.hash | awk {'print $5'}`
+test $file_size -eq $expected_hash_len
+
+## Check cpHash output for TPM2_PolicyLocality
+tpm2 startauthsession -S session.dat
+tpm2 policylocality -S session.dat -L policy.dat three --cphash cp.hash
+TPM2_CC_PolicyLocality="0000016f"
+locality="08"
+policySession=$(tpm2 sessionconfig session.dat | grep Session-Handle | \
+    awk -F ' 0x' '{print $2}')
+
+echo -ne $TPM2_CC_PolicyLocality$policySession$locality | xxd -r -p | \
+openssl dgst -sha256 -binary -out test.bin
+cmp cp.hash test.bin 2
+tpm2 flushcontext session.dat
+
+## Check cpHash output for TPM2_PolicyRestart
+tpm2 startauthsession -S session.dat
+tpm2 policyrestart -S session.dat --cphash cp.hash
+TPM2_CC_PolicyRestart="00000180"
+sessionHandle=$(tpm2 sessionconfig session.dat | grep Session-Handle | \
+    awk -F ' 0x' '{print $2}')
+
+echo -ne $TPM2_CC_PolicyRestart$sessionHandle | xxd -r -p | \
+openssl dgst -sha256 -binary -out test.bin
+cmp cp.hash test.bin 2
+tpm2 flushcontext session.dat
+
 exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/abrmd_policynvwritten.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/abrmd_policynvwritten.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/abrmd_policyor.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/abrmd_policyor.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/abrmd_policypassword.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/abrmd_policypassword.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/certify.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/certify.sh Changed

@@ -10,6 +10,14 @@
         shut_down
     fi
 }
+
+verify_signature_with_ssl() {
+# Verify the signatures with openssl
+tpm2 readpublic -Q -c certify.ctx -f pem -o certify.pem
+openssl dgst -verify certify.pem -keyform pem -sha256 \
+    -signature sig.out attest.out
+}
+
 trap cleanup EXIT
 
 start_up
@@ -18,13 +26,29 @@
 
 tpm2 clear -Q
 
-tpm2 createprimary -Q -C e -g sha256 -G rsa -c primary.ctx
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c primary.ctx -p signedpass
+
+tpm2 create -Q -g sha256 -G rsa:rsassa -u certify.pub -r certify.priv \
+    -C primary.ctx -P signedpass -p certifypass
+
+tpm2 load -Q -C primary.ctx -P signedpass -u certify.pub -r certify.priv \
+    -n certify.name -c certify.ctx
+
+tpm2 certify \
+    -c primary.ctx -P signedpass \
+    -C certify.ctx -p certifypass \
+    -g sha256 -o attest.out -f plain -s sig.out  
+
+verify_signature_with_ssl
 
-tpm2 create -Q -g sha256 -G rsa -u certify.pub -r certify.priv -C primary.ctx
+# Test with full options
 
-tpm2 load -Q -C primary.ctx -u certify.pub -r certify.priv -n certify.name \
--c certify.ctx
+tpm2 certify \
+    --certifiedkey-context primary.ctx --certifiedkey-auth signedpass \
+    --signingkey-context certify.ctx --signingkey-auth certifypass \
+    --hash-algorithm sha256 --attestation attest.out \
+    --format plain --signature sig.out
 
-tpm2 certify -Q -c primary.ctx -C certify.ctx -g sha256 -o attest.out -s sig.out
+verify_signature_with_ssl
 
 exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/create.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/create.sh Changed

@@ -104,4 +104,29 @@
 xxd -p creation.data | tr -d '\n' | \
 grep `cat pcr_data.bin | openssl dgst -sha256 -binary | xxd -p | tr -d '\n'`
 
+# Test if additional sessions can be specified
+tpm2 clear
+tpm2 createprimary -C o -c prim.ctx -Q
+tpm2 startauthsession -S audit_session.ctx --audit-session
+tpm2 startauthsession -S enc_session.ctx --hmac-session -c prim.ctx
+tpm2 create -C prim.ctx -u key.pub -r key.priv -p apple \
+ -S enc_session.ctx \
+ -S audit_session.ctx
+tpm2 flushcontext audit_session.ctx
+tpm2 flushcontext enc_session.ctx
+
+# Test public key output
+tpm2_create -C primary.ctx -u obj.pub -r obj.priv -f pem -o obj.pem
+openssl rsa -noout -text -inform PEM -in obj.pem -pubin
+
+# Test policy from hash input
+
+expected_dgst="fdb1c1e5ba81e95f2db8db6ed7627e9b01658e80df7f33220bd3638f98ad2d5f"
+tpm2 createprimary -c primary.ctx
+tpm2 create -C primary.ctx -u key.pub -r key.priv -L "$(expected_digest)"
+tpm2 load -C primary.ctx -u key.pub -r key.priv -c key.ctx
+got_digest="$(tpm2 readpublic -c key.ctx | grep "authorization policy" | cut -d ' ' -f3-)"
+test "$expected_digest" == "$got_digest"
+
+
 exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/createek.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/createek.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/createprimary.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/createprimary.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/duplicate.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/duplicate.sh Changed

@@ -5,7 +5,8 @@
 cleanup() {
     rm -f primary.ctx new_parent.prv new_parent.pub new_parent.ctx policy.dat \
     session.dat key.prv key.pub key.ctx duppriv.bin dupseed.dat key2.prv \
-    key2.pub key2.ctx sym_key_in.bin
+    key2.pub key2.ctx sym_key_in.bin cleartext.txt secret.bin decrypted.txt \
+    primary.pub rsa-priv.pem rsa.pub rsa.priv rsa.dpriv rsa.seed rsa-pub.pem rsa.sig
 
     if  "$1" != "no-shut-down" ; then
           shut_down
@@ -100,8 +101,107 @@
 -p "session:session.dat" -r dupprv.bin -s dupseed.dat
 end_duplication_session
 
+## External RSA key, wrapped for the primary key
+tpm2 readpublic -c primary.ctx -o primary.pub
+openssl genrsa -out rsa-priv.pem
+openssl rsa -in rsa-priv.pem -pubout > rsa-pub.pem
+tpm2 duplicate \
+	--tcti none \
+	-U primary.pub \
+	-G rsa \
+	-k rsa-priv.pem \
+	-u rsa.pub \
+	-r rsa.dpriv \
+	-s rsa.seed
+tpm2 import \
+	-C primary.ctx \
+	-G rsa \
+	-i rsa.dpriv \
+	-s rsa.seed \
+	-u rsa.pub \
+	-r rsa.priv
+
+# validate that TPM signatures with this imported key are acceptable to OpenSSL
+tpm2 load \
+	-C primary.ctx \
+	-c rsa.ctx \
+	-u rsa.pub \
+	-r rsa.priv
+echo foo | tpm2 sign \
+	-c rsa.ctx \
+	-o rsa.sig \
+	-f plain
+echo foo | openssl dgst \
+	-sha256 \
+	-verify rsa-pub.pem \
+	-signature rsa.sig
+
+## External RSA key, with a password authorization policy
+echo magicwords > cleartext.txt
+openssl pkeyutl \
+	-encrypt \
+	-pubin \
+	-inkey rsa-pub.pem \
+	-in cleartext.txt \
+	-out secret.bin
+
+tpm2 startauthsession -S session.dat
+tpm2 policypassword -S session.dat -L policy.dat
+
+tpm2 duplicate \
+	--tcti none \
+	-U primary.pub \
+	-G rsa \
+	-k rsa-priv.pem \
+	-u rsa.pub \
+	-r rsa.dpriv \
+	-s rsa.seed \
+	-L policy.dat \
+	-p secretpassword
+
+tpm2 import \
+	-C primary.ctx \
+	-G rsa \
+	-i rsa.dpriv \
+	-s rsa.seed \
+	-u rsa.pub \
+	-r rsa.priv
+
+# validate that TPM can decrypt messages with this imported key
+
+tpm2 load \
+	-C primary.ctx \
+	-c rsa.ctx \
+	-u rsa.pub \
+	-r rsa.priv \
+
+tpm2 startauthsession -S session.dat --policy-session
+tpm2 policypassword -S session.dat -L policy.dat
+
+cat secret.bin | tpm2 rsadecrypt \
+	-c rsa.ctx \
+	-p session:session.dat+secretpassword \
+	> decrypted.txt
+cmp cleartext.txt decrypted.txt
+
 trap - ERR
 
+## Attempt to decrypt without the password or policy
+
+cat secret.bin | tpm2 rsadecrypt \
+	-c rsa.ctx \
+	-p session:session.dat
+if  $? -eq 0 ; then
+  echo "Expected \"tpm2 rsadecrypt\" to fail without password."
+  exit 1
+fi
+cat secret.bin | tpm2 rsadecrypt \
+	-c rsa.ctx
+if  $? -eq 0 ; then
+  echo "Expected \"tpm2 rsadecrypt\" to fail without policy."
+  exit 1
+fi
+
 ## Null parent - should fail (TPM_RC_HIERARCHY)
 start_duplication_session
 tpm2 duplicate -Q -C null -c key2.ctx -G aes -i sym_key_in.bin \

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/ecc.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/ecc.sh Changed

@@ -16,6 +16,17 @@
 
 cleanup "no-shut-down"
 
+# TPM2_ECC_Parameters
+## Check cpHash output for TPM2_ECC_Parameters
+tpm2 geteccparameters ecc256 -o ecc.params --cphash cp.hash
+TPM2_CC_ECC_Parameters="00000178"
+Param_curveID="0003"
+
+echo -ne $TPM2_CC_ECC_Parameters$Param_curveID | xxd -r -p | \
+openssl dgst -sha256 -binary -out test.bin
+cmp cp.hash test.bin 2
+
+
 # TPM2_EC_Ephemeral
 ## Check if commit counter is zero on first invocation
 tpm2 ecephemeral -u pass1_ecc.q -t pass1_ecc.ctr ecc256
@@ -24,6 +35,15 @@
 tpm2 ecephemeral -u pass2_ecc.q -t pass2_ecc.ctr ecc256
 xxd -p pass2_ecc.ctr | grep 0001
 
+## Check cpHash output for TPM2_EC_Ephemeral
+tpm2 ecephemeral -u pass1_ecc.q -t pass1_ecc.ctr ecc256 --cphash cp.hash
+TPM2_CC_EC_Ephemeral="0000018e"
+Param_curveID="0003"
+
+echo -ne $TPM2_CC_EC_Ephemeral$Param_curveID | xxd -r -p | \
+openssl dgst -sha256 -binary -out test.bin
+cmp cp.hash test.bin 2
+
 # TPM2_Commit
 ## Check if commit counter in incremented after successful execution of commit
 tpm2 createprimary -C o -c prim.ctx -Q
@@ -46,12 +66,36 @@
 
 tpm2 ecdhkeygen -u ecc256ecdh.pub -o ecc256ecdh.priv -c ecdh_key.ctx
 
+## Test cpHash calculation for ecdhkeygen
+tpm2 ecdhkeygen -u ecc256ecdh.pub -o ecc256ecdh.priv -c ecdh_key.ctx --cphash cp.hash
+name="$(tpm2 readpublic -c ecdh_key.ctx | grep '^name:' | cut -d ' ' -f2)"
+
+cc="00000163"
+buffer="${cc}${name}"
+echo -n "${buffer}" | xxd -r -p -c256 | openssl dgst -sha256 -binary > expected.hash
+cmp cp.hash expected.hash 2
+
+tpm2 ecdhkeygen -u ecc256ecdh.pub -o ecc256ecdh.priv -c ecdh_key.ctx --cphash "sha384:cp.hash"
+echo -n "${buffer}" | xxd -r -p -c256 | openssl dgst -sha384 -binary > expected.hash
+cmp cp.hash expected.hash 2
+
 # TPM2_ECDH_ZGen
 ## Check if the recovered Z point matches
 tpm2 ecdhzgen -u ecc256ecdh.pub -o ecdhZgen.dat -c ecdh_key.ctx
 
 diff ecdhZgen.dat ecc256ecdh.priv
 
+## Check cpHash output for TPM2_ECDH_ZGen
+tpm2 ecdhzgen -u ecc256ecdh.pub -o ecdhZgen.dat -c ecdh_key.ctx --cphash cp.hash
+TPM2_CC_ECDH_ZGen="00000154"
+tpm2 readpublic -Q -c ecdh_key.ctx -n cp_hash_zgen_key.name
+Key_Name=$(xxd -p -c64 cp_hash_zgen_key.name)
+Param_inPoint=$(xxd -p -c64 ecc256ecdh.pub )
+
+echo -ne $TPM2_CC_ECDH_ZGen$Key_Name$Param_inPoint | xxd -r -p | \
+openssl dgst -sha256 -binary -out test.bin
+cmp cp.hash test.bin 2
+
 # TPM2_ZGen_2Phase
 ## Check if output Z points are generated using separate commit count values
 tpm2 zgen2phase -c ecdh_key.ctx --static-public ecc256ecdh.pub \
@@ -76,4 +120,20 @@
 
 trap onerror ERR
 
+# Test for cpHash with TPM2_CC_Commit
+tpm2 create -C prim.ctx -c cp_hash_commit_key.ctx -u cp_hash_commit_key.pub \
+    -r cp_hash_commit_key.priv -G ecc256:ecdaa
+
+tpm2 commit -c cp_hash_commit_key.ctx --cphash cp.hash
+
+TPM2_CC_Commit="0000018B"
+tpm2 readpublic -Q -c cp_hash_commit_key.ctx -n cp_hash_commit_key.name
+Key_Name=$(xxd -p -c64 cp_hash_commit_key.name)
+Param_P1="00040000000000000000"
+
+echo -ne $TPM2_CC_Commit$Key_Name$Param_P1 | xxd -r -p | \
+openssl dgst -sha256 -binary -out test.bin
+
+cmp cp.hash test.bin 2
+
 exit 0

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/encodeobject.sh Added

@@ -0,0 +1,57 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+start_up
+
+alg_pem_load=ecc
+pem_parent=prim
+pem_file=mykey
+Pem_persistent_parent=0x81100000
+
+cleanup() {
+
+  rm -f $file_load_key_pub $file_load_key_priv $file_load_key_name \
+  $file_load_key_ctx
+
+  tpm2 evictcontrol -Q -Co -c $Handle_parent 2>/dev/null || true
+
+  if  $(ina "$@" "keep_ctx") -ne 0 ; then
+    rm -f $file_primary_key_ctx
+  fi
+
+  if  $(ina "$@" "no-shut-down") -ne 0 ; then
+          shut_down
+  fi
+}
+trap cleanup EXIT
+
+cleanup "no-shut-down"
+
+tpm2 clear
+
+# test to check negative parent in TSS pem file
+
+tpm2 createprimary -G $alg_pem_load -C o \
+-a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|decrypt|noda" \
+-c $pem_parent.ctx
+
+tpm2 create -C $pem_parent.ctx -u $pem_file.pub -r $pem_file.priv
+
+tpm2 evictcontrol -C o -c $pem_parent.ctx $Pem_persistent_parent
+
+tpm2 encodeobject -C $Pem_persistent_parent -u $pem_file.pub \
+-r $pem_file.priv -o $pem_file.pem
+
+tpm2 load -r $pem_file.pem -c $pem_file.ctx
+
+PARENTVAL=`openssl asn1parse -in $pem_file.pem -inform pem | awk '{print $7}'`
+if egrep -q "^:-0-9a-fA-F{8}" <<< "$PARENTVAL"
+then
+  echo "Fail: Parent value is negative"
+  exit 1
+fi
+
+exit 0
+
+cleanup "no-shut-down"

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/eventlog.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/eventlog.sh Changed

@@ -1,35 +1,102 @@
 # SPDX-License-Identifier: BSD-3-Clause
 
+set -E
+shopt -s expand_aliases
+
+alias python=${PYTHON-python}
+
 yaml_validate() {
     python -c 'import yaml,sys; yaml.safe_load(sys.stdin)'
 }
 
 expect_fail() {
-    $@
+    tpm2 eventlog $@
     if  $? -eq 0 ; then
         echo "failing test case passed"
         exit 1;
     fi
 }
+
 expect_pass() {
-    $@ | yaml_validate
+    evlog=$1
+    shift
+
+    base=$(basename $evlog)
+    tpm2 eventlog $@ $evlog 1> $base.out 2> $base.err
+
+    ret=0
+
+    yaml_validate < $base.out
     if  $? -ne 0 ; then
-        echo "passing test case failed"
-        exit 1;
+        echo "YAML parsing failed"
+        ret=1
+    fi
+
+    diff $evlog.yaml $base.out
+    if  $? -ne 0 ; then
+        echo "YAML output changed"
+
+        if test "$TEST_REGENERATE_OUTPUT" = "1"
+        then
+            cp $base.out $evlog.yaml
+        else
+            ret=1
+        fi
+    fi
+
+    if test -f $evlog.warn
+    then
+        diff $evlog.warn $base.err
+        if  $? -ne 0 ; then
+            echo "WARNING output changed"
+
+            if test "$TEST_REGENERATE_OUTPUT" = "1"
+            then
+                cp $base.err $evlog.warn
+            else
+                ret=1
+            fi
+        fi
+    else
+        if test -s $base.err
+        then
+            cat $base.err
+            echo "WARNING output unexpected"
+
+            if test "$TEST_REGENERATE_OUTPUT" = "1"
+            then
+                cp $base.err $evlog.warn
+            else
+                ret=1
+            fi
+        fi
+    fi
+
+    rm $base.out $base.err
+    if test $ret != 0
+    then
+        exit $ret
     fi
 }
 
-expect_fail tpm2 eventlog
-expect_fail tpm2 eventlog foo
-expect_fail tpm2 eventlog foo bar
-expect_fail tpm2 eventlog ${srcdir}/test/integration/fixtures/event-bad.bin
-
-expect_pass tpm2 eventlog ${srcdir}/test/integration/fixtures/specid-vendordata.bin
-expect_pass tpm2 eventlog ${srcdir}/test/integration/fixtures/event.bin
-expect_pass tpm2 eventlog ${srcdir}/test/integration/fixtures/event-uefivar.bin
-expect_pass tpm2 eventlog ${srcdir}/test/integration/fixtures/event-uefiaction.bin
-expect_pass tpm2 eventlog ${srcdir}/test/integration/fixtures/event-uefiservices.bin
-expect_pass tpm2 eventlog ${srcdir}/test/integration/fixtures/event-uefi-sha1-log.bin
-expect_pass tpm2 eventlog ${srcdir}/test/integration/fixtures/event-bootorder.bin
+expect_fail
+expect_fail foo
+expect_fail foo bar
+expect_fail ${srcdir}/test/integration/fixtures/event-bad.bin
+
+expect_pass ${srcdir}/test/integration/fixtures/specid-vendordata.bin
+expect_pass ${srcdir}/test/integration/fixtures/event.bin
+expect_pass ${srcdir}/test/integration/fixtures/event-uefivar.bin
+expect_pass ${srcdir}/test/integration/fixtures/event-uefiaction.bin
+expect_pass ${srcdir}/test/integration/fixtures/event-uefiservices.bin
+expect_pass ${srcdir}/test/integration/fixtures/event-uefi-sha1-log.bin
+expect_pass ${srcdir}/test/integration/fixtures/event-bootorder.bin
+expect_pass ${srcdir}/test/integration/fixtures/event-postcode.bin
+
+# Make sure that --eventlog-version=2 works on complete TPM2 logs
+expect_pass ${srcdir}/test/integration/fixtures/event-arch-linux.bin --eventlog-version=2
+expect_pass ${srcdir}/test/integration/fixtures/event-gce-ubuntu-2104-log.bin --eventlog-version=2
+expect_pass ${srcdir}/test/integration/fixtures/event-sd-boot-fedora37.bin --eventlog-version=2
+expect_pass ${srcdir}/test/integration/fixtures/event-moklisttrusted.bin --eventlog-version=2
 
 exit $?

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/flushcontext.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/flushcontext.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/getcap.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/getcap.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/getekcertificate.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/getekcertificate.sh Changed

@@ -19,14 +19,34 @@
 # Check connectivity
 if  -z "$(curl -V 2>/dev/null)" ; then
     echo "curl is not not installed. Skipping connection check."
+    exit 077
 else
     if  "$(curl --silent --output /dev/null --write-out %{http_code} \
-    'https://ekop.intel.com/')" != '200' ; then
+    'https://ekop.intel.com/ekcertservice/WVEG2rRwkQ7m3RpXlUphgo6Y2HLxl18h6ZZkkOAdnBE%3D')" != '200' ; then
         echo 'No connection to https://ekop.intel.com/'
         exit 77
     fi
 fi
 
+# Setup retries for when EK certificate cannot be retrieved on first try
+getekcert_with_retries() {
+    trap - ERR
+    cert_done=
+    for i in 1 2 3;
+        do
+        tpm2 getekcertificate -u $1 -x -X -o $2
+        tpm2 getekcertificate -u $1 -x -X > $3
+        # Test that stdout output is the same as output to file
+        cmp $2 $3
+        if  $? == 0 ; then
+            cert_done=1
+            break
+        fi
+    done
+    trap onerror ERR
+    test $cert_done
+}
+
 # Sample RSA ek public from a real platform
 echo "013a0001000b000300b20020837197674484b3f81a90cc8d46a5d724fd52
 d76e06520b64f2a1da1b331469aa00060080004300100800000000000100
@@ -40,14 +60,10 @@
 79a8f32938dd8197e29dae839f5b4ca0f5de27c9522c23c54e1c2ce57859
 525118bd4470b18180eef78ae4267bcd" | xxd -r -p > test_rsa_ek.pub
 
-# Get ek certificate and output to file
-tpm2 getekcertificate -u test_rsa_ek.pub -x -X -o rsa_ek_cert.bin
-
-# Test that stdoutput is the same
-tpm2 getekcertificate -u test_rsa_ek.pub -x -X > stdout_rsa_ek_cert.bin
-
-# stdout file should match
-cmp rsa_ek_cert.bin stdout_rsa_ek_cert.bin
+#
+# RSA EK Certificate from ekop.intel.com
+#
+getekcert_with_retries test_rsa_ek.pub rsa_ek_cert.bin stdout_rsa_ek_cert.bin
 
 # Retrieved certificate should be valid
 tpm2 loadexternal -C e  -u test_rsa_ek.pub -c rsa_key.ctx
@@ -62,14 +78,11 @@
 002021a536c8fef7482313d7f4517f11c9f2b4cd424cbc8fe9094b895668
 51fe0853" | xxd -r -p > test_ecc_ek.pub
 
-# Get ecc certificate and output to file
-tpm2 getekcertificate -u test_ecc_ek.pub -x -X -o ecc_ek_cert.bin
-
-# Test that stdoutput is the same
-tpm2 getekcertificate -u test_ecc_ek.pub -x -X > stdout_ecc_ek_cert.bin
+#
+# ECC EK Certificate from ekop.intel.com
+#
+getekcert_with_retries test_ecc_ek.pub ecc_ek_cert.bin stdout_ecc_ek_cert.bin
 
-# stdout file should match
-cmp ecc_ek_cert.bin stdout_ecc_ek_cert.bin
 
 # Retrieved certificate should be valid
 tpm2 loadexternal -C e  -u test_ecc_ek.pub -c ecc_key.ctx
@@ -91,51 +104,33 @@
 }
 
 ## ECC only INTC certificate from NV index
-tpm2 getekcertificate -u test_ecc_ek.pub -x -X -o ecc_ek_cert.bin --raw
-
-define_ek_cert_nv_index ecc_ek_cert.bin $ECC_EK_CERT_NV_INDEX
+openssl x509 -in ecc_ek_cert.bin -out ecc_ek_cert.der -outform DER
 
-tpm2 getekcertificate -o nv_ecc_ek_cert.pem
+define_ek_cert_nv_index ecc_ek_cert.der $ECC_EK_CERT_NV_INDEX
 
-sed 's/-/+/g;s/_/\//g;s/%3D/=/g;s/^{.*certificate":"//g;s/"}$//g;' \
-ecc_ek_cert.bin | base64 --decode > ecc_test.der
+tpm2 getekcertificate -o nv_ecc_ek_cert.der
 
-openssl x509 -inform PEM -outform DER  -in nv_ecc_ek_cert.pem \
--out nv_ecc_ek_cert.der
-
-diff nv_ecc_ek_cert.der ecc_test.der
+diff nv_ecc_ek_cert.der ecc_ek_cert.der
 
 ## RSA only INTC certificate from NV index
 tpm2 nvundefine -C p $ECC_EK_CERT_NV_INDEX
 
-tpm2 getekcertificate -u test_rsa_ek.pub -x -X -o rsa_ek_cert.bin --raw
-
-define_ek_cert_nv_index rsa_ek_cert.bin $RSA_EK_CERT_NV_INDEX
+openssl x509 -in rsa_ek_cert.bin -out rsa_ek_cert.der -outform DER
 
-tpm2 getekcertificate -o nv_rsa_ek_cert.pem
+define_ek_cert_nv_index rsa_ek_cert.der $RSA_EK_CERT_NV_INDEX
 
-sed 's/-/+/g;s/_/\//g;s/%3D/=/g;s/^{.*certificate":"//g;s/"}$//g;' \
-rsa_ek_cert.bin | base64 --decode > rsa_test.der
+tpm2 getekcertificate -o nv_rsa_ek_cert.der
 
-openssl x509 -inform PEM -outform DER  -in nv_rsa_ek_cert.pem \
--out nv_rsa_ek_cert.der
+diff nv_rsa_ek_cert.der rsa_ek_cert.der
 
-diff nv_rsa_ek_cert.der rsa_test.der
+rm nv_rsa_ek_cert.der nv_ecc_ek_cert.der -f
 
 ## RSA & ECC INTC certificates from NV index
+define_ek_cert_nv_index ecc_ek_cert.der $ECC_EK_CERT_NV_INDEX
 
-define_ek_cert_nv_index ecc_ek_cert.bin $ECC_EK_CERT_NV_INDEX
-
-tpm2 getekcertificate -o nv_rsa_ek_cert.pem -o nv_ecc_ek_cert.pem
-
-openssl x509 -inform PEM -outform DER  -in nv_ecc_ek_cert.pem \
--out nv_ecc_ek_cert.der
-
-openssl x509 -inform PEM -outform DER  -in nv_rsa_ek_cert.pem \
--out nv_rsa_ek_cert.der
-
-diff nv_ecc_ek_cert.der ecc_test.der
+tpm2 getekcertificate -o nv_rsa_ek_cert.der -o nv_ecc_ek_cert.der
 
-diff nv_rsa_ek_cert.der rsa_test.der
+diff nv_rsa_ek_cert.der rsa_ek_cert.der
+diff nv_ecc_ek_cert.der ecc_ek_cert.der
 
 exit 0

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/getpolicydigest.sh Added

@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm -f policy.out test.policy
+
+    if  "$1" != "no-shut-down" ; then
+        shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+# Create a reference policy and compare
+tpm2 startauthsession -S session.ctx
+
+tpm2 policypassword -S session.ctx -L test.policy
+
+tpm2 getpolicydigest -S session.ctx -o policy.out
+
+tpm2 flushcontext session.ctx
+
+#
+# Test cpHash output
+#
+tpm2 clear
+tpm2 flushcontext -t -l -s
+tpm2 startauthsession -S session.ctx --policy-session
+
+tpm2 getpolicydigest -S session.ctx --cphash cp.hash
+
+TPM2_CC_PolicyGetDigest=00000189
+SESSION_HANDLE=$(tpm2 sessionconfig session.ctx | grep Session-Handle | \
+    awk -F ' 0x' '{print $2}')
+echo $TPM2_CC_PolicyGetDigest$SESSION_HANDLE | xxd -r -p | \
+    openssl dgst -sha256 -binary -out test.bin
+cmp cp.hash test.bin 2
+ if  $? != 0 ; then
+    echo "cpHash doesn't match calculated value"
+    exit 1
+ fi
+
+tpm2 flushcontext session.ctx
+
+exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/getrandom.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/getrandom.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/gettime.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/gettime.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/import.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/import.sh Changed

@@ -4,12 +4,13 @@
 
 cleanup() {
     rm -f import_key.ctx import_key.name import_key.priv import_key.pub \
-    parent.ctx plain.dec.ssl  plain.enc plain.txt sym.key import_rsa_key.pub \
-    import_rsa_key.priv import_rsa_key.ctx import_rsa_key.name private.pem \
+    parent.ctx plain.dec.ssl  plain.enc plain.txt sym.key import_rsa_key*.pub \
+    import_rsa_key*.priv import_rsa_key.ctx import_rsa_key.name private.pem \
     public.pem plain.rsa.enc plain.rsa.dec public.pem data.in.raw \
     data.in.digest data.out.signed ticket.out ecc.pub ecc.priv ecc.name \
     ecc.ctx private.ecc.pem public.ecc.pem passfile aes.key policy.dat \
-    aes.priv aes.pub
+    aes.priv aes.pub sealdata seal.pub seal.priv seal.ctx unsealdata hmackey \
+    hmac.pub hmac.priv hmac.ctx hmac-tpm2.out hmac-ossl.out
 
     if  "$1" != "no-shut-down" ; then
           shut_down
@@ -66,11 +67,20 @@
     tpm2 import -Q -G rsa -g "$name_alg" -i private.pem -C $1 \
     -u import_rsa_key.pub -r import_rsa_key.priv
 
+    # test in import with scheme and discard
+    tpm2 import -G rsa:rsassa-sha256 -g "$name_alg" -i private.pem -C $1 \
+    -u import_rsa_key2.pub -r import_rsa_key2.priv | grep -q 'rsassa'
+
+    # test import with short symmetric qualifier and discard
+    tpm2 import -G rsa:aes -g "$name_alg" -i private.pem -C $1 \
+    -u import_rsa_key2.pub -r import_rsa_key2.priv -a 'userwithauth|restricted|decrypt' \
+    | grep -q cfb
+
     tpm2 load -Q -C $1 -u import_rsa_key.pub -r import_rsa_key.priv \
     -n import_rsa_key.name -c import_rsa_key.ctx
 
     openssl rsa -in private.pem -out public.pem -outform PEM -pubout
-    openssl rsautl -encrypt -inkey public.pem -pubin -in plain.txt \
+    openssl pkeyutl -encrypt -inkey public.pem -pubin -in plain.txt \
     -out plain.rsa.enc
 
     tpm2 rsadecrypt -c import_rsa_key.ctx -o plain.rsa.dec plain.rsa.enc
@@ -117,8 +127,13 @@
     shasum -a 256 data.in.raw | awk '{ print "000000 " $1 }' | xxd -r -c 32 > \
     data.in.digest
 
-    tpm2 import -Q -G ecc -g "$name_alg" -i private.ecc.pem -C $1 -u ecc.pub \
-    -r ecc.priv
+    # test import with scheme
+    tpm2 import -G ecc:ecdsa-sha256 -g "$name_alg" -i private.ecc.pem -C $1 -u ecc.pub \
+    -r ecc.priv | grep -q 'ecdsa'
+
+    # test import with symmetric and discard
+    tpm2 import -G ecc:aes128cfb -g "$name_alg" -i private.ecc.pem -C $1 -u ecc2.pub \
+    -r ecc2.priv -a 'userwithauth|restricted|decrypt' | grep -q 'cfb'
 
     tpm2 load -Q -C $1 -u ecc.pub -r ecc.priv -n ecc.name -c ecc.ctx
 
@@ -167,6 +182,26 @@
         trap onerror ERR
 }
 
+run_keyedhash_seal_import_test() {
+
+    dd if=/dev/urandom of=sealdata bs=128 count=1
+    tpm2 import -C "$1" -G keyedhash -i sealdata -u seal.pub -r seal.priv
+    tpm2 load -C "$1" -u seal.pub -r seal.priv -c seal.ctx
+    tpm2 unseal -c seal.ctx -o unsealdata
+    cmp sealdata unsealdata
+}
+
+run_keyedhash_hmac_import_test() {
+
+    dd if=/dev/urandom of=hmackey bs=64 count=1
+    hexkey=$(xxd -p -c 256 < hmackey)
+    tpm2 import -C "$1" -G hmac -i hmackey -u hmac.pub -r hmac.priv
+    tpm2 load -C "$1" -u hmac.pub -r hmac.priv -c hmac.ctx
+    echo -n "test data" | tpm2 hmac -g sha256 -c hmac.ctx -o hmac-tpm2.out
+    echo -n "test data" | openssl dgst -sha256 -mac HMAC -macopt hexkey:"$hexkey" -binary -out hmac-ossl.out
+    cmp hmac-tpm2.out hmac-ossl.out
+}
+
 run_test() {
 
     cleanup "no-shut-down"
@@ -189,6 +224,9 @@
     run_rsa_import_test parent.ctx 2048
 
     run_ecc_import_test parent.ctx prime256v1
+
+    run_keyedhash_seal_import_test parent.ctx
+    run_keyedhash_hmac_import_test parent.ctx
 }
 
 #
@@ -231,4 +269,16 @@
 
 run_aes_policy_import_test "parent.ctx"
 
+#
+# Test policy from hash
+#
+openssl genrsa -out private.pem 1024
+
+expected_dgst="fdb1c1e5ba81e95f2db8db6ed7627e9b01658e80df7f33220bd3638f98ad2d5f"
+tpm2 import -G rsa -g sha256 -i private.pem -C parent.ctx \
+    -u import_rsa_key.pub -r import_rsa_key.priv -L "$expected_digest"
+tpm2 load -C parent.ctx -u import_rsa_key.pub -r import_rsa_key.priv -c key.ctx
+got_digest="$(tpm2 readpublic -c key.ctx | grep "authorization policy" | cut -d ' ' -f3-)"
+test "$expected_digest" == "$got_digest"
+
 exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/load.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/load.sh Changed

@@ -11,6 +11,10 @@
 
 alg_load=sha1
 
+alg_pem_load=ecc
+pem_parent=prim
+pem_file=mykey
+
 file_primary_key_ctx=context.p_"$alg_primary_obj"_"$alg_primary_key"
 file_load_key_pub=opu_"$alg_create_obj"_"$alg_create_key"
 file_load_key_priv=opr_"$alg_create_obj"_"$alg_create_key"
@@ -22,6 +26,7 @@
 
 Handle_parent=0x81010018
 Handle_ek_load=0x81010017
+Pem_persistent_parent=0x81100000
 
 cleanup() {
 
@@ -67,4 +72,36 @@
 tpm2 load -Q -C $Handle_parent -u $file_load_key_pub -r $file_load_key_priv \
 -n $file_load_key_name -c $file_load_key_ctx
 
+cleanup "no-shut-down"
+
+#####pem test - persistent parent
+
+tpm2 createprimary -G $alg_pem_load -C o \
+-a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|decrypt|noda" \
+-c $pem_parent.ctx
+
+tpm2 create -C $pem_parent.ctx -u $pem_file.pub -r $pem_file.priv
+
+tpm2 evictcontrol -C o -c $pem_parent.ctx $Pem_persistent_parent
+
+tpm2 encodeobject -C $Pem_persistent_parent -u $pem_file.pub \
+-r $pem_file.priv -o $pem_file.pem
+
+tpm2 load -r $pem_file.pem -c $pem_file.ctx
+
+cleanup "no-shut-down"
+
+#####pem test - non-persistent parent
+
+tpm2 createprimary -G $alg_pem_load -C o \
+-a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|decrypt|noda" \
+-c $pem_parent.ctx
+
+tpm2 create -C $pem_parent.ctx -u $pem_file.pub -r $pem_file.priv
+
+tpm2 encodeobject -C $pem_parent.ctx -u $pem_file.pub -r $pem_file.priv \
+-o $pem_file.pem
+
+tpm2 load -r $pem_file.pem -c $pem_file.ctx
+
 exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/loadexternal.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/loadexternal.sh Changed

@@ -16,6 +16,9 @@
 "$alg_primary_key"-"$alg_create_obj"_"$alg_create_key"
 file_loadexternal_output=loadexternal_"$file_loadexternal_key_ctx"
 
+tss_privkey=tss_pk
+tss_prim=prim
+
 Handle_parent=0x81010019
 
 cleanup() {
@@ -24,7 +27,7 @@
   $file_loadexternal_key_ctx $file_loadexternal_output private.pem public.pem \
   plain.txt plain.rsa.dec key.ctx public.ecc.pem private.ecc.pem \
   data.in.digest data.out.signed ticket.out name.bin stdout.yaml passfile \
-  private.pem
+  private.pem key.priv key.pub
 
   if  $(ina "$@" "keep_handle") -ne 0 ; then
     tpm2 evictcontrol -Q -Co -c $Handle_parent 2>/dev/null || true
@@ -84,7 +87,7 @@
     openssl rsa -in private.pem -out public.pem -outform PEM -pubout
 
     echo "hello world" > plain.txt
-    openssl rsautl -encrypt -inkey public.pem -pubin -in plain.txt \
+    openssl pkeyutl -encrypt -inkey public.pem -pubin -in plain.txt \
     -out plain.rsa.enc
 
     tpm2 loadexternal -G rsa -C n -p foo -r private.pem -c key.ctx
@@ -98,7 +101,7 @@
 
     tpm2 rsaencrypt -c key.ctx plain.txt -o plain.rsa.enc
 
-    openssl rsautl -decrypt -inkey private.pem -in plain.rsa.enc \
+    openssl pkeyutl -decrypt -inkey private.pem -in plain.rsa.enc \
     -out plain.rsa.dec
 
     diff plain.txt plain.rsa.dec
@@ -235,5 +238,44 @@
 echo -n "mypassword" > "passfile"
 run_rsa_passin_test "private.pem" "stdin" "passfile"
 
+#
+# Test cpHash output
+#
+tpm2 createprimary -C o -c prim.ctx -Q
+tpm2 create -C prim.ctx -u key.pub -r key.priv -Q
+tpm2 loadexternal -C n -u key.pub -c key.ctx --cphash cp.hash
+TPM2_CC_Loadexternal="00000167"
+External_priv_dat="0000"
+External_pub_dat=$(xxd -p key.pub | tr -d '\n')
+Hierarchy="40000007"
+echo -ne $TPM2_CC_Loadexternal$External_priv_dat$External_pub_dat$Hierarchy | \
+    xxd -r -p | openssl dgst -sha256 -binary -out test.bin
+cmp cp.hash test.bin 2
+if  $? != 0 ; then
+	echo "cpHash doesn't match calculated value"
+    exit 1
+fi
+
+#
+# TSS Privkey
+#
+tpm2 createprimary -G rsa -C o \
+-a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|decrypt|noda" \
+-c $tss_prim.ctx
+
+tpm2 create -C $tss_prim.ctx -u $tss_privkey.pub -r $tss_privkey.priv
+
+tpm2 encodeobject -C $tss_prim.ctx -u $tss_privkey.pub -r $tss_privkey.priv -o $tss_privkey.pem
+
+tpm2 loadexternal -r $tss_privkey.pem -c $tss_privkey.ctx
+
+#
+# Test Policy from A Hash Input
+#
+openssl genrsa -out "private.pem" 1024
 
+expected_dgst="fdb1c1e5ba81e95f2db8db6ed7627e9b01658e80df7f33220bd3638f98ad2d5f"
+tpm2 loadexternal -Q -G rsa -r private.pem -c key.ctx -L "$expected_digest"
+got_digest="$(tpm2 readpublic -c key.ctx | grep "authorization policy" | cut -d ' ' -f3-)"
+test "$expected_digest" == "$got_digest"
 exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/nv.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/nv.sh Changed

@@ -286,4 +286,110 @@
 	exit 1
 fi
 
+# Test nvextend and nvdefine with aux sessions
+tpm2 clear
+
+tpm2 createprimary -C o -c prim.ctx
+tpm2 startauthsession -S enc_session.ctx --hmac-session -c prim.ctx
+
+tpm2 changeauth -c o owner
+tpm2 nvdefine -C o -P owner -a "nt=extend|ownerread|policywrite|ownerwrite" \
+$nv_test_index -p nvindexauth -S enc_session.ctx
+
+echo "foo" | tpm2 nvextend -C o -P owner -i- $nv_test_index -S enc_session.ctx
+
+tpm2 flushcontext enc_session.ctx
+rm enc_session.ctx
+rm prim.ctx
+
+check=$(tpm2 nvread -C o -P owner $nv_test_index | xxd -p -c 64 | sed s/'^0*'//)
+expected="1c8457de84bb43c18d5e1d75c43e393bdaa7bca8d25967eedd580c912db65e3e"
+if  "$check" != "$expected" ; then
+	echo "Expected setbits read value of \"$expected\", got \"$check\""
+	exit 1
+fi
+
+#
+# Test for TPM2_NV_ReadPublic cpHash output
+#
+tpm2 clear
+TPM2_CC_NV_ReadPublic="00000169"
+tpm2 nvdefine 1
+NV_INDEX_NAME=$(tpm2 nvreadpublic 1| grep name | awk {'print $2'})
+tpm2 nvundefine 1
+tpm2 nvreadpublic 1 --cphash cp.hash --tcti=none -n $NV_INDEX_NAME
+echo -ne $TPM2_CC_NV_ReadPublic$NV_INDEX_NAME | xxd -r -p | openssl dgst -sha256 -binary -out test.bin
+cmp cp.hash test.bin 2
+if  $? != 0 ; then
+	echo "cpHash doesn't match calculated value"
+	exit 1
+fi
+tpm2 clear
+
+# Test human readable NV counter
+tpm2 nvdefine -C o -a "nt=counter|ownerread|ownerwrite" $nv_test_index
+tpm2 nvincrement -C o $nv_test_index
+check=$(tpm2 nvread -C o $nv_test_index --print-yaml)
+expected="counter: 1"
+if  "$check" != "$expected" ; then
+    echo "Expected human readable counter value of \"$expected\", got \"$check\""
+    exit 1
+fi
+tpm2 nvundefine -C o $nv_test_index
+
+# Test human readable NV bits
+tpm2 nvdefine -C o -a "nt=bits|ownerread|ownerwrite" $nv_test_index
+tpm2 nvsetbits -C o --bits 0x4000000000000001  $nv_test_index
+check=$(tpm2 nvread -C o $nv_test_index --print-yaml)
+expected="bits:  0, 62 "
+if  "$check" != "$expected" ; then
+    echo "Expected human readable bits value of \"$expected\", got \"$check\""
+    exit 1
+fi
+tpm2 nvundefine -C o $nv_test_index
+
+# Test human readable NV extend
+tpm2 nvdefine -C o -g sha256 -a "nt=extend|ownerread|ownerwrite" $nv_test_index
+echo -n "falafel" | tpm2 nvextend -C o -i -  $nv_test_index
+check=$(tpm2 nvread -C o $nv_test_index --print-yaml)
+expected="sha256: 0xC5728723A3BB57916DB9E5DEA901094C63A960598A8A29FE277AEE5F6A8EE7CE"
+if  "$check" != "$expected" ; then
+    echo "Expected human readable extended value of \"$expected\", got \"$check\""
+    exit 1
+fi
+tpm2 nvundefine -C o $nv_test_index
+
+# Test human readable NV pinfail
+tpm2 nvdefine -C o -g sha256 -a "nt=pinfail|ownerread|ownerwrite|no_da" $nv_test_index
+echo -n "000004D20000162E" | xxd -r -p | tpm2 nvwrite -C o -i - $nv_test_index
+check=$(tpm2 nvread -C o $nv_test_index --print-yaml)
+expected=$(echo -e "pinfail:\n  pinCount: 1234\n  pinLimit: 5678")
+if  "$check" != "$expected" ; then
+    echo "Expected human readable extended value of \"$expected\", got \"$check\""
+    exit 1
+fi
+tpm2 nvundefine -C o $nv_test_index
+
+# Test human readable NV pinpass
+tpm2 nvdefine -C o -g sha256 -a "nt=pinpass|ownerread|ownerwrite|no_da" $nv_test_index
+echo -n "000004D20000162E" | xxd -r -p | tpm2 nvwrite -C o -i - $nv_test_index
+check=$(tpm2 nvread -C o $nv_test_index --print-yaml)
+expected=$(echo -e "pinpass:\n  pinCount: 1234\n  pinLimit: 5678")
+if  "$check" != "$expected" ; then
+    echo "Expected human readable extended value of \"$expected\", got \"$check\""
+    exit 1
+fi
+tpm2 nvundefine -C o $nv_test_index
+
+# Test human readable NV ordinary
+tpm2 nvdefine -C o -g sha256 -s 4 -a "ownerread|ownerwrite" $nv_test_index
+echo -n "00010203" | xxd -r -p | tpm2 nvwrite -C o -i - $nv_test_index
+check=$(tpm2 nvread -C o $nv_test_index --print-yaml)
+expected="data: 00010203"
+if  "$check" != "$expected" ; then
+    echo "Expected human readable extended value of \"$expected\", got \"$check\""
+    exit 1
+fi
+tpm2 nvundefine -C o $nv_test_index
+
 exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/pcrallocate.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/pcrallocate.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/pcrevent.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/pcrevent.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/pcrlist.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/pcrlist.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/pcrreset.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/pcrreset.sh Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/pcrs_format.sh Added

@@ -0,0 +1,61 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+# shellcheck disable=SC1091
+source helpers.sh
+
+cleanup() {
+    rm -f ek.ctx ak.ctx nonce.bin \
+      quote.pcr quote.pcr.serialized quote.pcr.values \
+      pcr.read, pcr.read.serialized, pcr.read.values
+     "$1" = "no-shut-down"  || shut_down
+}
+
+fail() {
+  echo "$*" > /dev/stderr
+  exit 1
+}
+
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+# Generate artifacts necessary to make a quote
+tpm2 createek -G ecc -c ek.ctx
+tpm2 createak -C ek.ctx -c ak.ctx -G ecc -g sha256 -s ecdsa
+tpm2 getrandom -o nonce.bin 20
+
+readonly pcrs_selection="sha1:15,16,22+sha256:15,16,22"
+tpm2 quote -c ak.ctx -l $pcrs_selection -q nonce.bin -m /dev/null -s /dev/null \
+  -g sha256 -o quote.pcr
+
+tpm2 quote -c ak.ctx -l $pcrs_selection -q nonce.bin -m /dev/null -s /dev/null \
+  -g sha256 -o quote.pcr.serialized -F serialized
+
+tpm2 quote -c ak.ctx -l $pcrs_selection -q nonce.bin -m /dev/null -s /dev/null \
+  -g sha256 -o quote.pcr.values -F values
+
+tpm2 pcrread $pcrs_selection -o pcr.read
+tpm2 pcrread $pcrs_selection -o pcr.read.serialized -F serialized
+tpm2 pcrread $pcrs_selection -o pcr.read.values -F values
+
+diff quote.pcr quote.pcr.serialized >& /dev/null ||
+  fail "default pcrs output format of tpm2 quote is expected to be 'serialized'"
+
+diff quote.pcr.serialized quote.pcr.values >& /dev/null &&
+  fail "pcrs output in 'serialized' format must be different from that" \
+    "in 'values' format for tpm2 quote"
+
+diff quote.pcr.serialized pcr.read.serialized >& /dev/null ||
+  fail "pcrs output in 'serialized' format of tpm2 quote and tpm2 pcrread" \
+    "must be identical"
+
+diff quote.pcr.values pcr.read.values >& /dev/null ||
+  fail "pcrs output in 'values' format of tpm2 quote and tpm2 pcrread" \
+    "must be identical"
+
+diff pcr.read pcr.read.values >& /dev/null ||
+  fail "default pcrs output format of tpm2 pcrread is expected to be 'values'"
+
+exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/print.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/print.sh Changed

@@ -11,10 +11,14 @@
 quote_file=quote.bin
 print_file=quote.yaml
 
+pem_file=tsskeypriv
+pem_pub=public_key
+tss_prim=prim
+
 cleanup() {
     rm -f $ak_name_file $ak_pubkey_file \
           $quote_file $print_file $ak_ctx \
-          tpmt_public.ak
+          tpmt_public.ak ${tss_prim}\.*
 
     if  "$1" != "no-shut-down" ; then
        shut_down
@@ -41,6 +45,9 @@
 tpm2 print -t TPMT_PUBLIC tpmt_public.ak > $print_file
 yaml_verify $print_file
 
+tpm2 print -t TPMT_PUBLIC -f pem tpmt_public.ak > $print_file
+openssl rsa -noout -text -inform PEM -in $print_file -pubin
+
 # Take PCR quote
 tpm2 quote -Q -c $ak_ctx -l "sha256:0,2,4,9,10,11,12,17" -q "0f8beb45ac" \
 -m $quote_file
@@ -90,4 +97,26 @@
   exit 1
 fi
 
+# TSS Privkey
+tpm2 createprimary -G rsa -C o \
+-a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|decrypt|noda" \
+-c $tss_prim.ctx
+
+tpm2 create -C $tss_prim.ctx -u $pem_file.pub -r $pem_file.priv
+
+tpm2 encodeobject -C $tss_prim.ctx -u $pem_file.pub -r $pem_file.priv \
+-o $pem_file.pem
+
+tpm2 print -t TSSPRIVKEY_OBJ $pem_file.pem
+
+tpm2 print -t TSSPRIVKEY_OBJ -f pem $pem_file.pem > $pem_pub.pem
+
+openssl rsa -pubin -in $pem_pub.pem -text
+
+tpm2 evictcontrol -c ${tss_prim}.ctx -o ${tss2_prim}.tr
+tpm2 readpublic -n ${tss_prim}.name
+name="$(tpm2 print -t ESYS_TR ${tss2_prim}.tr | grep 'name:' | cut -d' ' -f2-)"
+expected_name="$(xxd -c256 -p ${tss_prim}.name)"
+test "${name}" == "${expected_name}"
+
 exit 0

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/readclock.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/readclock.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/rsadecrypt.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/rsadecrypt.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/send.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/send.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/sessionaudit.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/sessionaudit.sh Changed

@@ -18,11 +18,10 @@
 
 cleanup "no-shutdown"
 
-tpm2 clear
-
 #
 # Get audit digest for a TPM command TPM2_GetRandom using and audit session
 #
+tpm2 clear
 
 tpm2 createprimary -Q -C e -c prim.ctx
 
@@ -36,6 +35,407 @@
 tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
 -S session.ctx
 
+tpm2 flushcontext session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest for a TPM command TPM2_CC_Create in an audit session
+#
+tpm2 clear
+
+tpm2 createprimary -Q -C e -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 create -Q -C prim.ctx -u key.pub -r key.priv --cphash cp.hash \
+--rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest for a TPM command TPM2_CC_Create in an audit session
+#
+tpm2 clear
+
+tpm2 createprimary -Q -C e -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 createprimary -C o -c prim.ctx -G rsa
+tpm2 readpublic -c prim.ctx -o prim.pub
+tpm2 create -C prim.ctx -u key.pub -r key.priv -c key.ctx
+tpm2 readpublic -c key.ctx -n key.name
+echo "plaintext" > plain.txt
+tpm2 makecredential -u prim.pub  -s plain.txt -n `xxd -p -c 34 key.name` \
+-o cred.secret
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 activatecredential -c key.ctx -C prim.ctx -i cred.secret \
+-o act_cred.secret -S session.ctx --cphash cp.hash --rphash rp.hash
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest for a TPM command TPM2_CC_Certify in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c primary.ctx
+
+tpm2 create -Q -C primary.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 create -Q -g sha256 -G rsa -u certify.pub -r certify.priv -C primary.ctx
+
+tpm2 load -Q -C primary.ctx -u certify.pub -r certify.priv -n certify.name \
+-c certify.ctx
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 certify -Q -c primary.ctx -C certify.ctx -g sha256 -o attest.out -s sig.out \
+--cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest for a TPM command TPM2_CC_CertifyCreation in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx \
+-d create.dig -t create.ticket
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 create -G rsa -u rsa.pub -r rsa.priv -C prim.ctx -c certsigningkey.ctx
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 certifycreation -C certsigningkey.ctx -c prim.ctx -d create.dig \
+-t create.ticket -g sha256 -f plain -s rsassa \
+--cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_HierarchyChangeauth in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx \
+-d create.dig -t create.ticket
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 changeauth -c o ownerpassword --cphash cp.hash --rphash rp.hash \
+-S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_ObjectChangeauth in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx \
+-d create.dig -t create.ticket
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 create -Q -C prim.ctx -p foo -u key.pub -r key.priv -c key.ctx
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 changeauth -C prim.ctx -p foo -c key.ctx -r new.priv bar \
+--cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_ChangeEPS in an audit session
+#
+tpm2 clear -Q
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 changeeps --cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_ChangePPS in an audit session
+#
+tpm2 clear -Q
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 changepps --cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_NV_Define in an audit session
+#
+tpm2 clear -Q
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 nvdefine 0x1500016 -C o -s 32 -a "ownerread|ownerwrite" \
+--cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_NV_Extend in an audit session
+#
+tpm2 clear -Q
+
+tpm2 nvdefine -C o -a "nt=extend|ownerread|policywrite|ownerwrite|writedefine" 1
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+echo 'my data' | tpm2 nvextend -C o -i- 1 -S session.ctx \
+--cphash cp.hash --rphash rp.hash
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+
+#
+# Get audit digest: TPM command TPM2_CC_Unseal in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+echo "plaintext" | \
+tpm2 create -C prim.ctx -c key.ctx -u key.pub -r key.priv -i-
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 unseal -c key.ctx --cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_nvsetbits in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+echo "plaintext" | \
+tpm2 create -C prim.ctx -c key.ctx -u key.pub -r key.priv -i-
+
+tpm2 nvdefine 1 -a "authwrite|ownerread|nt=bits"
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 nvsetbits 1 -i 1 --cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_NVRead in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 nvdefine 1 -a "authwrite|ownerread|ownerwrite" -s 32
+echo "foo" | tpm2 nvwrite -i- 1 -C o
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 nvread 1 -C o -s 3 --cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+tpm2 flushcontext session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_NVWrite in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 nvdefine 1 -a "authwrite|ownerread|ownerwrite" -s 32
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+echo "foo" | \
+tpm2 nvwrite -i- 1 -C o --cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+tpm2 flushcontext session.ctx
+
 dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
 dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
 dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
@@ -44,4 +444,256 @@
 <( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
 <( tail -c 32 att.data )
 
+#
+# Get audit digest: TPM command TPM2_CC_NV_Certify in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -C o -c primary.ctx -Q
+
+tpm2 create -G rsa -u signing_key.pub -r signing_key.priv -C primary.ctx \
+-c signing_key.ctx -Q
+
+tpm2 readpublic -c signing_key.ctx -f pem -o sslpub.pem -Q
+
+tpm2 nvdefine -s 32 -C o -a "ownerread|ownerwrite|authread|authwrite" 1
+
+dd if=/dev/urandom bs=1 count=32 status=none| tpm2 nvwrite 1 -i-
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 nvcertify -C signing_key.ctx -g sha256 -f plain -s rsassa \
+-o signature.bin --attestation attestation.bin --size 32 1 -c o \
+--cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+tpm2 flushcontext session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_NV_Increment in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 nvdefine 1 -a "nt=counter|ownerread|authwrite"
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 nvincrement 1 --cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+tpm2 flushcontext session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_NV_WriteLock in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 nvdefine 1 -C o -s 32 -a "authread|authwrite|writedefine"
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 nvwritelock 1 -C 0x01000001 --cphash cp.hash --rphash rp.hash \
+-S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+tpm2 flushcontext session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_NV_GlobalWriteLock in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 nvdefine 1 -C o -s 32 -a "authread|authwrite|globallock"
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 nvwritelock --global -C o --cphash cp.hash --rphash rp.hash \
+-S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+tpm2 flushcontext session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_NV_ReadLock in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 nvdefine 1 -C o -s 32 -a "authread|authwrite|read_stclear"
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 nvreadlock 1 --cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+tpm2 flushcontext session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_NV_Undefine in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 nvdefine 1 -C o -s 32 -a "authread|authwrite|read_stclear"
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 nvundefine 1 --cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+tpm2 flushcontext session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_NV_UndefineSpaceSpecail in an
+# audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 startauthsession -S special_session.ctx --policy-session
+tpm2 policycommandcode -S special_session.ctx TPM2_CC_NV_UndefineSpaceSpecial \
+-L policy.digest
+
+tpm2 nvdefine 1 -C p -s 32 -a "authread|authwrite|policydelete|platformcreate" \
+-L policy.digest
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 nvundefine 1 --cphash cp.hash --rphash rp.hash -S special_session.ctx \
+-S session.ctx
+
+tpm2 flushcontext special_session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+tpm2 flushcontext session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# Get audit digest: TPM command TPM2_CC_NV_ReadLock in an audit session
+#
+tpm2 clear -Q
+
+tpm2 createprimary -Q -C e -g sha256 -G rsa -c prim.ctx
+
+tpm2 create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
+-r signing_key.priv
+
+tpm2 nvdefine 1 -C o -s 32 -a "authread|authwrite|read_stclear"
+
+tpm2 startauthsession -S session.ctx --audit-session
+
+tpm2 nvreadpublic 1 --cphash cp.hash --rphash rp.hash -S session.ctx
+
+tpm2 getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
+-S session.ctx
+
+tpm2 flushcontext session.ctx
+
+dd if=/dev/zero bs=1 count=32 status=none of=zero.bin
+dd if=cp.hash skip=2 bs=1 count=32 status=none of=cphash.bin
+dd if=rp.hash skip=2 bs=1 count=32 status=none of=rphash.bin
+
+diff \
+<( cat zero.bin cphash.bin rphash.bin | openssl dgst -sha256 -binary ) \
+<( tail -c 32 att.data )
+
+#
+# End
+#
 exit 0

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/sessionconfig.sh Added

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/symlink.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/symlink.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/testparms.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/testparms.sh Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/integration/tests/unseal.sh -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/integration/tests/unseal.sh Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/scripts Added

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/scripts/echo_tcti.py Added

@@ -0,0 +1,89 @@
+#!/usr/bin/env python
+
+#
+# This TCTI is designed to use with the subprocess TCTI and echo the contents
+# of arg1, formatted as a hex string, as a response to a single TPM command.
+#
+# Example"
+# ./tools/tpm2 getcap --tcti='cmd:./test/scripts/echo_tcti.py 8001000000170000000001000001000000000100000003' -i vendor
+# 0000000100000003
+#
+
+import binascii
+import codecs
+import io
+import sys
+
+
+def from_bytes(b):
+    # python2 and 3 compat int.from_bytes(byte_order='big')
+    return int(codecs.encode(b, "hex"), 16)
+
+
+class TPMCommand(object):
+    def __init__(self, data):
+        self._data = data
+
+    @property
+    def size(self, data_only=False):
+        x = from_bytes(self._data2:6)
+        return x if data_only == False else x - 10
+
+    @property
+    def tag(self):
+        return from_bytes(self._data0:2)
+
+    @property
+    def cc(self):
+        return from_bytes(self._data6:10)
+
+    @property
+    def data(self):
+        return self._data10:
+
+    @property
+    def header(self):
+        return self._data:10
+
+
+def read_command(stdin):
+    # TPM Command Header
+    # TAG  UINT16 0:2
+    # SIZE UINT32 2:6
+    # CC   UINT32 6:10
+    # DATA
+    header = stdin.read(10)
+    # Check for EOF
+    if len(header) == 0:
+        return None
+    elif len(header) < 10:
+        raise RuntimeError("Length of header invalid, got: %u" % len(header))
+    size = from_bytes(header2:6)
+    data = stdin.read(size - 10)
+    return TPMCommand(header + data)
+
+
+def write_response(data):
+    with io.open(sys.stdout.fileno(), "wb", closefd=False) as stdout:
+        bdata = binascii.unhexlify(data)
+        stdout.write(bdata)
+        stdout.flush()
+
+
+def main():
+
+    if len(sys.argv) < 2:
+        sys.stderr.write(
+            "Expected one argument of a hex string to use as a TPM response buffer.\n"
+        )
+        sys.exit(1)
+
+    with io.open(sys.stdin.fileno(), "rb", closefd=False) as stdin:
+        c = read_command(stdin)
+        if c is None:
+            sys.exit
+        write_response(sys.argv1)
+
+
+if __name__ == "__main__":
+    main()

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/unit/test_object.c Added

@@ -0,0 +1,64 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+
+#include <setjmp.h>
+#include <cmocka.h>
+#include <tss2/tss2_mu.h>
+#include "object.h"
+#include "log.h"
+
+#define NEGATIVE_PARENT -1
+
+tool_rc tpm2_util_object_fetch_tssprivkey_from_file(const char *objectstr,
+    BIO **input_bio, TSSPRIVKEY_OBJ **tpk) {
+
+    UNUSED(objectstr);
+    UNUSED(input_bio);
+    /*
+     * Create a blob and copy over to tpk such that tpk->parent is negative
+     */
+    TSSPRIVKEY_OBJ *tpk_internal = TSSPRIVKEY_OBJ_new();
+    tpk_internal->type = OBJ_txt2obj(OID_loadableKey, 1);
+    tpk_internal->emptyAuth = true;
+
+    int returnval = ASN1_INTEGER_set(tpk_internal->parent, NEGATIVE_PARENT);
+    if (returnval != 1) {
+        /**
+         * Unable to set parent required for testing
+         */
+        LOG_ERR("Unable to set ASN1Integer parent");
+        return tool_rc_general_error;
+    }
+
+    (*tpk) = tpk_internal;
+    return tool_rc_success;
+}
+
+static void test_tpm2_util_object_fetch_parent_from_tpk(void **state) {
+
+    UNUSED(state);
+    uint64_t val;
+
+    tool_rc rc = tpm2_util_object_fetch_parent_from_tpk("", &val);
+
+    assert_int_equal(rc, tool_rc_success);
+}
+
+/* link required symbol, but tpm2_tool.c declares it AND main, which
+ * we have a main below for cmocka tests.
+ */
+bool output_enabled = true;
+
+int main(int argc, char* argv) {
+    (void) argc;
+    (void) argv;
+
+    const struct CMUnitTest tests = {
+        cmocka_unit_test(test_tpm2_util_object_fetch_parent_from_tpk)
+    };
+
+    return cmocka_run_group_tests(tests, NULL, NULL);
+}

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/unit/test_tpm2_eventlog.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/unit/test_tpm2_eventlog.c Changed

@@ -133,11 +133,12 @@
     return mock_type(bool);
 }
 static bool test_event2_callback(TCG_EVENT2 const *event, UINT32 type,
-                                 void *data) {
+                                 void *data, uint32_t eventlog_version) {
 
     (void)event;
     (void)type;
     (void)data;
+    (void)eventlog_version;
 
     return mock_type(bool);
 }
@@ -192,7 +193,7 @@
 
     assert_false(parse_event2(eventhdr, sizeof(buf), &size_event, &size_digest));
 }
-static void test_foreach_event2(void **state){
+static void test_foreach_event2_version1(void **state){
 
     (void)state;
     char bufsizeof(TCG_EVENT_HEADER2) + TCG_DIGEST2_SHA1_SIZE + sizeof(TCG_EVENT2) + 6 = { 0, };
@@ -212,6 +213,31 @@
         .digest2_cb = foreach_digest2_test_callback,
         .event2_cb = test_event2_callback,
         .event2hdr_cb = test_event2hdr_callback,
+        .eventlog_version = 1,
+    };
+    assert_true(foreach_event2(&ctx, eventhdr, sizeof(buf)));
+}
+static void test_foreach_event2_version2(void **state){
+
+    (void)state;
+    char bufsizeof(TCG_EVENT_HEADER2) + TCG_DIGEST2_SHA1_SIZE + sizeof(TCG_EVENT2) + 6 = { 0, };
+    TCG_EVENT_HEADER2 *eventhdr = (TCG_EVENT_HEADER2*)buf;
+    TCG_DIGEST2 *digest = eventhdr->Digests;
+    TCG_EVENT2 *event = (TCG_EVENT2*)((uintptr_t)digest + TCG_DIGEST2_SHA1_SIZE);
+
+    eventhdr->DigestCount = 1;
+    digest->AlgorithmId = TPM2_ALG_SHA1;
+    event->EventSize = 6;
+
+    will_return(test_event2hdr_callback, true);
+    will_return(foreach_digest2_test_callback, true);
+    will_return(test_event2_callback, true);
+
+    tpm2_eventlog_context ctx = {
+        .digest2_cb = foreach_digest2_test_callback,
+        .event2_cb = test_event2_callback,
+        .event2hdr_cb = test_event2hdr_callback,
+        .eventlog_version = 2,
     };
     assert_true(foreach_event2(&ctx, eventhdr, sizeof(buf)));
 }
@@ -278,7 +304,31 @@
     };
     assert_false(foreach_event2(&ctx, eventhdr, sizeof(buf)));
 }
-static void test_foreach_event2_event2body_fail(void **state){
+static void test_foreach_event2_event2body_version1_fail(void **state){
+
+    (void)state;
+    char bufsizeof(TCG_EVENT_HEADER2) + TCG_DIGEST2_SHA1_SIZE + sizeof(TCG_EVENT2) + 1 = { 0, };
+    TCG_EVENT_HEADER2 *eventhdr = (TCG_EVENT_HEADER2*)buf;
+    TCG_DIGEST2 *digest = eventhdr->Digests;
+    TCG_EVENT2 *event = (TCG_EVENT2*)(buf + sizeof(*eventhdr) + TCG_DIGEST2_SHA1_SIZE);
+
+    eventhdr->DigestCount = 1;
+    digest->AlgorithmId = TPM2_ALG_SHA1;
+    event->EventSize = 1;
+
+    will_return(test_event2hdr_callback, true);
+    will_return(foreach_digest2_test_callback, true);
+    will_return(test_event2_callback, false);
+
+    tpm2_eventlog_context ctx = {
+        .event2hdr_cb = test_event2hdr_callback,
+        .digest2_cb = foreach_digest2_test_callback,
+        .event2_cb = test_event2_callback,
+        .eventlog_version = 1,
+    };
+    assert_false(foreach_event2(&ctx, eventhdr, sizeof(buf)));
+}
+static void test_foreach_event2_event2body_version2_fail(void **state){
 
     (void)state;
     char bufsizeof(TCG_EVENT_HEADER2) + TCG_DIGEST2_SHA1_SIZE + sizeof(TCG_EVENT2) + 1 = { 0, };
@@ -298,6 +348,7 @@
         .event2hdr_cb = test_event2hdr_callback,
         .digest2_cb = foreach_digest2_test_callback,
         .event2_cb = test_event2_callback,
+        .eventlog_version = 2,
     };
     assert_false(foreach_event2(&ctx, eventhdr, sizeof(buf)));
 }
@@ -314,9 +365,9 @@
 
     (void)state;
 
-    char bufsizeof(TCG_EVENT2) + sizeof(UEFI_VARIABLE_DATA) + sizeof(char16_t) = { 0, };
+    char bufsizeof(TCG_EVENT2) + sizeof(UEFI_VARIABLE_DATA) + sizeof(UTF16_CHAR) = { 0, };
     TCG_EVENT2 *event = (TCG_EVENT2*)buf;
-    event->EventSize = sizeof(UEFI_VARIABLE_DATA) + sizeof(char16_t) - 1;
+    event->EventSize = sizeof(UEFI_VARIABLE_DATA) + sizeof(UTF16_CHAR) - 1;
     UEFI_VARIABLE_DATA *data = (UEFI_VARIABLE_DATA*)event->Event;
     data->UnicodeNameLength = 1;
 
@@ -515,9 +566,11 @@
         cmocka_unit_test(test_parse_event2_baddigest),
         cmocka_unit_test(test_parse_event2_badeventsize),
         cmocka_unit_test(test_parse_event2_badeventbuf),
-        cmocka_unit_test(test_foreach_event2),
+        cmocka_unit_test(test_foreach_event2_version1),
+        cmocka_unit_test(test_foreach_event2_version2),
         cmocka_unit_test(test_foreach_event2_event2hdr_fail),
-        cmocka_unit_test(test_foreach_event2_event2body_fail),
+        cmocka_unit_test(test_foreach_event2_event2body_version1_fail),
+        cmocka_unit_test(test_foreach_event2_event2body_version2_fail),
         cmocka_unit_test(test_foreach_event2_digest2_fail),
         cmocka_unit_test(test_foreach_event2_parse_event2body_fail),
         cmocka_unit_test(test_parse_event2body_uefivar_badsize),

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/unit/test_tpm2_eventlog_yaml.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/unit/test_tpm2_eventlog_yaml.c Changed

@@ -47,6 +47,9 @@
 def_eventtype_to_string(EV_EFI_ACTION)
 def_eventtype_to_string(EV_EFI_PLATFORM_FIRMWARE_BLOB)
 def_eventtype_to_string(EV_EFI_HANDOFF_TABLES)
+def_eventtype_to_string(EV_EFI_PLATFORM_FIRMWARE_BLOB2)
+def_eventtype_to_string(EV_EFI_HANDOFF_TABLES2)
+def_eventtype_to_string(EV_EFI_VARIABLE_BOOT2)
 def_eventtype_to_string(EV_EFI_VARIABLE_AUTHORITY)
 
 static void eventtype_to_string_default(void **state) {
@@ -64,14 +67,23 @@
     digest->AlgorithmId = TPM2_ALG_SHA1;
     assert_true(yaml_digest2_callback(digest, TPM2_SHA1_DIGEST_SIZE, &count));
 }
-static void test_yaml_event2data(void **state) {
+static void test_yaml_event2data_version1(void **state) {
 
     (void)state;
     uint8_t buf sizeof(TCG_EVENT2) + 6;
     TCG_EVENT2 *event = (TCG_EVENT2*)buf;
 
     event->EventSize = 6;
-    assert_true(yaml_event2data(event, EV_PREBOOT_CERT));
+    assert_true(yaml_event2data(event, EV_PREBOOT_CERT, 1));
+}
+static void test_yaml_event2data_version2(void **state) {
+
+    (void)state;
+    uint8_t buf sizeof(TCG_EVENT2) + 6;
+    TCG_EVENT2 *event = (TCG_EVENT2*)buf;
+
+    event->EventSize = 6;
+    assert_true(yaml_event2data(event, EV_PREBOOT_CERT, 2));
 }
 static void test_yaml_event2hdr_callback(void **state){
 
@@ -99,7 +111,7 @@
 
     (void)state;
 
-    assert_false(yaml_eventlog(NULL, 0));
+    assert_false(yaml_eventlog(NULL, 0, 1));
 }
 int main(void) {
 
@@ -132,12 +144,16 @@
         cmocka_unit_test(eventtype_to_string_EV_EFI_ACTION),
         cmocka_unit_test(eventtype_to_string_EV_EFI_PLATFORM_FIRMWARE_BLOB),
         cmocka_unit_test(eventtype_to_string_EV_EFI_HANDOFF_TABLES),
+        cmocka_unit_test(eventtype_to_string_EV_EFI_PLATFORM_FIRMWARE_BLOB2),
+        cmocka_unit_test(eventtype_to_string_EV_EFI_HANDOFF_TABLES2),
+        cmocka_unit_test(eventtype_to_string_EV_EFI_VARIABLE_BOOT2),
         cmocka_unit_test(eventtype_to_string_EV_EFI_VARIABLE_AUTHORITY),
         cmocka_unit_test(eventtype_to_string_default),
         cmocka_unit_test(test_yaml_event2hdr_callback),
         cmocka_unit_test(test_yaml_event2hdr_callback_nulldata),
         cmocka_unit_test(test_yaml_digest2_callback),
-        cmocka_unit_test(test_yaml_event2data),
+        cmocka_unit_test(test_yaml_event2data_version1),
+        cmocka_unit_test(test_yaml_event2data_version2),
         cmocka_unit_test(test_yaml_eventlog),
     };

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/unit/test_tpm2_policy.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/unit/test_tpm2_policy.c Changed

@@ -58,6 +58,21 @@
         }
 };
 
+/* fake sha256 digests */
+static const UINT8 sha256_digest32 =  {
+    0xb5, 0xbb, 0x9d, 0x80, 0x14, 0xa0, 0xf9, 0xb1, 0xd6, 0x1e, 0x21, 0xe7,
+    0x96, 0xd7, 0x8d, 0xcc, 0xdf, 0x13, 0x52, 0xf2, 0x3c, 0xd3, 0x28, 0x12,
+    0xf4, 0x85, 0x0b, 0x87, 0x8a, 0xe4, 0x94, 0x4c
+};
+
+static const UINT8 sha256_digest_232 =  {
+    0x7d, 0x86, 0x5e, 0x95, 0x9b, 0x24, 0x66, 0x91, 0x8c, 0x98, 0x63, 0xaf,
+    0xca, 0x94, 0x2d, 0x0f, 0xb8, 0x9d, 0x7c, 0x9a, 0xc0, 0xc9, 0x9b, 0xaf,
+    0xc3, 0x74, 0x95, 0x04, 0xde, 0xd9, 0x77, 0x30
+};
+
+static const UINT8 *current_sha256_digest = sha256_digest;
+
 TSS2_RC __wrap_Esys_StartAuthSession(ESYS_CONTEXT *esysContext, ESYS_TR tpmKey,
         ESYS_TR bind, ESYS_TR shandle1, ESYS_TR shandle2, ESYS_TR shandle3,
         const TPM2B_NONCE *nonceCaller, TPM2_SE sessionType,
@@ -160,6 +175,32 @@
     return TSS2_RC_SUCCESS;
 }
 
+bool __real_files_get_file_size_path(const char *path, unsigned long *file_size);
+bool __wrap_files_get_file_size_path(const char *path, unsigned long *file_size) {
+
+    if (strcmp(path, "testpolicy.sha256")) {
+        return __real_files_get_file_size_path(path, file_size);
+    }
+
+    *file_size = 32;
+    return true;
+}
+
+bool __real_files_load_bytes_from_path(const char *path, UINT8 *buf, UINT16 *size);
+bool __wrap_files_load_bytes_from_path(const char *path, UINT8 *buf, UINT16 *size) {
+
+    if (strcmp(path, "testpolicy.sha256")) {
+        return __real_files_load_bytes_from_path(path, buf, size);
+    }
+
+    /* plop in a fake digest */
+    *size = 32;
+    memcpy(buf, current_sha256_digest, 32);
+
+    return true;
+}
+
+
 static void test_tpm2_policy_build_pcr_good(void **state) {
     UNUSED(state);
 
@@ -179,7 +220,8 @@
     assert_int_equal(rc, tool_rc_success);
 
     TPM2B_DIGEST *policy_digest;
-    rc = tpm2_policy_get_digest(ESAPI_CONTEXT, s, &policy_digest);
+    rc = tpm2_policy_get_digest(ESAPI_CONTEXT, s, &policy_digest, 0,
+        TPM2_ALG_ERROR);
     assert_int_equal(rc, tool_rc_success);
 
     assert_int_equal(policy_digest->size, expected_policy_digest.size);
@@ -293,7 +335,8 @@
     assert_int_equal(trc, tool_rc_success);
 
     TPM2B_DIGEST *policy_digest;
-    trc = tpm2_policy_get_digest(ESAPI_CONTEXT, s, &policy_digest);
+    trc = tpm2_policy_get_digest(ESAPI_CONTEXT, s, &policy_digest, 0,
+        TPM2_ALG_ERROR);
     assert_int_equal(rc, tool_rc_success);
 
     assert_int_equal(policy_digest->size, expected_policy_digest.size);
@@ -353,6 +396,56 @@
     assert_int_equal(trc, tool_rc_general_error);
 }
 
+static void tpm2_policy_parse_policy_list_good(void **state) {
+    UNUSED(state);
+
+    TPML_DIGEST policy_list = { 0 };
+    char str = "sha256:testpolicy.sha256,testpolicy.sha256";
+    bool res = tpm2_policy_parse_policy_list(str, &policy_list);
+    assert_true(res);
+    assert_int_equal(policy_list.count, 2);
+    assert_int_equal(policy_list.digests0.size, sizeof(sha256_digest));
+    assert_memory_equal(policy_list.digests0.buffer, sha256_digest, sizeof(sha256_digest));
+    assert_int_equal(policy_list.digests1.size, sizeof(sha256_digest));
+    assert_memory_equal(policy_list.digests1.buffer, sha256_digest, sizeof(sha256_digest));
+}
+
+static void tpm2_policy_parse_policy_list_double_call(void **state) {
+    UNUSED(state);
+
+    TPML_DIGEST policy_list = { 0 };
+    char str = "sha256:testpolicy.sha256,testpolicy.sha256";
+    bool res = tpm2_policy_parse_policy_list(str, &policy_list);
+    assert_true(res);
+    assert_int_equal(policy_list.count, 2);
+    assert_int_equal(policy_list.digests0.size, sizeof(sha256_digest));
+    assert_memory_equal(policy_list.digests0.buffer, sha256_digest, sizeof(sha256_digest));
+    assert_int_equal(policy_list.digests1.size, sizeof(sha256_digest));
+    assert_memory_equal(policy_list.digests1.buffer, sha256_digest, sizeof(sha256_digest));
+
+    /* swap digests to ensure we know where we wrote to in the array */
+    current_sha256_digest = sha256_digest_2;
+
+    /* strtok_r in previous calls modifies this */
+    char str2 = "sha256:testpolicy.sha256,testpolicy.sha256";
+    res = tpm2_policy_parse_policy_list(str2, &policy_list);
+    assert_true(res);
+    /* count should go to 4 */
+    assert_int_equal(policy_list.count, 4);
+
+    /* original data intact */
+    assert_int_equal(policy_list.digests0.size, sizeof(sha256_digest));
+    assert_memory_equal(policy_list.digests0.buffer, sha256_digest, sizeof(sha256_digest));
+    assert_int_equal(policy_list.digests1.size, sizeof(sha256_digest));
+    assert_memory_equal(policy_list.digests1.buffer, sha256_digest, sizeof(sha256_digest));
+
+    /* extra data */
+    assert_int_equal(policy_list.digests2.size, sizeof(sha256_digest_2));
+    assert_memory_equal(policy_list.digests2.buffer, sha256_digest_2, sizeof(sha256_digest_2));
+    assert_int_equal(policy_list.digests3.size, sizeof(sha256_digest_2));
+    assert_memory_equal(policy_list.digests3.buffer, sha256_digest_2, sizeof(sha256_digest_2));
+}
+
 /* link required symbol, but tpm2_tool.c declares it AND main, which
  * we have a main below for cmocka tests.
  */
@@ -364,6 +457,8 @@
 
     const struct CMUnitTest tests = {
         cmocka_unit_test(test_tpm2_policy_build_pcr_good),
+        cmocka_unit_test(tpm2_policy_parse_policy_list_good),
+        cmocka_unit_test(tpm2_policy_parse_policy_list_double_call),
         cmocka_unit_test_setup_teardown(test_tpm2_policy_build_pcr_file_good,
                 test_setup, test_teardown),
         cmocka_unit_test_setup_teardown(test_tpm2_policy_build_pcr_file_bad_size,

_service:tar_scm:tpm2-tools-5.0.tar.gz/test/unit/test_tpm2_session.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/test/unit/test_tpm2_session.c Changed

_service:tar_scm:tpm2-tools-5.4.tar.gz/test/unit/vendor_tests.sh Added

_service:tar_scm:tpm2-tools-5.4.tar.gz/tools/fapi/tss2_gettpm2object.c Added

@@ -0,0 +1,184 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <tss2/tss2_tctildr.h>
+#include <tss2/tss2_esys.h>
+#include <tss2/tss2_mu.h>
+
+#include "tools/fapi/tss2_template.h"
+#include "lib/tpm2.h"
+#include "lib/files.h"
+
+/* Context struct used to store passed commandline parameters */
+static struct cxt {
+    char const *data;
+    char const *path;
+    char const *tcti;
+    bool        overwrite;
+} ctx;
+
+/* Parse commandline parameters */
+static bool on_option(char key, char *value) {
+    switch (key) {
+    case 'c':
+        ctx.data = value;
+        break;
+    case 'f':
+        ctx.overwrite = true;
+        break;
+    case 'p':
+        ctx.path = value;
+        break;
+    }
+    return true;
+}
+
+/* Define possible commandline parameters */
+static bool tss2_tool_onstart(tpm2_options **opts) {
+    struct option topts = {
+        {"path", required_argument, NULL, 'p'},
+        {"context",required_argument, NULL, 'c'},
+        {"force" , no_argument, NULL, 'f'},
+        {"tcti", required_argument, NULL, 'T'},
+
+    };
+    return (*opts = tpm2_options_new ("c:fp:", ARRAY_LEN(topts), topts,
+                                      on_option, NULL, 0)) != NULL;
+}
+
+/* Execute specific tool */
+static int tss2_tool_onrun (FAPI_CONTEXT *fctx) {
+    uint8_t blob_type;
+    uint8_t *esys_blob = NULL;
+    size_t esys_blob_size;
+    ESYS_CONTEXT *esys_ctx = NULL;
+    ESYS_TR esys_handle = ESYS_TR_NONE;
+    ESYS_TR esys_handle_deser = ESYS_TR_NONE;
+    FILE *stream = NULL;
+    TPM2_HANDLE tpm_handle;
+    TSS2_RC e_rc;
+    TSS2_TCTI_CONTEXT *tcti = NULL;
+    tool_rc t_rc;
+
+    /* Check availability of required parameters */
+    if (!ctx.path) {
+        fprintf (stderr, "path is missing, use --path\n");
+        return -1;
+    }
+
+    if (!ctx.data) {
+        ctx.data = "-";
+    }
+
+    /* Execute FAPI command with passed arguments */
+    TSS2_RC r = Fapi_GetEsysBlob (fctx, ctx.path, &blob_type, &esys_blob, &esys_blob_size);
+    if (r != TSS2_RC_SUCCESS) {
+        LOG_PERR ("Fapi_GetAppData", r);
+        return 1;
+    }
+
+    if (strcmp(ctx.data, "-")) {
+        if (!ctx.overwrite) {
+            FILE *fp = fopen(ctx.data, "rb");
+            if (fp) {
+                fclose(fp);
+                LOG_ERR("Path: %s already exists. Please rename or delete the file!\n",
+                ctx.data);
+                goto error;
+            }
+        }
+        stream = fopen(ctx.data, "w+b");
+        if (!stream) {
+            LOG_ERR("Could not open path \"%s\", due to error: \"%s\"", ctx.data,
+                    strerror(errno));
+            goto error;
+        }
+    } else {
+        stream = stdout;
+    }
+
+    r = Fapi_GetTcti(fctx, &tcti);
+    if (r != TSS2_RC_SUCCESS) {
+        LOG_PERR ("Fapi_GetTcti", r);
+        goto error;
+    }
+
+    e_rc = Esys_Initialize(&esys_ctx, tcti, NULL);
+  
+    if (blob_type == FAPI_ESYSBLOB_CONTEXTLOAD) {
+        size_t offset = 0;
+        TPMS_CONTEXT context;
+      
+        if (e_rc != TPM2_RC_SUCCESS) {
+            LOG_PERR("Esys_Initialize", e_rc);
+            goto error;
+        }
+         e_rc = Tss2_MU_TPMS_CONTEXT_Unmarshal(esys_blob, esys_blob_size, &offset, &context);
+         if (e_rc != TPM2_RC_SUCCESS) {
+             LOG_PERR("Tss2_MU_TPMS_CONTEXT_Unmarshal", e_rc);
+             goto error;
+         }
+         e_rc = Esys_ContextLoad(esys_ctx, &context, &esys_handle);
+         if (e_rc != TPM2_RC_SUCCESS) {
+             LOG_PERR("Esys_ContextLoad", e_rc);
+             goto error;
+         }
+         t_rc = files_save_tpm_context_to_file(esys_ctx, esys_handle, stream);
+         if (t_rc != tool_rc_success) {
+             goto error;
+         }
+         Esys_FlushContext(esys_ctx, esys_handle);
+         Esys_Finalize(&esys_ctx);
+    } else {
+        t_rc = tpm2_tr_deserialize(esys_ctx, esys_blob, esys_blob_size, &esys_handle_deser);
+        if (t_rc != tool_rc_success) {
+             goto error;
+        }
+        e_rc = Esys_TR_GetTpmHandle(esys_ctx, esys_handle_deser, &tpm_handle);
+        if (e_rc != TSS2_RC_SUCCESS) {
+            LOG_PERR("Esys_TR_GetTpmHandle", e_rc);
+            goto error;
+        }
+        int bytes_written = fprintf(stream,"0x%08x", tpm_handle);
+        if (bytes_written != 10) {
+            LOG_ERR("IO error for path \"%s\"", ctx.data);
+            goto error;
+        }
+                
+        Esys_TR_Close(esys_ctx, &esys_handle_deser);
+        Esys_Finalize(&esys_ctx);
+    }
+
+    /* Free allocated variables */
+    Fapi_Free (esys_blob);
+    if (stream && stream != stdout) {
+        fclose(stream);
+    }
+
+    return 0;
+
+ error:
+    if (stream && stream != stdout) {
+        fclose(stream);
+    }
+    Fapi_Free (esys_blob);
+    if (esys_handle != ESYS_TR_NONE) {
+        Esys_FlushContext(esys_ctx, esys_handle);
+    }
+    if (esys_handle_deser != ESYS_TR_NONE) {
+        Esys_TR_Close(esys_ctx, &esys_handle_deser);
+    }
+    if (esys_ctx) {
+        Esys_Finalize(&esys_ctx);
+    }
+    if (tcti) {
+        Tss2_TctiLdr_Finalize(&tcti);
+    }
+    return 1;
+}
+
+TSS2_TOOL_REGISTER("gettpm2object", tss2_tool_onstart, tss2_tool_onrun, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/fapi/tss2_provision.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/fapi/tss2_provision.c Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/fapi/tss2_quote.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/fapi/tss2_quote.c Changed

@@ -9,6 +9,7 @@
 /* Context struct used to store passed command line parameters */
 static struct cxt {
     uint32_t   *pcrList;
+    size_t     pcrListSize;
     char const *keyPath;
     char const *qualifyingData;
     char const *quoteInfo;
@@ -21,21 +22,20 @@
 /**
  * Split the comma separated input, parse each token as number,
  * put the numbers in the array output.  Allocate memory for
- * output to hold the numbers.  The last element of output is -1.
+ * output to hold the numbers.
  *
  * On failure returns false and output is not allocated.
  * On success the caller frees output.
  */
-static inline bool extract_pcrs(char *input, uint32_t **output) {
+static inline bool extract_pcrs(char *input, uint32_t **output, size_t *list_size) {
     size_t size = 1;
     char *temp = input;
     while ((temp = strchr (temp+1, ','))) size++;
-    *output = malloc (sizeof(uint32_t) * (size + 1));
+    *output = malloc (sizeof(uint32_t) * (size));
     if (!*output) {
         fprintf (stderr, "malloc failed: %m\n");
         return false;
     }
-    (*output)size = -1;
     char *x = strtok_r (input, ",", &temp);
     if (!tpm2_util_string_to_uint32(x, output0)) {
         fprintf (stderr, "%s cannot be used as PCR\n", x);
@@ -50,6 +50,9 @@
             return false;
         }
     }
+
+    *list_size = size+1;
+
     return true;
 }
 
@@ -58,7 +61,7 @@
     (void)value;
     switch (key) {
     case 'x':
-        return extract_pcrs(value, &ctx.pcrList);
+        return extract_pcrs(value, &ctx.pcrList, &ctx.pcrListSize);
     case 'Q':
         ctx.qualifyingData = value;
         break;
@@ -153,9 +156,9 @@
     uint8_t *signature;
     size_t signatureSize;
     char *quoteInfo, *pcrLog = NULL, *certificate = NULL;
-    r = Fapi_Quote (fctx, ctx.pcrList, 1, ctx.keyPath,
+    r = Fapi_Quote (fctx, ctx.pcrList, ctx.pcrListSize, ctx.keyPath,
         NULL, qualifyingData, qualifyingDataSize, &quoteInfo,
-        &signature, &signatureSize, &pcrLog, &certificate);
+        &signature, &signatureSize, ctx.pcrLog ? &pcrLog : NULL, &certificate);
     if (r != TSS2_RC_SUCCESS) {
         LOG_PERR ("Fapi_Quote", r);
         free (ctx.pcrList);
@@ -172,7 +175,8 @@
             strlen(quoteInfo));
         if (r) {
             Fapi_Free (quoteInfo);
-            Fapi_Free (pcrLog);
+            if (ctx.pcrLog)
+                Fapi_Free (pcrLog);
             Fapi_Free (signature);
             Fapi_Free (certificate);
             return 1;
@@ -191,7 +195,8 @@
             return 1;
         }
     }
-    Fapi_Free (pcrLog);
+    if (ctx.pcrLog)
+        Fapi_Free (pcrLog);
 
     if (ctx.signature && signature) {
         r = open_write_and_close (ctx.signature, ctx.overwrite, signature,

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/fapi/tss2_template.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/fapi/tss2_template.c Changed

@@ -21,6 +21,9 @@
 
 #include "tools/fapi/tss2_template.h"
 #include "lib/config.h"
+#include "lib/tpm2_alg_util.h"
+
+#define READ_SIZE 1024
 
 /* needed by tpm2_util and tpm2_option functions */
 bool output_enabled = false;
@@ -250,6 +253,120 @@
     return TSS2_RC_SUCCESS;
 }
 
+uint8_t *input_signature = NULL;
+
+TSS2_RC sign_callback(
+#ifdef FAPI_3_0
+    char        const *objectPath,
+#else /* FAPI_3_0 */
+    __attribute__((unused)) FAPI_CONTEXT *fapi_context,
+#endif /* FAPI_3_0 */
+    char        const *description,
+    char        const *publicKey,
+    char        const *publicKeyHint,
+    uint32_t    hashAlg,
+    uint8_t     const *dataToSign,
+    size_t      dataToSignSize,
+#ifdef FAPI_3_0
+    uint8_t     const **signature,
+#else /* FAPI_3_0 */
+    uint8_t     **signature,
+#endif /* FAPI_3_0 */
+    size_t      *signatureSize,
+    void        *userData)
+{
+
+    if (input_signature != NULL) {
+        free(input_signature);
+        input_signature = NULL;
+    }
+
+    int rc;
+    char pathREAD_SIZE;
+    char publicKeyHintStrREAD_SIZE;
+
+    if (userData) {
+        printf("%s:", (const char *) userData);
+    } else {
+        const char *hashAlgName = tpm2_alg_util_algtostr(hashAlg,
+            tpm2_alg_util_flags_hash);
+        int cpy_size = 0;
+        if (strlen(publicKeyHint) > 0) {
+            const char* tmp = "the key corresponding to the key hint \"%s\" and";
+            cpy_size = strlen(tmp) - 2 /* remove replaced %s */ +
+                strlen(publicKeyHint);
+            rc = snprintf(publicKeyHintStr, cpy_size+1 /* add \0 */, tmp,
+                publicKeyHint);
+            if (rc != cpy_size){
+                fprintf (stderr, "Command snprintf failed with %d\n", rc);
+                return TSS2_FAPI_RC_GENERAL_FAILURE;
+            }
+        }
+        else {
+            const char* tmp = "the key corresponding to the fingerprint \"%s\" and";
+            char publicKeyHintTmpREAD_SIZE;
+            rc = tpm2_pem_encoded_key_to_fingerprint(publicKey, publicKeyHintTmp);
+            if (rc != true){
+                fprintf (stderr, "Error getting the fingerprint of the "\
+                    "PEM-encoded public key\n");
+                return TSS2_FAPI_RC_GENERAL_FAILURE;
+            }
+            cpy_size = strlen(tmp) - 2 /* remove replaced %s */ +
+                strlen(publicKeyHintTmp);
+            rc = snprintf(publicKeyHintStr, cpy_size+1 /* add \0 */, tmp,
+                publicKeyHintTmp);
+            if (rc != cpy_size){
+                fprintf (stderr, "Command snprintf failed with %d\n", rc);
+                return TSS2_FAPI_RC_GENERAL_FAILURE;
+            }
+        }
+
+#ifdef FAPI_3_0
+        printf("%s: Authorize usage of %s by signing the nonce with %s the hash "\
+            "algorithm \"%s\".\n", description, objectPath, publicKeyHintStr,
+            hashAlgName);
+#else /* FAPI_3_0 */
+        printf("%s: Authorize usage of the key by signing the nonce with %s the "\
+            "hash algorithm \"%s\".\n", description, publicKeyHintStr,
+            hashAlgName);
+#endif /* FAPI_3_0 */
+
+    }
+    printf("Filename for nonce output: ");
+    rc = tpm2_safe_read_from_stdin(READ_SIZE, path);
+    if (rc != true){
+        fprintf (stderr, "Please enter a valid file path\n");
+        return TSS2_FAPI_RC_GENERAL_FAILURE;
+    }
+
+    rc = open_write_and_close(path, true, dataToSign,
+        dataToSignSize);
+    if (rc) {
+        fprintf (stderr, "Could not write to file: %s\n", path);
+        return TSS2_FAPI_RC_GENERAL_FAILURE;
+    }
+
+    printf("Filename for signature input: ");
+    rc = tpm2_safe_read_from_stdin(READ_SIZE, path);
+    if (rc != true){
+        fprintf (stderr, "Please enter a valid file path\n");
+        return TSS2_FAPI_RC_GENERAL_FAILURE;
+    }
+
+    size_t input_signatureSize;
+    rc = open_read_and_close (path, (void**)&input_signature,
+    &input_signatureSize);
+    if (rc) {
+        fprintf (stderr, "Could not read from file path: %s\n", path);
+        return TSS2_FAPI_RC_GENERAL_FAILURE;
+    }
+
+    *signature = input_signature;
+    *signatureSize = input_signatureSize;
+
+    return TSS2_RC_SUCCESS;
+}
+
 TSS2_RC branch_callback(
 #ifdef FAPI_3_0
     char const                     *objectPath,
@@ -410,6 +527,14 @@
         Fapi_Finalize (&fctx);
         goto free_opts;
     }
+
+    r = Fapi_SetSignCB (fctx, sign_callback, NULL);
+    if (r != TSS2_RC_SUCCESS) {
+        fprintf (stderr, "Fapi_SetSignCB returned %u\n", r);
+        Fapi_Finalize (&fctx);
+        goto free_opts;
+    }
+
     r = Fapi_SetBranchCB (fctx, branch_callback, NULL);
     if (r != TSS2_RC_SUCCESS) {
         fprintf (stderr, "Fapi_SetBranchCB returned %u\n", r);
@@ -443,6 +568,9 @@
     if (tool_opts)
         tpm2_options_free (tool_opts);
     free (password);
+    if (ret == 0){
+        free (input_signature);
+    }
     exit(ret);
 }

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/misc/tpm2_certifyX509certutil.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/misc/tpm2_certifyX509certutil.c Changed

@@ -8,6 +8,8 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 #include <openssl/bio.h>
@@ -15,6 +17,46 @@
 #include "log.h"
 #include "tpm2_tool.h"
 
+typedef struct {
+    ASN1_TIME *notBefore;
+    ASN1_TIME *notAfter;
+} TPM2_PARTIAL_CERT_VALIDITY;
+
+typedef struct {
+    X509_ALGOR *algorithm;
+    X509_NAME *issuer;
+    TPM2_PARTIAL_CERT_VALIDITY *validity;
+    X509_NAME *subject;
+    STACK_OF(X509_EXTENSION) *extensions;
+} TPM2_PARTIAL_CERT;
+
+ASN1_SEQUENCE(TPM2_PARTIAL_CERT_VALIDITY) = {
+    ASN1_SIMPLE(TPM2_PARTIAL_CERT_VALIDITY, notBefore, ASN1_TIME),
+    ASN1_SIMPLE(TPM2_PARTIAL_CERT_VALIDITY, notAfter, ASN1_TIME),
+} ASN1_SEQUENCE_END(TPM2_PARTIAL_CERT_VALIDITY)
+
+/* partialCertificate per Part 3, 18.8.1 */
+ASN1_SEQUENCE(TPM2_PARTIAL_CERT) = {
+    ASN1_OPT(TPM2_PARTIAL_CERT, algorithm, X509_ALGOR),
+    ASN1_SIMPLE(TPM2_PARTIAL_CERT, issuer, X509_NAME),
+    ASN1_SIMPLE(TPM2_PARTIAL_CERT, validity, TPM2_PARTIAL_CERT_VALIDITY),
+    ASN1_SIMPLE(TPM2_PARTIAL_CERT, subject, X509_NAME),
+    ASN1_EXP_SEQUENCE_OF(TPM2_PARTIAL_CERT, extensions, X509_EXTENSION, 3),
+} ASN1_SEQUENCE_END(TPM2_PARTIAL_CERT)
+
+IMPLEMENT_ASN1_FUNCTIONS(TPM2_PARTIAL_CERT)
+
+int i2d_TPM2_PARTIAL_CERT_bio(BIO *bp, const TPM2_PARTIAL_CERT *a)
+{
+    return ASN1_i2d_bio_of(TPM2_PARTIAL_CERT, i2d_TPM2_PARTIAL_CERT, bp, a);
+}
+
+int TPM2_add_ext(TPM2_PARTIAL_CERT *x, X509_EXTENSION *ex, int loc)
+{
+    return (X509v3_add_ext(&(x->extensions), ex, loc) != NULL);
+}
+
+
 struct tpm_gen_partial_cert {
     const char *out_path;
     const char *valid_str;
@@ -95,80 +137,6 @@
       .def = "CA Unit" },
 };
 
-static tool_rc fixup_cert(const char *cert) {
-
-    int fd = open(cert, O_RDONLY);
-    if (fd < 0) {
-        LOG_ERR("open failed");
-        return tool_rc_general_error;
-    }
-
-    struct stat fs;
-    int ret = fstat(fd, &fs);
-    if (ret < 0) {
-        close(fd);
-        return tool_rc_general_error;
-    }
-
-    ssize_t size = fs.st_size;
-    if (size < 100 || size > 255) {
-        LOG_ERR("Wrong cert size %zd", size);
-        close(fd);
-        return tool_rc_general_error; /* there is something wrong with this cert */
-    }
-
-    char* buf = calloc(1, size);
-    if (!buf) {
-        LOG_ERR("Alloc failed");
-        close(fd);
-        return tool_rc_general_error;
-    }
-
-    tool_rc rc = tool_rc_success;
-    ret = read(fd, buf, size);
-    close(fd);
-    if (ret != size) {
-        LOG_ERR("read failed");
-        rc = tool_rc_general_error;
-        goto out;
-    }
-
-    fd = open(cert, O_WRONLY | O_TRUNC);
-    if (fd < 0) {
-        LOG_ERR("second open failed");
-        rc = tool_rc_general_error;
-        goto out;
-    }
-
-    /* We need to skip one wrapping sequence (8 bytes) and one
-     * sequence with one empty byte field at the end (5 bytes).
-     * Fix the size here */
-    buf2 = size - 16;
-
-    /* Write the external sequence with the fixed size */
-    ret = write(fd, buf, 3);
-    if (ret != 3) {
-        LOG_ERR("write failed");
-        rc = tool_rc_general_error;
-        close(fd);
-        goto out;
-    }
-
-    /* skip the wrapping sequence the write the rest
-     * without the 5 bytes at the end */
-    ret = write(fd, buf + 11, size - 16);
-    close(fd);
-    if (ret != size - 16) {
-        LOG_ERR("second write failed");
-        rc = tool_rc_general_error;
-    }
-
-out:
-    free(buf);
-
-    return rc;
-}
-
 static int populate_fields(X509_NAME *name, const char *opt) {
 
     char *name_opt = strdup(opt);
@@ -228,19 +196,14 @@
     }
 
     X509_EXTENSION *extv3 = NULL;
-    X509 *cert = X509_new();
+    TPM2_PARTIAL_CERT *cert = TPM2_PARTIAL_CERT_new();
     if (!cert) {
-        LOG_ERR("X509_new");
-        goto out_err;
-    }
-
-    X509_NAME *issuer = X509_get_issuer_name(cert);
-    if (!issuer) {
-        LOG_ERR("X509_get_issuer_name");
+        LOG_ERR("TPM2_PARTIAL_CERT_new");
         goto out_err;
     }
 
-    int fields_added = populate_fields(issuer, ctx.issuer);
+    /* populate issuer */
+    int fields_added = populate_fields(cert->issuer, ctx.issuer);
     if (fields_added <= 0) {
         LOG_ERR("Could not parse any issuer fields");
         goto out_err;
@@ -248,28 +211,18 @@
         LOG_INFO("Added %d issuer fields", fields_added);
     }
 
-    int ret = X509_set_issuer_name(cert, issuer); // add issuer
-    if (ret != 1) {
-        LOG_ERR("X509_set_issuer_name");
-        goto out_err;
-    }
-
+    /* populate validity */
     unsigned int valid_days;
     if (!tpm2_util_string_to_uint32(ctx.valid_str, &valid_days)) {
         LOG_ERR("string_to_uint32");
         goto out_err;
     }
 
-    X509_gmtime_adj(X509_get_notBefore(cert), 0); // add valid not before
-    X509_gmtime_adj(X509_get_notAfter(cert), valid_days * 86400); // add valid not after
-
-    X509_NAME *subject = X509_get_subject_name(cert);
-    if (!subject) {
-        LOG_ERR("X509_get_subject_name");
-        goto out_err;
-    }
+    X509_gmtime_adj(cert->validity->notBefore, 0); // add valid not before
+    X509_gmtime_adj(cert->validity->notAfter, valid_days * 86400); // add valid not after
 
-    fields_added = populate_fields(subject, ctx.subject);
+    /* populate subject */
+    fields_added = populate_fields(cert->subject, ctx.subject);
     if (fields_added <= 0) {
         LOG_ERR("Could not parse any subject fields");
         goto out_err;
@@ -277,51 +230,37 @@
         LOG_INFO("Added %d subject fields", fields_added);
     }
 
-    ret = X509_set_subject_name(cert, subject);  // add subject
-    if (ret != 1) {
-        LOG_ERR("X509_NAME_add_entry_by_txt");
-        goto out_err;
-    }
-
+    /* populate extensions */
     extv3 = X509V3_EXT_conf_nid(NULL, NULL, NID_key_usage,
-    "critical,digitalSignature,keyCertSign,cRLSign");
+                "critical,digitalSignature,keyCertSign,cRLSign");
     if (!extv3) {
         LOG_ERR("X509V3_EXT_conf_nid");
         goto out_err;
     }
 
-    ret = X509_add_ext(cert, extv3, -1); // add required v3 extention: key usage
+    int ret = TPM2_add_ext(cert, extv3, -1); // add required v3 extention: key usage
     if (ret != 1) {
         LOG_ERR("X509_add_ext");
         goto out_err;
     }
 
-    ret = i2d_X509_bio(cert_out, cert); // print cert in DER format
+    /* output */
+    ret = i2d_TPM2_PARTIAL_CERT_bio(cert_out, cert); // print cert in DER format
     if (ret != 1) {
         LOG_ERR("i2d_X509_bio");
         goto out_err;
     }
 
     X509_EXTENSION_free(extv3);
-    X509_free(cert);
+    TPM2_PARTIAL_CERT_free(cert);
     BIO_free_all(cert_out);
 
-    ret = fixup_cert(ctx.out_path);
-    if (ret) {
-        LOG_ERR("fixup_cert");
-        return tool_rc_general_error;
-    }
-
     return tool_rc_success;
 
 out_err:
     BIO_free_all(cert_out);
-    if (cert) {
-        X509_free(cert);
-    }
-    if (extv3) {
-        X509_EXTENSION_free(extv3);
-    }
+    X509_EXTENSION_free(extv3);
+    TPM2_PARTIAL_CERT_free(cert);
 
     return tool_rc_general_error;
 }

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/misc/tpm2_checkquote.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/misc/tpm2_checkquote.c Changed

@@ -57,6 +57,7 @@
 static bool verify(void) {
 
     bool result = false;
+    EVP_PKEY_CTX *pkey_ctx = NULL;
 
     /* read the public key */
     EVP_PKEY *pkey = NULL;
@@ -65,7 +66,19 @@
         return false;
     }
 
-    EVP_PKEY_CTX *pkey_ctx = EVP_PKEY_CTX_new(pkey, NULL);
+#if OPENSSL_VERSION_NUMBER >= 0x10101003L
+#if OPENSSL_VERSION_MAJOR < 3
+    if (ctx.halg == TPM2_ALG_SM3_256) {
+        ret = EVP_PKEY_set_alias_type(pkey, EVP_PKEY_SM2);
+        if (!ret) {
+            LOG_ERR("EVP_PKEY_set_alias_type failed: %s", ERR_error_string(ERR_get_error(), NULL));
+            goto err;
+        }
+    }
+#endif
+#endif
+
+    pkey_ctx = EVP_PKEY_CTX_new(pkey, NULL);
     if (!pkey_ctx) {
         LOG_ERR("EVP_PKEY_CTX_new failed: %s", ERR_error_string(ERR_get_error(), NULL));
         goto err;
@@ -74,7 +87,7 @@
     /* get the digest alg */
     /* TODO SPlit loading on plain vs tss format to detect the hash alg */
     /* If its a plain sig we need -g */
-    const EVP_MD *md = tpm2_openssl_halg_from_tpmhalg(ctx.halg);
+    const EVP_MD *md = tpm2_openssl_md_from_tpmhalg(ctx.halg);
     // TODO error handling
 
     int rc = EVP_PKEY_verify_init(pkey_ctx);
@@ -269,11 +282,11 @@
 
     if (le64toh(pcrs->count) > ARRAY_LEN(pcrs->pcr_values)) {
         LOG_ERR("Malformed PCR file, pcr count cannot be greater than %zu, got: %" PRIu64 " ",
-                ARRAY_LEN(pcrs->pcr_values), le64toh(pcrs->count));
+                ARRAY_LEN(pcrs->pcr_values), le64toh((UINT64)pcrs->count));
         return false;
     }
 
-    UINT32 j;
+    size_t j;
     for (j = 0; j < le64toh(pcrs->count); j++) {
         if (fread(&pcrs->pcr_valuesj, sizeof(TPML_DIGEST), 1, pcr_input)
                 != 1) {
@@ -376,7 +389,7 @@
     TPM2B_ATTEST *msg = NULL;
     TPML_PCR_SELECTION pcr_select;
     tpm2_pcrs *pcrs;
-    tpm2_pcrs temp_pcrs;
+    tpm2_pcrs temp_pcrs = {};
     tool_rc return_value = tool_rc_general_error;
 
     msg = message_from_file(ctx.msg_file_path);
@@ -463,7 +476,7 @@
         if (pcr_select.count > TPM2_NUM_PCR_BANKS)
             goto err;
 
-        tpm2_eventlog_context eventlog_ctx = {};
+        tpm2_eventlog_context eventlog_ctx = { 0 };
         bool rc = eventlog_from_file(&eventlog_ctx, ctx.eventlog_path);
         if (!rc) {
             LOG_ERR("Failed to process eventlog");

_service:tar_scm:tpm2-tools-5.4.tar.gz/tools/misc/tpm2_encodeobject.c Added

@@ -0,0 +1,217 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+
+/*
+ * Part of this file is copied from tpm2-tss-engine.
+ *
+ * Copyright 2017-2018, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ * Copyright (c) 2019, Wind River Systems.
+ * All rights reserved.
+ */
+
+#include <inttypes.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "files.h"
+#include "log.h"
+#include "tpm2.h"
+#include "tpm2_options.h"
+#include "tpm2_tool.h"
+#include "object.h"
+
+typedef struct tpm_encodeobject_ctx tpm_encodeobject_ctx;
+struct tpm_encodeobject_ctx {
+    struct {
+        const char *ctx_path;
+        const char *auth_str;
+        tpm2_loaded_object object;
+    } parent;
+
+    struct {
+        const char *pubpath;
+        TPM2B_PUBLIC public;
+        const char *privpath;
+        TPM2B_PRIVATE private;
+        ESYS_TR handle;
+        bool needs_auth;
+    } object;
+
+    char *output_path;
+};
+
+static tpm_encodeobject_ctx ctx;
+
+static bool on_option(char key, char *value) {
+    switch (key) {
+    case 'P':
+        ctx.parent.auth_str = value;
+        break;
+    case 'u':
+        ctx.object.pubpath = value;
+        break;
+    case 'r':
+        ctx.object.privpath = value;
+        break;
+    case 'C':
+        ctx.parent.ctx_path = value;
+        break;
+    case 'o':
+        ctx.output_path = value;
+	break;
+    case 'p':
+        ctx.object.needs_auth = true;
+        break;
+    }
+
+    return true;
+}
+
+static bool tpm2_tool_onstart(tpm2_options **opts) {
+    const struct option topts = {
+      { "auth",           required_argument, NULL, 'P' },
+      { "public",         required_argument, NULL, 'u' },
+      { "private",        required_argument, NULL, 'r' },
+      { "parent-context", required_argument, NULL, 'C' },
+      { "output",         required_argument, NULL, 'o' },
+      { "key-auth",       no_argument,       NULL, 'p' },
+    };
+
+    *opts = tpm2_options_new("P:u:r:C:o:p", ARRAY_LEN(topts), topts, on_option,
+            NULL, 0);
+
+    return *opts != NULL;
+}
+
+static tool_rc check_opts(void) {
+    tool_rc rc = tool_rc_success;
+    if (!ctx.parent.ctx_path) {
+        LOG_ERR("Expected parent object via -C");
+        rc = tool_rc_option_error;
+    }
+
+    if (!ctx.object.pubpath) {
+        LOG_ERR("Expected public object portion via -u");
+        rc = tool_rc_option_error;
+    }
+
+    if (!ctx.object.privpath) {
+        LOG_ERR("Expected private object portion via -r");
+        rc = tool_rc_option_error;
+    }
+
+    if (!ctx.output_path) {
+        LOG_ERR("Expected output file path via -o");
+        rc = tool_rc_option_error;
+    }
+
+    return rc;
+}
+
+static tool_rc init(ESYS_CONTEXT *ectx) {
+    bool res = files_load_public(ctx.object.pubpath, &ctx.object.public);
+    if (!res) {
+        return tool_rc_general_error;
+    }
+
+    res = files_load_private(ctx.object.privpath, &ctx.object.private);
+    if (!res) {
+        return tool_rc_general_error;
+    }
+
+    return tpm2_util_object_load_auth(ectx, ctx.parent.ctx_path,
+            ctx.parent.auth_str, &ctx.parent.object, false,
+            TPM2_HANDLE_ALL_W_NV);
+}
+
+static int encode(void) {
+
+    uint8_t private_bufsizeof(ctx.object.private);
+    size_t private_len = 0;
+    tool_rc rc = tool_rc_general_error;
+    BIO *bio = NULL;
+    TSSPRIVKEY_OBJ *tpk = NULL;
+    BIGNUM *bn_parent = NULL;
+    TSS2_RC rval = Tss2_MU_TPM2B_PRIVATE_Marshal(&ctx.object.private,
+        private_buf, sizeof(private_buf), &private_len);
+    if (rval != TPM2_RC_SUCCESS) {
+        LOG_ERR("Error serializing private portion of object");
+        goto error;
+    }
+
+    size_t public_len = 0;
+    uint8_t public_bufsizeof(ctx.object.public);
+    rval = Tss2_MU_TPM2B_PUBLIC_Marshal(&ctx.object.public, public_buf,
+        sizeof(public_buf), &public_len);
+    if (rval != TPM2_RC_SUCCESS) {
+        LOG_ERR("Error serializing public portion of object");
+        goto error;
+    }
+
+    tpk = TSSPRIVKEY_OBJ_new();
+    if (!tpk) {
+        LOG_ERR("oom");
+        goto error;
+    }
+
+    tpk->type = OBJ_txt2obj(OID_loadableKey, 1);
+    if (!tpk->type) {
+        LOG_ERR("oom");
+        goto error;
+    }
+
+    tpk->emptyAuth = ctx.object.needs_auth;
+
+    bn_parent = BN_new();
+    if (!bn_parent) {
+        goto error;
+    }
+
+    if ((ctx.parent.object.handle >> TPM2_HR_SHIFT) == TPM2_HT_PERSISTENT) {
+        BN_set_word(bn_parent, ctx.parent.object.handle);
+    } else {
+	/* Indicate that the parent is a primary object generated on the fly. */
+        BN_set_word(bn_parent, TPM2_RH_OWNER);
+    }
+
+    BN_to_ASN1_INTEGER(bn_parent, tpk->parent);
+    ASN1_STRING_set(tpk->privkey, private_buf, private_len);
+    ASN1_STRING_set(tpk->pubkey, public_buf, public_len);
+
+    bio =  BIO_new_file(ctx.output_path, "w");
+    if (bio == NULL) {
+	    LOG_ERR("Could not open file: \"%s\"", ctx.output_path);
+        goto error;
+    }
+
+    PEM_write_bio_TSSPRIVKEY_OBJ(bio, tpk);
+    rc = tool_rc_success;
+
+ error:
+    BN_free(bn_parent);
+    if (bio)
+        BIO_free(bio);
+    if (tpk)
+        TSSPRIVKEY_OBJ_free(tpk);
+    return rc;
+}
+
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+    UNUSED(flags);
+
+    tool_rc rc = check_opts();
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    rc = init(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    return encode();
+}
+
+// Register this tool with tpm2_tool.c
+TPM2_TOOL_REGISTER("encodeobject", tpm2_tool_onstart, tpm2_tool_onrun, NULL, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/misc/tpm2_eventlog.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/misc/tpm2_eventlog.c Changed

@@ -12,8 +12,13 @@
 #include "tpm2_eventlog_yaml.h"
 #include "tpm2_tool.h"
 
+#define CHUNK_SIZE 16384
+
 static char *filename = NULL;
 
+/* Set the default YAML version */
+static uint32_t eventlog_version = 1;
+
 static bool on_positional(int argc, char **argv) {
 
     if (argc != 1) {
@@ -27,10 +32,34 @@
     return true;
 }
 
+static bool on_option(char key, char *value) {
+
+    uint32_t version;
+
+    switch (key) {
+    case 0:
+        if (!tpm2_util_string_to_uint32(value, &version)) {
+            LOG_ERR("Cannot parse eventlog version: %s\n", value);
+            return false;
+        }
+        if (version < MIN_EVLOG_YAML_VERSION || version > MAX_EVLOG_YAML_VERSION) {
+            LOG_ERR("Unexpected YAML version number: %u\n", version);
+            return false;
+        }
+        eventlog_version = version;
+        break;
+    }
+    return true;
+}
+
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
-    *opts = tpm2_options_new(NULL, 0, NULL, NULL, on_positional,
-                             TPM2_OPTIONS_NO_SAPI);
+    static struct option topts = {
+         { "eventlog-version",         required_argument, NULL, 0 },
+    };
+
+    *opts = tpm2_options_new("y:", ARRAY_LEN(topts), topts, on_option,
+                             on_positional, TPM2_OPTIONS_NO_SAPI);
 
     return *opts != NULL;
 }
@@ -45,38 +74,41 @@
         return tool_rc_option_error;
     }
 
-    unsigned long size = 0;
-    bool ret = files_get_file_size_path(filename, &size);
-    if (!ret) {
-        return tool_rc_general_error;
-    }
-
-    if (size > UINT16_MAX) {
-        LOG_WARN("event log exceeds %" PRIu16 " and will be truncated",
-                 UINT16_MAX);
-    }
-
-    UINT16 size_tmp = UINT16_MAX;
-    UINT8 *eventlog = calloc(1, size_tmp);
-    if (eventlog == NULL){
-        LOG_ERR("failed to allocate %lu bytes: %s", size, strerror(errno));
+    /* Read the file in chunks.  Usually the file will reside in
+       securityfs, and those files do not have a public file size */
+    FILE *fileptr = fopen(filename, "rb");
+    if (!fileptr) {
         return tool_rc_general_error;
     }
 
+    /* Reserve the buffer for the first chunk */
     tool_rc rc = tool_rc_success;
-    ret = files_load_bytes_from_path(filename, eventlog, &size_tmp);
-    if (!ret) {
-        rc = tool_rc_general_error;
-        goto out;
-    }
-
-    ret = yaml_eventlog(eventlog, size_tmp);
+    UINT8 *eventlog = NULL;
+    size_t size = 0;
+    bool is_file_read = false;
+    do {
+        UINT8 *eventlog_tmp = realloc(eventlog, size + CHUNK_SIZE);
+        if (!eventlog_tmp){
+            LOG_ERR("failed to allocate %zu bytes: %s", size + CHUNK_SIZE, strerror(errno));
+            rc = tool_rc_general_error;
+            goto out;
+        }
+        eventlog = eventlog_tmp;
+        is_file_read = files_read_bytes_chunk(fileptr, eventlog + size, CHUNK_SIZE, &size);
+    } while (is_file_read);
+
+    /* Parse eventlog data */
+    bool ret = yaml_eventlog(eventlog, size, eventlog_version);
     if (!ret) {
         LOG_ERR("failed to parse tpm2 eventlog");
         rc = tool_rc_general_error;
     }
 
 out:
+    if (fileptr) {
+        fclose(fileptr);
+    }
+
     if (eventlog) {
         free(eventlog);
     }

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/misc/tpm2_print.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/misc/tpm2_print.c Changed

@@ -5,23 +5,37 @@
 #include <stdio.h>
 #include <string.h>
 
+#include <tss2/tss2_esys.h>
+#include <tss2/tss2_rc.h>
+
 #include "files.h"
 #include "log.h"
+#include "tpm2.h"
 #include "tpm2_alg_util.h"
+#include "tpm2_convert.h"
 #include "tpm2_tool.h"
 #include "tpm2_util.h"
+#include "object.h"
 
 typedef bool (*print_fn)(FILE *f);
 
+#define FLAG_FMT (1 << 0)
+
 typedef struct tpm2_print_ctx tpm2_print_ctx;
 struct tpm2_print_ctx {
     struct {
         const char *path;
         print_fn handler;
     } file;
+    bool format_set;
+    tpm2_convert_pubkey_fmt format;
 };
 
-static tpm2_print_ctx ctx;
+#define TCTI_FAKE_MAGIC 0x46414b454d414700ULL
+
+static tpm2_print_ctx ctx = {
+        .format = pubkey_format_tss
+};
 
 static void print_clock_info(TPMS_CLOCK_INFO *clock_info, size_t indent_count) {
 
@@ -256,6 +270,13 @@
         return res;
     }
 
+    if (ctx.format_set) {
+        TPM2B_PUBLIC tpm2b_public = {
+                .publicArea = public
+        };
+        return tpm2_convert_pubkey_save(&tpm2b_public, ctx.format, NULL);
+    }
+
     tpm2_util_tpmt_public_to_yaml(&public, NULL);
 
     return true;
@@ -269,29 +290,210 @@
         return res;
     }
 
+    if (ctx.format_set) {
+        return tpm2_convert_pubkey_save(&public, ctx.format, NULL);
+    }
+
     tpm2_util_public_to_yaml(&public, NULL);
 
     return true;
 }
 
-#define ADD_HANDLER(type) { .name = #type, .fn = print_##type }
+static bool print_TSSPRIVKEY_OBJ(FILE *fstream) {
+
+    UNUSED(fstream);
+    
+    TPM2B_PUBLIC pub = { 0 };
+    TPM2B_PRIVATE priv = { 0 };
+    tool_rc rc = tpm2_util_object_fetch_priv_pub_from_tpk(ctx.file.path, &pub,
+        &priv);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Unable to fetch public/private portion of tss privkey");
+        return false;
+    }
+
+    if (ctx.format_set) {
+        return tpm2_convert_pubkey_save(&pub, ctx.format, NULL);
+    }
+
+    tpm2_util_public_to_yaml(&pub, NULL);
+
+    return true;
+}
+
+typedef struct TSS2_TCTI_FAKE_CONTEXT TSS2_TCTI_FAKE_CONTEXT;
+struct TSS2_TCTI_FAKE_CONTEXT {
+    TSS2_TCTI_CONTEXT_COMMON_V2 common;
+};
+
+static TSS2_RC tcti_fake_transmit (
+    TSS2_TCTI_CONTEXT *tcti_ctx,
+    size_t size,
+    const uint8_t *cmd_buf)
+{
+    UNUSED(size);
+    UNUSED(cmd_buf);
+    UNUSED(tcti_ctx);
+    return TSS2_RC_SUCCESS;
+}
+static TSS2_RC tcti_fake_receive (
+    TSS2_TCTI_CONTEXT *tcti_ctx,
+    size_t *size,
+    unsigned char *resp_buf,
+    int32_t timeout)
+{
+    UNUSED(size);
+    UNUSED(resp_buf);
+    UNUSED(tcti_ctx);
+    UNUSED(timeout);
+    return TSS2_RC_SUCCESS;
+}
+
+static TSS2_RC
+Tss2_Tcti_Fake_Init (
+    TSS2_TCTI_CONTEXT *tcti_ctx,
+    size_t *size)
+{
+    if (size == NULL) {
+        return TSS2_TCTI_RC_BAD_VALUE;
+    }
+    if (tcti_ctx == NULL) {
+        *size = sizeof (TSS2_TCTI_FAKE_CONTEXT);
+        return TSS2_RC_SUCCESS;
+    }
+    if (*size != sizeof (TSS2_TCTI_FAKE_CONTEXT)) {
+        return TSS2_TCTI_RC_BAD_VALUE;
+    }
+
+    TSS2_TCTI_FAKE_CONTEXT *t = (TSS2_TCTI_FAKE_CONTEXT *)tcti_ctx;
+    TSS2_TCTI_CONTEXT_COMMON_V2 *tcti_common = &t->common;
+
+    TSS2_TCTI_MAGIC (tcti_common) = TCTI_FAKE_MAGIC;
+    TSS2_TCTI_VERSION (tcti_common) = 2;
+    TSS2_TCTI_TRANSMIT (tcti_common) = tcti_fake_transmit;
+    TSS2_TCTI_RECEIVE (tcti_common) = tcti_fake_receive;
+    TSS2_TCTI_FINALIZE (tcti_common) = NULL;
+    TSS2_TCTI_CANCEL (tcti_common) = NULL;
+    TSS2_TCTI_GET_POLL_HANDLES (tcti_common) = NULL;
+    TSS2_TCTI_SET_LOCALITY (tcti_common) = NULL;
+    TSS2_TCTI_MAKE_STICKY (tcti_common) = NULL;
+
+    return TSS2_RC_SUCCESS;
+}
+
+static bool print_ESYS_TR(FILE* fd) {
+
+
+    uint8_t *buffer = NULL;
+    ESYS_CONTEXT *esys_ctx = NULL;
+    TPM2B_NAME *name = NULL;
+
+    unsigned long size = 0;
+    bool result = files_get_file_size(fd, &size, NULL);
+    if (!result) {
+        LOG_ERR("Failed to get file size: %s", strerror(ferror(fd)));
+        return false;
+    }
+
+    if (size < 1) {
+        LOG_ERR("Invalid serialized ESYS_TR size, got: %lu", size);
+        return false;
+    }
+
+    buffer = calloc(1, size);
+    if (!buffer) {
+        LOG_ERR("oom");
+        return false;
+    }
+
+    result = files_read_bytes(fd, buffer, size);
+    if (!result) {
+        LOG_ERR("Could not read serialized ESYS_TR from disk");
+        goto error;
+    }
+
+    uint8_t tcti_bufsizeof(TSS2_TCTI_FAKE_CONTEXT) = { 0 };
+    TSS2_TCTI_CONTEXT *tcti_ctx = (TSS2_TCTI_CONTEXT *)tcti_buf;
+    size_t tcti_size = sizeof(tcti_buf);
+    TSS2_RC rc = Tss2_Tcti_Fake_Init(tcti_ctx, &tcti_size);
+    if (rc != TSS2_RC_SUCCESS) {
+        LOG_ERR("Tss2_Tcti_Fake_Init: %s", Tss2_RC_Decode(rc));
+        goto error;
+    }
+
+    rc = Esys_Initialize(&esys_ctx, tcti_ctx, NULL);
+    if (rc != TSS2_RC_SUCCESS) {
+        LOG_ERR("Esys_Initialize: %s", Tss2_RC_Decode(rc));
+        goto error;
+    }
+
+    ESYS_TR handle;
+    result = tpm2_tr_deserialize(esys_ctx, buffer, size, &handle) == tool_rc_success;
+    if (!result) {
+        LOG_ERR("Was the handle for a transient object?");
+        goto error;
+    }
+
+    rc = Esys_TR_GetName(esys_ctx, handle, &name);
+    if (rc != TSS2_RC_SUCCESS) {
+        LOG_ERR("Esys_TR_GetName: %s", Tss2_RC_Decode(rc));
+        goto error;
+    }
+
+    TPM2_HANDLE tpm_handle = 0;
+    rc = Esys_TR_GetTpmHandle(esys_ctx, handle, &tpm_handle);
+    if (rc != TSS2_RC_SUCCESS) {
+        LOG_ERR("Esys_TR_GetTpmHandle: %s", Tss2_RC_Decode(rc));
+        goto error;
+    }
+
+    tpm2_tool_output("tpm-handle: 0x%x\n", tpm_handle);
+    tpm2_tool_output("name: ");
+    tpm2_util_hexdump(name->name, name->size);
+    tpm2_tool_output("\n");
+
+    result = true;
+
+out:
+    free(buffer);
+    Esys_Free(name);
+    Esys_Finalize(&esys_ctx);
+
+    return result;
+error:
+    result = false;
+    goto out;
+}
+
+#define ADD_HANDLER(type) { .name = #type, .flags = 0, .fn = print_##type }
+#define ADD_HANDLER_FMT(type) { .name = #type, .flags = FLAG_FMT, .fn = print_##type }
+
 
 static bool handle_type(const char *name) {
 
     static const struct {
         const char *name;
+        unsigned flags;
         print_fn fn;
     } handlers = {
         ADD_HANDLER(TPMS_ATTEST),
         ADD_HANDLER(TPMS_CONTEXT),
-        ADD_HANDLER(TPM2B_PUBLIC),
-        ADD_HANDLER(TPMT_PUBLIC)
+        ADD_HANDLER_FMT(TPM2B_PUBLIC),
+        ADD_HANDLER_FMT(TPMT_PUBLIC),
+        ADD_HANDLER_FMT(TSSPRIVKEY_OBJ),
+        ADD_HANDLER(ESYS_TR)
     };
 
     size_t i;
     for (i=0; i < ARRAY_LEN(handlers); i++) {
 
         if (!strcmp(name, handlersi.name)) {
+
+            if (ctx.format_set && !(handlersi.flags & FLAG_FMT)) {
+                LOG_ERR("Cannot specify --format/-f with handler for type \"%s\"", name);
+                return false;
+            }
+
             ctx.file.handler = handlersi.fn;
             return true;
         }
@@ -306,8 +508,12 @@
     switch (key) {
     case 't':
         return handle_type(value);
-    case 'i':
-        ctx.file.path = value;
+    case 'f':
+        ctx.format = tpm2_convert_pubkey_fmt_from_optarg(value);
+        if (ctx.format == pubkey_format_err) {
+            return false;
+        }
+        ctx.format_set = true;
         break;
     default:
         LOG_ERR("Invalid option %c", key);
@@ -331,10 +537,11 @@
 
 static bool tpm2_tool_onstart(tpm2_options **opts) {
     static const struct option topts = {
-        { "type",  required_argument, NULL, 't' },
+        { "type",   required_argument, NULL, 't' },
+        { "format", required_argument, NULL, 'f' },
     };
 
-    *opts = tpm2_options_new("t:", ARRAY_LEN(topts), topts, on_option, on_arg,
+    *opts = tpm2_options_new("t:f:", ARRAY_LEN(topts), topts, on_option, on_arg,
             TPM2_OPTIONS_NO_SAPI);
 
     return *opts != NULL;

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_activatecredential.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_activatecredential.c Changed

@@ -13,7 +13,12 @@
 #include "tpm2_tool.h"
 
 typedef struct tpm_activatecred_ctx tpm_activatecred_ctx;
+#define MAX_AUX_SESSIONS 1 // two sessions provided by auth interface
+#define MAX_SESSIONS 3
 struct tpm_activatecred_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -27,27 +32,101 @@
     } credentialed_key; //Typically AK
 
     TPM2B_ID_OBJECT credential_blob;
+    const char *credential_blob_path;
+    bool is_credential_blob_specified;
     TPM2B_ENCRYPTED_SECRET secret;
+
+    /*
+     * Outputs
+     */
     const char *output_file;
+    TPM2B_DIGEST *cert_info_data;
 
-    struct {
-        UINT8 i :1;
-        UINT8 o :1;
-    } flags;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+    bool is_command_dispatch;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
+};
 
-    char *cp_hash_path;
+static tpm_activatecred_ctx ctx = {
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tpm_activatecred_ctx ctx;
+static tool_rc activate_credential_and_output(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. TPM2_CC_<command> OR Retrieve cpHash
+     */
+    return tpm2_activatecredential(ectx, &ctx.credentialed_key.object,
+        &ctx.credential_key.object, &ctx.credential_blob, &ctx.secret,
+        &ctx.cert_info_data, &ctx.cp_hash, &ctx.rp_hash,
+        ctx.parameter_hash_algorithm, ctx.aux_session_handle0);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-static bool read_cert_secret(const char *path, TPM2B_ID_OBJECT *cred,
-        TPM2B_ENCRYPTED_SECRET *secret) {
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    tpm2_tool_output("certinfodata:");
+    size_t i;
+    for (i = 0; i < ctx.cert_info_data->size; i++) {
+        tpm2_tool_output("%.2x", ctx.cert_info_data->bufferi);
+    }
+    tpm2_tool_output("\n");
+
+    is_file_op_success = files_save_bytes_to_file(ctx.output_file,
+        ctx.cert_info_data->buffer, ctx.cert_info_data->size);
+    free(ctx.cert_info_data);
+    if (!is_file_op_success) {
+        return tool_rc_general_error;
+    }
+
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+    }
+
+    return is_file_op_success ? tool_rc_success : tool_rc_general_error;
+}
+
+static bool read_cert_secret(void) {
 
     bool result = false;
-    FILE *fp = fopen(path, "rb");
+    FILE *fp = fopen(ctx.credential_blob_path, "rb");
     if (!fp) {
-        LOG_ERR("Could not open file \"%s\" error: \"%s\"", path,
-                strerror(errno));
+        LOG_ERR("Could not open file \"%s\" error: \"%s\"",
+        ctx.credential_blob_path, strerror(errno));
         return false;
     }
 
@@ -63,25 +142,25 @@
         goto out;
     }
 
-    result = files_read_16(fp, &cred->size);
+    result = files_read_16(fp, &ctx.credential_blob.size);
     if (!result) {
         LOG_ERR("Could not read credential size");
         goto out;
     }
 
-    result = files_read_bytes(fp, cred->credential, cred->size);
+    result = files_read_bytes(fp, ctx.credential_blob.credential, ctx.credential_blob.size);
     if (!result) {
         LOG_ERR("Could not read credential data");
         goto out;
     }
 
-    result = files_read_16(fp, &secret->size);
+    result = files_read_16(fp, &ctx.secret.size);
     if (!result) {
         LOG_ERR("Could not read secret size");
         goto out;
     }
 
-    result = files_read_bytes(fp, secret->secret, secret->size);
+    result = files_read_bytes(fp, ctx.secret.secret, ctx.secret.size);
     if (!result) {
         LOG_ERR("Could not write secret data");
         goto out;
@@ -94,63 +173,96 @@
     return result;
 }
 
-static bool output_and_save(TPM2B_DIGEST *digest, const char *path) {
-
-    tpm2_tool_output("certinfodata:");
-
-    unsigned k;
-    for (k = 0; k < digest->size; k++) {
-        tpm2_tool_output("%.2x", digest->bufferk);
-    }
-    tpm2_tool_output("\n");
-
-    return files_save_bytes_to_file(path, digest->buffer, digest->size);
-}
-
-static tool_rc activate_credential_and_output(ESYS_CONTEXT *ectx) {
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
-    tool_rc rc = tool_rc_general_error;
+    /*
+     * 1. Object and auth initializations
+     */
 
-    TPM2B_DIGEST *cert_info_data;
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
 
-    if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        rc = tpm2_activatecredential(ectx, &ctx.credentialed_key.object,
-            &ctx.credential_key.object, &ctx.credential_blob, &ctx.secret,
-            &cert_info_data, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
+    /*
+     * 1.b Add object names and their auth sessions
+     */
 
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
+    /* Object #1 */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.credential_key.ctx_path,
+        ctx.credential_key.auth_str, &ctx.credential_key.object, false,
+        TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+    /* Object #2 */
+    rc = tpm2_util_object_load_auth(ectx, ctx.credentialed_key.ctx_path,
+        ctx.credentialed_key.auth_str, &ctx.credentialed_key.object, false,
+        TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
         return rc;
     }
 
-    rc = tpm2_activatecredential(ectx, &ctx.credentialed_key.object,
-            &ctx.credential_key.object, &ctx.credential_blob, &ctx.secret,
-            &cert_info_data, NULL);
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
     if (rc != tool_rc_success) {
-        goto out_all;
+        return rc;
     }
 
-    bool result = output_and_save(cert_info_data, ctx.output_file);
-    if (!result) {
-        goto out_all;
+    /*
+     * 3. Command specific initializations
+     */
+    rc = read_cert_secret() ? tool_rc_success : tool_rc_general_error;
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    rc = tool_rc_success;
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.credential_key.object.session,
+        ctx.credentialed_key.object.session,
+        ctx.aux_session0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.cp_hash_path && !ctx.rp_hash_path) ?
+        false : true;
 
-out_all:
-    free(cert_info_data);
     return rc;
 }
 
-static bool on_option(char key, char *value) {
+static tool_rc check_options(void) {
+
+    if ((!ctx.credentialed_key.ctx_path) && (!ctx.credential_key.ctx_path)
+        && !ctx.is_credential_blob_specified && !ctx.output_file) {
+        LOG_ERR("Expected options c and C and i and o.");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
 
-    bool result;
+static bool on_option(char key, char *value) {
 
     switch (key) {
     case 'c':
@@ -167,19 +279,27 @@
         break;
     case 'i':
         /* logs errors */
-        result = read_cert_secret(value, &ctx.credential_blob, &ctx.secret);
-        if (!result) {
-            return false;
-        }
-        ctx.flags.i = 1;
+        ctx.credential_blob_path = value;
+        ctx.is_credential_blob_specified = 1;
         break;
     case 'o':
         ctx.output_file = value;
-        ctx.flags.o = 1;
         break;
     case 0:
         ctx.cp_hash_path = value;
         break;
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
     }
 
     return true;
@@ -195,9 +315,11 @@
          {"credential-blob",         required_argument, NULL, 'i'},
          {"certinfo-data",           required_argument, NULL, 'o'},
          {"cphash",                  required_argument, NULL,  0 },
+         {"rphash",                  required_argument, NULL,  1 },
+         {"session",                required_argument, NULL, 'S' },
     };
 
-    *opts = tpm2_options_new("c:C:p:P:i:o:", ARRAY_LEN(topts), topts, on_option,
+    *opts = tpm2_options_new("c:C:p:P:i:o:S:", ARRAY_LEN(topts), topts, on_option,
             NULL, 0);
 
     return *opts != NULL;
@@ -208,34 +330,48 @@
     /* opts is unused, avoid compiler warning */
     UNUSED(flags);
 
-    if ((!ctx.credentialed_key.ctx_path) && (!ctx.credential_key.ctx_path)
-            && !ctx.flags.i && !ctx.flags.o) {
-        LOG_ERR("Expected options c and C and i and o.");
-        return tool_rc_option_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.credential_key.ctx_path,
-            ctx.credential_key.auth_str, &ctx.credential_key.object, false,
-            TPM2_HANDLE_ALL_W_NV);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    rc = tpm2_util_object_load_auth(ectx, ctx.credentialed_key.ctx_path,
-            ctx.credentialed_key.auth_str, &ctx.credentialed_key.object,
-            false, TPM2_HANDLE_ALL_W_NV);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = activate_credential_and_output(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    return activate_credential_and_output(ectx);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    tool_rc rc = tool_rc_success;
+    /*
+     * 1. Free objects
+     */
 
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
     tool_rc tmp_rc = tpm2_session_close(&ctx.credentialed_key.object.session);
     if (tmp_rc != tool_rc_success) {
         rc = tmp_rc;
@@ -246,8 +382,22 @@
         rc = tmp_rc;
     }
 
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
     return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("activatecredential", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("activatecredential", tpm2_tool_onstart, tpm2_tool_onrun,
+tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_certify.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_certify.c Changed

@@ -11,7 +11,12 @@
 #include "tpm2_options.h"
 
 typedef struct tpm_certify_ctx tpm_certify_ctx;
+#define MAX_AUX_SESSIONS 1 // two sessions provided by auth interface
+#define MAX_SESSIONS 3
 struct tpm_certify_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -24,139 +29,210 @@
         tpm2_loaded_object object;
     } signing_key;
 
+    TPMI_ALG_HASH halg;
+    tpm2_convert_sig_fmt sig_fmt;
+    TPMT_SIG_SCHEME scheme;
+    TPMI_ALG_SIG_SCHEME sig_scheme;
+
+    /*
+     * Outputs
+    */
     struct {
         char *attest;
         char *sig;
     } file_path;
+    TPM2B_ATTEST *certify_info;
+    TPMT_SIGNATURE *signature;
 
-    struct {
-        UINT16 g :1;
-        UINT16 o :1;
-        UINT16 s :1;
-        UINT16 f :1;
-    } flags;
-
-    TPMI_ALG_HASH halg;
-    tpm2_convert_sig_fmt sig_fmt;
-
-    char *cp_hash_path;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
 };
 
 static tpm_certify_ctx ctx = {
     .sig_fmt = signature_format_tss,
+    .halg = TPM2_ALG_NULL,
+    .sig_scheme = TPM2_ALG_NULL,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .scheme = {
+        .scheme = TPM2_ALG_NULL,
+    }
 };
 
-static tool_rc get_key_type(ESYS_CONTEXT *ectx, ESYS_TR object_handle,
-        TPMI_ALG_PUBLIC *type) {
+static tool_rc certify(ESYS_CONTEXT *ectx) {
 
-    TPM2B_PUBLIC *out_public = NULL;
-    tool_rc rc = tpm2_readpublic(ectx, object_handle, &out_public, NULL, NULL);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
-
-    *type = out_public->publicArea.type;
+    TPM2B_DATA qualifying_data = {
+        .size = 4,
+        .buffer = { 0x00, 0xff, 0x55,0xaa },
+    };
 
-    free(out_public);
+    /*
+     * 1. TPM2_CC_<command> OR Retrieve cpHash
+     */
 
-    return tool_rc_success;
+    return tpm2_certify(ectx, &ctx.certified_key.object,
+        &ctx.signing_key.object, &qualifying_data, &ctx.scheme,
+        &ctx.certify_info, &ctx.signature, &ctx.cp_hash, &ctx.rp_hash,
+        ctx.parameter_hash_algorithm, ctx.aux_session_handle0);
 }
 
-static tool_rc set_scheme(ESYS_CONTEXT *ectx, ESYS_TR key_handle,
-        TPMI_ALG_HASH halg, TPMT_SIG_SCHEME *scheme) {
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
-    TPM2_ALG_ID type;
-    tool_rc rc = get_key_type(ectx, key_handle, &type);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
+    UNUSED(ectx);
 
-    switch (type) {
-    case TPM2_ALG_RSA:
-        scheme->scheme = TPM2_ALG_RSASSA;
-        scheme->details.rsassa.hashAlg = halg;
-        break;
-    case TPM2_ALG_KEYEDHASH:
-        scheme->scheme = TPM2_ALG_HMAC;
-        scheme->details.hmac.hashAlg = halg;
-        break;
-    case TPM2_ALG_ECC:
-        scheme->scheme = TPM2_ALG_ECDSA;
-        scheme->details.ecdsa.hashAlg = halg;
-        break;
-    case TPM2_ALG_SYMCIPHER:
-    default:
-        LOG_ERR("Unknown key type, got: 0x%x", type);
-        return tool_rc_general_error;
-    }
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-    return tool_rc_success;
-}
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
 
-static tool_rc certify_and_save_data(ESYS_CONTEXT *ectx) {
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
+    }
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    /* serialization is safe here, since it's just a byte array */
+    is_file_op_success = files_save_bytes_to_file(ctx.file_path.attest,
+        ctx.certify_info->attestationData, ctx.certify_info->size);
+    if (!is_file_op_success) {
+         goto out;
+     }
+
+    is_file_op_success = tpm2_convert_sig_save(ctx.signature, ctx.sig_fmt,
+        ctx.file_path.sig);
+    if (!is_file_op_success) {
+        goto out;
+    }
 
-    TPM2B_DATA qualifying_data = {
-        .size = 4,
-        .buffer = { 0x00, 0xff, 0x55,0xaa }
-    };
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+    }
 
-    tool_rc rc = tool_rc_general_error;
+out:
+    free(ctx.certify_info);
+    free(ctx.signature);
 
-    TPMT_SIG_SCHEME scheme;
-    tool_rc tmp_rc = set_scheme(ectx, ctx.signing_key.object.tr_handle,
-            ctx.halg, &scheme);
-    if (tmp_rc != tool_rc_success) {
-        LOG_ERR("No suitable signing scheme!");
-        return tmp_rc;
-    }
+    return is_file_op_success ? tool_rc_success : tool_rc_general_error;
+}
 
-    TPM2B_ATTEST *certify_info;
-    TPMT_SIGNATURE *signature;
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
-    if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_certify(ectx, &ctx.certified_key.object,
-        &ctx.signing_key.object, &qualifying_data, &scheme, &certify_info,
-        &signature, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
+    /*
+     * 1. Object and auth initializations
+     */
 
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
 
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    /* Object #1 */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.certified_key.ctx_path,
+        ctx.certified_key.auth_str, &ctx.certified_key.object, false,
+        TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
         return rc;
     }
 
-    tmp_rc = tpm2_certify(ectx, &ctx.certified_key.object,
-            &ctx.signing_key.object, &qualifying_data, &scheme, &certify_info,
-            &signature, NULL);
-    if (tmp_rc != tool_rc_success) {
-        return tmp_rc;
+    /* Object #2 */
+    rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
+        ctx.signing_key.auth_str, &ctx.signing_key.object, false,
+        TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        return rc;
     }
-    /* serialization is safe here, since it's just a byte array */
-    bool result = files_save_bytes_to_file(ctx.file_path.attest,
-            certify_info->attestationData, certify_info->size);
-    if (!result) {
-        goto out;
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    result = tpm2_convert_sig_save(signature, ctx.sig_fmt, ctx.file_path.sig);
-    if (!result) {
-        goto out;
+    /*
+     * 3. Command specific initializations
+     */
+    rc = tpm2_alg_util_get_signature_scheme(ectx,
+        ctx.signing_key.object.tr_handle, &ctx.halg, ctx.sig_scheme,
+        &ctx.scheme);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    rc = tool_rc_success;
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.certified_key.object.session,
+        ctx.signing_key.object.session,
+        ctx.aux_session0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
 
-out:
-    free(certify_info);
-    free(signature);
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.cp_hash_path && !ctx.rp_hash_path) ?
+        false : true;
 
     return rc;
 }
 
+static tool_rc check_options(void) {
+
+    if ((!ctx.certified_key.ctx_path) && (!ctx.signing_key.ctx_path)) {
+        LOG_ERR("Must specify the object to be certified and the signing key.");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.cp_hash_path && !ctx.rp_hash_path &&
+       (ctx.file_path.attest || ctx.file_path.sig)) {
+        LOG_ERR("Cannot specify output options when calculating cpHash");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
+
 static bool on_option(char key, char *value) {
 
     switch (key) {
@@ -178,26 +254,42 @@
             LOG_ERR("Could not format algorithm to number, got: \"%s\"", value);
             return false;
         }
-        ctx.flags.g = 1;
         break;
     case 'o':
         ctx.file_path.attest = value;
-        ctx.flags.o = 1;
         break;
     case 's':
         ctx.file_path.sig = value;
-        ctx.flags.s = 1;
         break;
     case 0:
         ctx.cp_hash_path = value;
         break;
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 2:
+        ctx.sig_scheme = tpm2_alg_util_from_optarg(value,
+                tpm2_alg_util_flags_sig);
+        if (ctx.sig_scheme == TPM2_ALG_ERROR) {
+            LOG_ERR("Unknown signing scheme, got: \"%s\"", value);
+            return false;
+        }
+        break;
     case 'f':
-        ctx.flags.f = 1;
         ctx.sig_fmt = tpm2_convert_sig_fmt_from_optarg(value);
-
         if (ctx.sig_fmt == signature_format_err) {
             return false;
         }
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
     }
 
     return true;
@@ -208,57 +300,70 @@
     const struct option topts = {
       { "certifiedkey-context", required_argument, NULL, 'c' },
       { "signingkey-context",   required_argument, NULL, 'C' },
-      { "certifiedkey-auth",    required_argument, NULL, 'p' },
-      { "signingkey-auth",      required_argument, NULL, 'P' },
+      { "certifiedkey-auth",    required_argument, NULL, 'P' },
+      { "signingkey-auth",      required_argument, NULL, 'p' },
       { "hash-algorithm",       required_argument, NULL, 'g' },
       { "attestation",          required_argument, NULL, 'o' },
       { "signature",            required_argument, NULL, 's' },
       { "format",               required_argument, NULL, 'f' },
       { "cphash",               required_argument, NULL,  0  },
+      { "rphash",               required_argument, NULL,  1  },
+      { "scheme",               required_argument, NULL,  2  },
+      { "session",              required_argument, NULL, 'S' },
     };
 
-    *opts = tpm2_options_new("P:p:g:o:s:c:C:f:", ARRAY_LEN(topts), topts,
+    *opts = tpm2_options_new("P:p:g:o:s:c:C:f:S:", ARRAY_LEN(topts), topts,
             on_option, NULL, 0);
 
     return *opts != NULL;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
-    UNUSED(flags);
 
-    if ((!ctx.certified_key.ctx_path) && (!ctx.signing_key.ctx_path)
-            && (ctx.flags.g) && (ctx.flags.o) && (ctx.flags.s)) {
-        return tool_rc_option_error;
-    }
+    UNUSED(flags);
 
-    if (ctx.cp_hash_path && (ctx.file_path.attest || ctx.file_path.sig)) {
-        LOG_ERR("Cannot specify output options when calculating cpHash");
-        return tool_rc_option_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    /* Load input files */
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.certified_key.ctx_path,
-            ctx.certified_key.auth_str, &ctx.certified_key.object, false,
-            TPM2_HANDLE_ALL_W_NV);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
-            ctx.signing_key.auth_str, &ctx.signing_key.object, false,
-            TPM2_HANDLE_ALL_W_NV);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = certify(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    return certify_and_save_data(ectx);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    tool_rc rc = tool_rc_success;
+    /*
+     * 1. Free objects
+     */
 
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
     tool_rc tmp_rc = tpm2_session_close(&ctx.signing_key.object.session);
     if (tmp_rc != tool_rc_success) {
         rc = tmp_rc;
@@ -269,8 +374,22 @@
         rc = tmp_rc;
     }
 
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
     return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("certify", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("certify", tpm2_tool_onstart, tpm2_tool_onrun,
+tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_certifycreation.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_certifycreation.c Changed

@@ -12,9 +12,13 @@
 #include "tpm2_convert.h"
 #include "tpm2_options.h"
 
+#define MAX_AUX_SESSIONS 2 // one session provided by auth interface
+#define MAX_SESSIONS 3
 typedef struct tpm_certifycreation_ctx tpm_certifycreation_ctx;
 struct tpm_certifycreation_ctx {
-    TPMT_TK_CREATION creation_ticket;
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -27,32 +31,262 @@
     } certified_key;
 
     char *creation_hash_path;
+    TPM2B_DIGEST creation_hash;
 
     char *creation_ticket_path;
+    TPMT_TK_CREATION creation_ticket;
+
+    TPM2B_DATA policy_qualifier;
+    const char *policy_qualifier_data;
 
     TPMI_ALG_HASH halg;
     TPMI_ALG_SIG_SCHEME sig_scheme;
     tpm2_convert_sig_fmt sig_format;
+    TPMT_SIG_SCHEME in_scheme;
+
+    /*
+     * Outputs
+     */
     char *signature_path;
+    TPMT_SIGNATURE *signature;
 
     char *certify_info_path;
+    TPM2B_ATTEST *certify_info;
+
+   /*
+    * Parameter hashes
+    */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+    bool is_command_dispatch;
 
-    const char *policy_qualifier_data;
-
-    char *cp_hash_path;
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
 };
 
 static tpm_certifycreation_ctx ctx = {
         .halg = TPM2_ALG_NULL,
-        .sig_scheme = TPM2_ALG_NULL
+        .sig_scheme = TPM2_ALG_NULL,
+        .policy_qualifier = TPM2B_EMPTY_INIT,
+        .aux_session_handle0 = ESYS_TR_NONE,
+        .aux_session_handle1 = ESYS_TR_NONE,
 };
 
-static bool set_digest_algorithm(char *value) {
+static tool_rc certifycreation(ESYS_CONTEXT *ectx) {
 
-    ctx.halg = tpm2_alg_util_from_optarg(value, tpm2_alg_util_flags_hash);
-    if (ctx.halg == TPM2_ALG_ERROR) {
-        LOG_ERR("Could not convert to number or lookup algorithm, got: "
-                "\"%s\"", value);
+    /*
+     * 1. TPM2_CC_<command> OR Retrieve cpHash
+     */
+    return tpm2_certifycreation(ectx, &ctx.signing_key.object,
+        &ctx.certified_key.object, &ctx.creation_hash, &ctx.in_scheme,
+        &ctx.creation_ticket, &ctx.certify_info, &ctx.signature,
+        &ctx.policy_qualifier, &ctx.cp_hash, &ctx.rp_hash,
+        ctx.parameter_hash_algorithm, ctx.aux_session_handle0,
+        ctx.aux_session_handle1);
+}
+
+static tool_rc process_output(void) {
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    is_file_op_success = tpm2_convert_sig_save(ctx.signature, ctx.sig_format,
+        ctx.signature_path);
+    if (!is_file_op_success) {
+        LOG_ERR("Failed saving signature data.");
+        return tool_rc_general_error;
+    }
+
+    is_file_op_success = files_save_bytes_to_file(ctx.certify_info_path,
+        ctx.certify_info->attestationData, ctx.certify_info->size);
+    if (!is_file_op_success) {
+        LOG_ERR("Failed saving attestation data.");
+        return tool_rc_general_error;
+    }
+
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+    }
+
+    return is_file_op_success ? tool_rc_success : tool_rc_general_error;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
+        ctx.signing_key.auth_str, &ctx.signing_key.object, false,
+        TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid signing key/ authorization.");
+        return rc;
+    }
+
+    rc = tpm2_util_object_load(ectx, ctx.certified_key.ctx_path,
+        &ctx.certified_key.object,
+        TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid key specified for certification.");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations
+     */
+
+     /* Load creation hash */
+    rc = files_load_digest(ctx.creation_hash_path, &ctx.creation_hash) ?
+        tool_rc_success : tool_rc_general_error;
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed loading creation hash.");
+        return rc;
+    }
+
+    /* Set signature scheme for key type & Validate chosen scheme */
+    rc = tpm2_alg_util_get_signature_scheme(ectx,
+        ctx.signing_key.object.tr_handle, &ctx.halg, ctx.sig_scheme,
+        &ctx.in_scheme);
+    if (rc != tool_rc_success) {
+        LOG_ERR("bad signature scheme for key type!");
+        return rc;
+    }
+
+    /* Load creation ticket */
+    rc = files_load_creation_ticket(ctx.creation_ticket_path,
+        &ctx.creation_ticket) ? tool_rc_success : tool_rc_general_error;
+    if (rc != tool_rc_success) {
+        LOG_ERR("Could not load creation ticket from file");
+        return rc;
+    }
+
+    /* Qualifier data is optional. If not specified default to 0 */
+    if (ctx.policy_qualifier_data) {
+        ctx.policy_qualifier.size = sizeof(ctx.policy_qualifier.buffer);
+
+        rc = tpm2_util_bin_from_hex_or_file(ctx.policy_qualifier_data,
+            &ctx.policy_qualifier.size, ctx.policy_qualifier.buffer) ?
+            tool_rc_success : tool_rc_general_error;
+        
+        if (rc != tool_rc_success) {
+            LOG_ERR("Could not load qualifier data");
+            return rc;
+        }
+    }
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.certified_key.object.session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.cp_hash_path && !ctx.rp_hash_path) ?
+        false : true;
+
+    return rc;
+}
+
+static bool check_options(void) {
+
+    if (ctx.cp_hash_path && !ctx.rp_hash_path &&
+        (ctx.certify_info_path || ctx.signature_path)) {
+        LOG_ERR("Cannot generate outputs when calculating cpHash.");
+        return false;
+    }
+
+    if (!ctx.signing_key.ctx_path) {
+        LOG_ERR("Must specify the signing key '-C'.");
+        return false;
+    }
+
+    if (!ctx.certified_key.ctx_path) {
+        LOG_ERR("Must specify the path of the key to certify '-c'.");
+        return false;
+    }
+
+    if (!ctx.creation_ticket_path) {
+        LOG_ERR("Must specify the creation ticket path '-t'.");
+        return false;
+    }
+
+    if (!ctx.signature_path && !ctx.cp_hash_path) {
+        LOG_ERR("Must specify the file path to save signature '-o'");
+        return false;
+    }
+
+    if (!ctx.certify_info_path && !ctx.cp_hash_path) {
+        LOG_ERR("Must specify file path to save attestation '--attestation'");
+        return false;
+    }
+
+    return true;
+}
+
+static bool set_signature_format(char *value) {
+
+    ctx.sig_format = tpm2_convert_sig_fmt_from_optarg(value);
+    if (ctx.sig_format == signature_format_err) {
         return false;
     }
     return true;
@@ -68,10 +302,12 @@
     return true;
 }
 
-static bool set_signature_format(char *value) {
+static bool set_digest_algorithm(char *value) {
 
-    ctx.sig_format = tpm2_convert_sig_fmt_from_optarg(value);
-    if (ctx.sig_format == signature_format_err) {
+    ctx.halg = tpm2_alg_util_from_optarg(value, tpm2_alg_util_flags_hash);
+    if (ctx.halg == TPM2_ALG_ERROR) {
+        LOG_ERR("Could not convert to number or lookup algorithm, got: "
+                "\"%s\"", value);
         return false;
     }
     return true;
@@ -115,9 +351,21 @@
     case 1:
         ctx.cp_hash_path = value;
         break;
+    case 2:
+        ctx.rp_hash_path = value;
+        break;
     case 'q':
         ctx.policy_qualifier_data = value;
         break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
         /* no default */
     }
 
@@ -140,195 +388,86 @@
       { "attestation",          required_argument, NULL,  0  },
       { "qualification",        required_argument, NULL, 'q' },
       { "cphash",               required_argument, NULL,  1  },
+      { "rphash",               required_argument, NULL,  2  },
+      { "session",              required_argument, NULL, 'S' },
     };
 
-    *opts = tpm2_options_new("C:P:c:d:t:g:s:f:o:q:", ARRAY_LEN(topts), topts,
+    *opts = tpm2_options_new("C:P:c:d:t:g:s:f:o:q:S:", ARRAY_LEN(topts), topts,
             on_option, NULL, 0);
 
     return *opts != NULL;
 }
 
-static bool is_input_options_args_valid(void) {
-
-    if (ctx.cp_hash_path && (ctx.certify_info_path || ctx.signature_path)) {
-        LOG_ERR("Cannot generate outputs when calculating cpHash.");
-        return false;
-    }
-
-    if (!ctx.signing_key.ctx_path) {
-        LOG_ERR("Must specify the signing key '-C'.");
-        return false;
-    }
-
-    if (!ctx.certified_key.ctx_path) {
-        LOG_ERR("Must specify the path of the key to certify '-c'.");
-        return false;
-    }
-
-    if (!ctx.creation_ticket_path) {
-        LOG_ERR("Must specify the creation ticket path '-t'.");
-        return false;
-    }
-
-    if (!ctx.signature_path && !ctx.cp_hash_path) {
-        LOG_ERR("Must specify the file path to save signature '-o'");
-        return false;
-    }
-
-    if (!ctx.certify_info_path && !ctx.cp_hash_path) {
-        LOG_ERR("Must specify file path to save attestation '--attestation'");
-        return false;
-    }
-
-    return true;
-}
-
-static tool_rc process_certifycreation_input(ESYS_CONTEXT *ectx,
-    TPM2B_DIGEST *creation_hash, TPMT_SIG_SCHEME *in_scheme,
-    TPMT_TK_CREATION *creation_ticket, TPM2B_DATA *policy_qualifier) {
-
-    /*
-     * Load objects and auths
-     */
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
-            ctx.signing_key.auth_str, &ctx.signing_key.object, false,
-            TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Invalid signing key/ authorization.");
-        return rc;
-    }
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
-    rc = tpm2_util_object_load(ectx, ctx.certified_key.ctx_path,
-        &ctx.certified_key.object,
-        TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Invalid key specified for certification.");
-        return rc;
-    }
+    UNUSED(flags);
 
     /*
-     * Load creation hash
+     * 1. Process options
      */
-    bool result = files_load_digest(ctx.creation_hash_path, creation_hash);
+    bool result = check_options();
     if (!result) {
-        LOG_ERR("Failed loading creation hash.");
-        return tool_rc_general_error;
+        return tool_rc_option_error;
     }
 
-    /*
-     * Set signature scheme for key type
-     * Validate chosen scheme is allowed for key type
+   /*
+     * 2. Process inputs
      */
-    rc = tpm2_alg_util_get_signature_scheme(ectx,
-        ctx.signing_key.object.tr_handle, &ctx.halg, ctx.sig_scheme, in_scheme);
+    tool_rc rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("bad signature scheme for key type!");
         return rc;
     }
 
     /*
-     * Load creation ticket
+     * 3. TPM2_CC_<command> call
      */
-    result = files_load_creation_ticket(ctx.creation_ticket_path,
-        creation_ticket);
-    if (!result) {
-        LOG_ERR("Could not load creation ticket from file");
-        return tool_rc_general_error;
+    rc = certifycreation(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     /*
-     * Qualifier data is optional. If not specified default to 0
+     * 4. Process outputs
      */
-    if (!ctx.policy_qualifier_data) {
-        return tool_rc_success;
-    }
-
-    policy_qualifier->size = sizeof(policy_qualifier->buffer);
-    result = tpm2_util_bin_from_hex_or_file(ctx.policy_qualifier_data,
-            &policy_qualifier->size, policy_qualifier->buffer);
-
-    return result ? tool_rc_success : tool_rc_general_error;;
-}
-
-static tool_rc process_certifycreation_output(TPMT_SIGNATURE *signature,
-    TPM2B_ATTEST *certify_info) {
-
-    bool result = tpm2_convert_sig_save(signature, ctx.sig_format,
-        ctx.signature_path);
-    if (!result) {
-        LOG_ERR("Failed saving signature data.");
-        return tool_rc_general_error;
-    }
-
-    result = files_save_bytes_to_file(ctx.certify_info_path,
-        certify_info->attestationData, certify_info->size);
-    if (!result) {
-        LOG_ERR("Failed saving attestation data.");
-        return tool_rc_general_error;
-    }
+    rc = process_output();
 
-    return tool_rc_success;
+    return rc;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
 
-    UNUSED(flags);
+    UNUSED(ectx);
 
-    bool result = is_input_options_args_valid();
-    if (!result) {
-        return tool_rc_option_error;
-    }
+    /*
+     * 1. Free objects
+     */
+    Esys_Free(ctx.signature);
+    Esys_Free(ctx.certify_info);
 
-    //Input
-    TPM2B_DIGEST creation_hash;
-    TPMT_SIG_SCHEME in_scheme;
-    TPMT_TK_CREATION creation_ticket;
-    TPM2B_DATA policy_qualifier = TPM2B_EMPTY_INIT;
-    tool_rc rc = process_certifycreation_input(ectx, &creation_hash, &in_scheme,
-        &creation_ticket, &policy_qualifier);
-    if (rc != tool_rc_success) {
-        return rc;
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.signing_key.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
-
-    //ESAPI call
-    TPMT_SIGNATURE *signature = NULL;
-    TPM2B_ATTEST *certify_info = NULL;
-    if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        rc = tpm2_certifycreation(ectx, &ctx.signing_key.object,
-        &ctx.certified_key.object, &creation_hash, &in_scheme, &creation_ticket,
-        &certify_info, &signature, &policy_qualifier, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
         }
-        return rc;
     }
 
-    rc = tpm2_certifycreation(ectx, &ctx.signing_key.object,
-        &ctx.certified_key.object, &creation_hash, &in_scheme, &creation_ticket,
-        &certify_info, &signature, &policy_qualifier, NULL);
-    if (rc != tool_rc_success) {
-        goto tpm2_tool_onrun_out;
-    }
-
-    //Output
-    rc = process_certifycreation_output(signature, certify_info);
-
-tpm2_tool_onrun_out:
-    Esys_Free(signature);
-    Esys_Free(certify_info);
     return rc;
 }
 
-static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
-    UNUSED(ectx);
-    return tpm2_session_close(&ctx.signing_key.object.session);
-}
-
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("certifycreation", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("certifycreation", tpm2_tool_onstart, tpm2_tool_onrun,
+tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_changeauth.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_changeauth.c Changed

@@ -10,8 +10,12 @@
 #include "tpm2_options.h"
 
 typedef struct changeauth_ctx changeauth_ctx;
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2 // It's possible that parent auth may not be needed
 struct changeauth_ctx {
-
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx;
         tpm2_loaded_object obj;
@@ -23,90 +27,261 @@
         const char *ctx;
         tpm2_loaded_object obj;
         tpm2_session *new;
+
+    /*
+     * Outputs
+     */
         const char *out_path;
     } object;
+    TPM2B_PRIVATE *out_private;
+    const TPM2B_AUTH *new_auth;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
+};
 
-    char *cp_hash_path;
+static changeauth_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
 };
 
-static changeauth_ctx ctx;
+static tool_rc hierarchy_change_auth(ESYS_CONTEXT *ectx) {
 
-static tool_rc hierarchy_change_auth(ESYS_CONTEXT *ectx,
-        const TPM2B_AUTH *new_auth) {
+    return tpm2_hierarchy_change_auth(ectx, &ctx.object.obj, ctx.new_auth,
+        &ctx.cp_hash, &ctx.rp_hash, ctx.parameter_hash_algorithm,
+        ctx.aux_session_handle0, ctx.aux_session_handle1);
+}
 
-    if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_hierarchy_change_auth(ectx, &ctx.object.obj, new_auth,
-            &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
+static tool_rc nv_change_auth(ESYS_CONTEXT *ectx) {
 
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
-        return rc;
+    return tpm2_nv_change_auth(ectx, &ctx.object.obj, ctx.new_auth,
+        &ctx.cp_hash, &ctx.rp_hash, ctx.parameter_hash_algorithm,
+        ctx.aux_session_handle0, ctx.aux_session_handle1);
+}
+
+static tool_rc object_change_auth(ESYS_CONTEXT *ectx) {
+
+    if (!ctx.object.out_path) {
+        LOG_ERR("Require private output file path option -r");
+        return tool_rc_general_error;
     }
 
-    return tpm2_hierarchy_change_auth(ectx, &ctx.object.obj, new_auth, NULL);
+    return tpm2_object_change_auth(ectx, &ctx.parent.obj, &ctx.object.obj,
+        ctx.new_auth, &ctx.out_private, &ctx.cp_hash, &ctx.rp_hash,
+        ctx.parameter_hash_algorithm, ctx.aux_session_handle0,
+        ctx.aux_session_handle1);
 }
 
-static tool_rc nv_change_auth(ESYS_CONTEXT *ectx, const TPM2B_AUTH *new_auth) {
+static tool_rc change_authorization(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. TPM2_CC_<command> OR Retrieve cpHash
+     */
 
+    tool_rc rc = tool_rc_success;
+
+    /* invoke the proper changauth command based on object type */
+    UINT8 tag = (ctx.object.obj.handle & TPM2_HR_RANGE_MASK) >> TPM2_HR_SHIFT;
+    switch (tag) {
+    case TPM2_HT_TRANSIENT:
+    case TPM2_HT_PERSISTENT:
+        rc = object_change_auth(ectx);
+        break;
+    case TPM2_HT_NV_INDEX:
+        rc = nv_change_auth(ectx);
+        break;
+    case TPM2_HT_PERMANENT:
+        rc = hierarchy_change_auth(ectx);
+        break;
+    default:
+        LOG_ERR("Unsupported object type, got: 0x%x", tag);
+        rc = tool_rc_general_error;
+    }
+
+    return rc;
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
     if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_nv_change_auth(ectx, &ctx.object.obj, new_auth,
-            &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
         }
+    }
 
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    if (ctx.is_command_dispatch && ctx.out_private) {
+        is_file_op_success = files_save_private(ctx.out_private,
+            ctx.object.out_path);
+        free(ctx.out_private);
+
+        if (!is_file_op_success) {
+            LOG_ERR("Failed to save the sensitive key portion");
+            return tool_rc_general_error;
         }
-        return rc;
     }
 
-    return tpm2_nv_change_auth(ectx, &ctx.object.obj, new_auth, NULL);
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+    }
+
+    return is_file_op_success ? tool_rc_success : tool_rc_general_error;
 }
 
-static tool_rc object_change_auth(ESYS_CONTEXT *ectx,
-        const TPM2B_AUTH *new_auth) {
+static inline bool object_needs_parent(tpm2_loaded_object *obj) {
 
-    if (!ctx.object.out_path) {
-        LOG_ERR("Require private output file path option -r");
+    TPM2_HC h = obj->handle & TPM2_HR_RANGE_MASK;
+    return (h == TPM2_HR_TRANSIENT) || (h == TPM2_HR_PERSISTENT);
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+    tool_rc rc = tpm2_auth_util_from_optarg(ectx, ctx.object.auth_new,
+        &ctx.object.new, true);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    ctx.new_auth = tpm2_session_get_auth_value(ctx.object.new);
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+     /* Note: Old-auth value is ignored when calculating cpHash */
+
+    /* Object #1 */
+    rc = tpm2_util_object_load_auth(ectx, ctx.object.ctx,
+        ctx.object.auth_current, &ctx.object.obj, false, TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    if (ctx.object.obj.tr_handle == ESYS_TR_RH_NULL) {
+        LOG_ERR("Cannot change the null hierarchy authorization");
         return tool_rc_general_error;
     }
+    /* transient objects or persistent objects need parents */
+    bool load_parent = object_needs_parent(&ctx.object.obj);
+    if (load_parent && !ctx.parent.ctx) {
+        LOG_ERR("Expected parent object information via -C");
+        return tool_rc_option_error;
+    }
 
-    TPM2B_PRIVATE *out_private = NULL;
+    /* Object #2 */
+    if (load_parent) {
+        rc = tpm2_util_object_load(ectx, ctx.parent.ctx, &ctx.parent.obj,
+            TPM2_HANDLE_ALL_W_NV);
 
-    if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_object_change_auth(ectx, &ctx.parent.obj, &ctx.object.obj,
-            new_auth, &out_private, &cp_hash);
         if (rc != tool_rc_success) {
             return rc;
         }
-
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
-        return rc;
     }
 
-    tool_rc rc = tpm2_object_change_auth(ectx, &ctx.parent.obj, &ctx.object.obj,
-            new_auth, &out_private, NULL);
+    /* 
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    bool res = files_save_private(out_private, ctx.object.out_path);
-    free(out_private);
+    /*
+     * 3. Command specific initializations dependent on loaded objects
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
 
-    return res ? tool_rc_success : tool_rc_general_error;
+    /* 4.a Determine pHash length and alg */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.object.obj.session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    /* 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.cp_hash_path && !ctx.rp_hash_path) ?
+        false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
+
+    /* load the object to call changeauth on */
+    if (!ctx.object.ctx) {
+        LOG_ERR("Expected object information via -c");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.cp_hash_path && !ctx.rp_hash_path) {
+        LOG_WARN("Auth not changed. Only cpHash is calculated.");
+    }
+
+    return tool_rc_success;
+}
+
+static bool on_arg(int argc, char *argv) {
+
+    if (argc != 1) {
+        LOG_ERR("Expected 1 new password argument, got: %d", argc);
+        return false;
+    }
+
+    ctx.object.auth_new = argv0;
+
+    return true;
 }
 
 static bool on_option(char key, char *value) {
@@ -130,24 +305,24 @@
     case 0:
         ctx.cp_hash_path = value;
         break;
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
         /*no default */
     }
 
     return true;
 }
 
-static bool on_arg(int argc, char *argv) {
-
-    if (argc != 1) {
-        LOG_ERR("Expected 1 new password argument, got: %d", argc);
-        return false;
-    }
-
-    ctx.object.auth_new = argv0;
-
-    return true;
-}
-
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     struct option topts = {
@@ -155,109 +330,93 @@
         { "object-context", required_argument, NULL, 'c' },
         { "parent-context", required_argument, NULL, 'C' },
         { "private",        required_argument, NULL, 'r' },
-         {"cphash",         required_argument, NULL,  0  },
+        { "cphash",         required_argument, NULL,  0  },
+        { "rphash",         required_argument, NULL,  1  },
+        { "session",        required_argument, NULL, 'S' },
     };
-    *opts = tpm2_options_new("p:c:C:r:", ARRAY_LEN(topts), topts,
+    *opts = tpm2_options_new("p:c:C:r:S:", ARRAY_LEN(topts), topts,
                              on_option, on_arg, 0);
 
     return *opts != NULL;
 }
 
-static inline bool object_needs_parent(tpm2_loaded_object *obj) {
-
-    TPM2_HC h = obj->handle & TPM2_HR_RANGE_MASK;
-    return (h == TPM2_HR_TRANSIENT) || (h == TPM2_HR_PERSISTENT);
-}
-
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    /* load the object to call changeauth on */
-    if (!ctx.object.ctx) {
-        LOG_ERR("Expected object information via -c");
-        return tool_rc_option_error;
-    }
-
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.object.ctx,
-            ctx.object.auth_current, &ctx.object.obj, false,
-            TPM2_HANDLE_ALL_W_NV);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    if (ctx.object.obj.tr_handle == ESYS_TR_RH_NULL) {
-        LOG_ERR("Cannot change the null hierarchy authorization");
-        return tool_rc_general_error;
-    }
-
-    /* transient objects or persistent objects need parents */
-    bool load_parent = object_needs_parent(&ctx.object.obj);
-    if (load_parent) {
-
-        if (!ctx.parent.ctx) {
-            LOG_ERR("Expected parent object information via -C");
-            return tool_rc_option_error;
-        }
-
-        rc = tpm2_util_object_load(ectx, ctx.parent.ctx, &ctx.parent.obj,
-                TPM2_HANDLE_ALL_W_NV);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-    }
-
-    rc = tpm2_auth_util_from_optarg(ectx, ctx.object.auth_new, &ctx.object.new,
-            true);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    const TPM2B_AUTH *new_auth = tpm2_session_get_auth_value(ctx.object.new);
-
-    /* invoke the proper changauth command based on object type */
-    UINT8 tag = (ctx.object.obj.handle & TPM2_HR_RANGE_MASK) >> TPM2_HR_SHIFT;
-    switch (tag) {
-    case TPM2_HT_TRANSIENT:
-    case TPM2_HT_PERSISTENT:
-        rc = object_change_auth(ectx, new_auth);
-        break;
-    case TPM2_HT_NV_INDEX:
-        rc = nv_change_auth(ectx, new_auth);
-        break;
-    case TPM2_HT_PERMANENT:
-        rc = hierarchy_change_auth(ectx, new_auth);
-        break;
-    default:
-        LOG_ERR("Unsupported object type, got: 0x%x", tag);
-        rc = tool_rc_general_error;
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = change_authorization(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
     tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.object.new);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
+    }
 
-    tool_rc tmp = tpm2_session_close(&ctx.object.new);
-    if (tmp != tool_rc_success) {
-        rc = tmp;
+    tmp_rc = tpm2_session_close(&ctx.object.obj.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
 
-    tmp = tpm2_session_close(&ctx.object.obj.session);
-    if (tmp != tool_rc_success) {
-        rc = tmp;
+    tmp_rc = tpm2_session_close(&ctx.parent.obj.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
 
-    tmp = tpm2_session_close(&ctx.parent.obj.session);
-    if (tmp != tool_rc_success) {
-        rc = tmp;
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
     }
 
     return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("changeauth", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("changeauth", tpm2_tool_onstart, tpm2_tool_onrun,
+tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_changeeps.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_changeeps.c Changed

@@ -1,5 +1,6 @@
 /* SPDX-License-Identifier: BSD-3-Clause */
 
+#include "files.h"
 #include "log.h"
 #include "tpm2.h"
 #include "tpm2_auth_util.h"
@@ -7,13 +8,148 @@
 #include "tpm2_tool.h"
 
 typedef struct changeeps_ctx changeeps_ctx;
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2
 struct changeeps_ctx {
+    /*
+     * Inputs
+     */
     const char *auth_str;
     tpm2_session *auth_session;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
+};
+
+static changeeps_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
 };
 
-static changeeps_ctx ctx;
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            LOG_ERR("Failed to save cpHash");
+            return tool_rc_general_error;
+        }
+    }
+
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+    }
+
+    return is_file_op_success ? tool_rc_success : tool_rc_general_error;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_auth_util_from_optarg(ectx, ctx.auth_str,
+        &ctx.auth_session, false);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed loading platform auth.");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations dependent on loaded objects
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.cp_hash_path && !ctx.rp_hash_path) ?
+        false : true;
+
+    return tool_rc_success;
+}
 
+static tool_rc check_options(void) {
+
+    if (ctx.cp_hash_path && !ctx.rp_hash_path) {
+        LOG_WARN("EPS not changed. Only cpHash is calculated.");
+    }
+
+    return tool_rc_success;
+}
 
 static bool on_option(char key, char *value) {
 
@@ -21,6 +157,21 @@
     case 'p':
         ctx.auth_str = value;
         break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
     }
 
     return true;
@@ -29,10 +180,13 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static struct option topts = {
-        { "auth", required_argument, NULL, 'p' },
+        { "auth",   required_argument, NULL, 'p' },
+        { "cphash", required_argument, NULL,  0  },
+        { "rphash", required_argument, NULL,  1  },
+        { "session",required_argument, NULL, 'S' },
     };
 
-    *opts = tpm2_options_new("p:", ARRAY_LEN(topts), topts, on_option, NULL, 0);
+    *opts = tpm2_options_new("p:S:", ARRAY_LEN(topts), topts, on_option, NULL, 0);
 
     return *opts != NULL;
 }
@@ -41,21 +195,68 @@
 
     UNUSED(flags);
 
-    tool_rc rc = tpm2_auth_util_from_optarg(ectx, ctx.auth_str,
-        &ctx.auth_session,
-        false);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Failed loading platform auth.");
         return rc;
     }
 
-    return tpm2_changeeps(ectx, ctx.auth_session);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = tpm2_changeeps(ectx, ctx.auth_session, &ctx.cp_hash, &ctx.rp_hash,
+        ctx.parameter_hash_algorithm, ctx.aux_session_handle0,
+        ctx.aux_session_handle1);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    return tpm2_session_close(&ctx.auth_session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
+    }
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_changepps.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_changepps.c Changed

@@ -1,5 +1,6 @@
 /* SPDX-License-Identifier: BSD-3-Clause */
 
+#include "files.h"
 #include "log.h"
 #include "tpm2.h"
 #include "tpm2_auth_util.h"
@@ -7,13 +8,148 @@
 #include "tpm2_tool.h"
 
 typedef struct changepps_ctx changepps_ctx;
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2
 struct changepps_ctx {
+    /*
+     * Inputs
+     */
     const char *auth_str;
     tpm2_session *auth_session;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
+};
+
+static changepps_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
 };
 
-static changepps_ctx ctx;
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            LOG_ERR("Failed to save cpHash");
+            return tool_rc_general_error;
+        }
+    }
+
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+    }
+
+    return is_file_op_success ? tool_rc_success : tool_rc_general_error;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_auth_util_from_optarg(ectx, ctx.auth_str,
+        &ctx.auth_session, false);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed loading platform auth.");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations dependent on loaded objects
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+    cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.cp_hash_path && !ctx.rp_hash_path) ?
+        false : true;
+
+    return tool_rc_success;
+}
 
+static tool_rc check_options(void) {
+
+    if (ctx.cp_hash_path && !ctx.rp_hash_path) {
+        LOG_WARN("EPS not changed. Only cpHash is calculated.");
+    }
+
+    return tool_rc_success;
+}
 
 static bool on_option(char key, char *value) {
 
@@ -21,6 +157,21 @@
     case 'p':
         ctx.auth_str = value;
         break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
     }
 
     return true;
@@ -29,10 +180,13 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static struct option topts = {
-        { "auth", required_argument, NULL, 'p' },
+        { "auth",   required_argument, NULL, 'p' },
+        { "cphash", required_argument, NULL,  0  },
+        { "rphash", required_argument, NULL,  1  },
+        { "session",required_argument, NULL, 'S' },
     };
 
-    *opts = tpm2_options_new("p:", ARRAY_LEN(topts), topts, on_option, NULL, 0);
+    *opts = tpm2_options_new("p:S:", ARRAY_LEN(topts), topts, on_option, NULL, 0);
 
     return *opts != NULL;
 }
@@ -41,22 +195,70 @@
 
     UNUSED(flags);
 
-    tool_rc rc = tpm2_auth_util_from_optarg(ectx, ctx.auth_str,
-        &ctx.auth_session,
-        false);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Failed loading platform auth.");
         return rc;
     }
 
-    return tpm2_changepps(ectx, ctx.auth_session);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = tpm2_changepps(ectx, ctx.auth_session, &ctx.cp_hash, &ctx.rp_hash,
+        ctx.parameter_hash_algorithm, ctx.aux_session_handle0,
+        ctx.aux_session_handle1);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    return tpm2_session_close(&ctx.auth_session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
+    }
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("changepps", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("changepps", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_clear.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_clear.c Changed

@@ -5,33 +5,137 @@
 #include "tpm2.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct clear_ctx clear_ctx;
 struct clear_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
         tpm2_loaded_object object;
     } auth_hierarchy;
 
-    char *cp_hash_path;
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static clear_ctx ctx = {
     .auth_hierarchy.ctx_path = "l",
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static bool on_option(char key, char *value) {
+static tool_rc clear(ESYS_CONTEXT *ectx) {
 
-    switch (key) {
-    case 'c':
-        ctx.auth_hierarchy.ctx_path = value;
-        break;
-    case 0:
-        ctx.cp_hash_path = value;
-        break;
+    return tpm2_clear(ectx, &ctx.auth_hierarchy.object, &ctx.cp_hash,
+        ctx.parameter_hash_algorithm);
+}
+
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
     }
 
-    return true;
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    return rc;
+}
+
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_L | TPM2_HANDLE_FLAGS_P);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid lockout authorization");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    if (!ctx.is_command_dispatch) {
+        LOG_WARN("Generating cpHash. Exiting without executing clear.");
+    }
+
+    return tool_rc_success;
 }
 
 static bool on_arg(int argc, char **argv) {
@@ -41,8 +145,10 @@
         return false;
     }
 
+    /*
+     * empty auth
+     */
     if (!argc) {
-        //empty auth
         return true;
     }
 
@@ -51,54 +157,87 @@
     return true;
 }
 
+static bool on_option(char key, char *value) {
+
+    switch (key) {
+    case 'c':
+        ctx.auth_hierarchy.ctx_path = value;
+        break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
+    }
+
+    return true;
+}
+
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
-        { "auth-hierarchy",     no_argument,       NULL, 'c' },
-        { "cphash",             required_argument, NULL,  0  },
+        { "auth-hierarchy", required_argument, 0, 'c' },
+        { "cphash",         required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("c:", ARRAY_LEN(topts), topts, on_option, on_arg,
             0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_L | TPM2_HANDLE_FLAGS_P);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid lockout authorization");
         return rc;
     }
 
-    if (ctx.cp_hash_path) {
-        LOG_WARN("Generating cpHash. Exiting without executing clear.");
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_clear(ectx, &ctx.auth_hierarchy.object, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
 
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = clear(ectx);
+    if (rc != tool_rc_success) {
         return rc;
     }
 
-    return tpm2_clear(ectx, &ctx.auth_hierarchy.object, NULL);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("clear", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("clear", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_clearcontrol.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_clearcontrol.c Changed

@@ -7,8 +7,12 @@
 #include "tpm2.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct clearcontrol_ctx clearcontrol_ctx;
 struct clearcontrol_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -17,12 +21,23 @@
 
     TPMI_YES_NO disable_clear;
 
-    char *cp_hash_path;
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static clearcontrol_ctx ctx = {
     .auth_hierarchy.ctx_path = "p",
     .disable_clear = 0,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
 static tool_rc clearcontrol(ESYS_CONTEXT *ectx) {
@@ -32,23 +47,110 @@
              ctx.auth_hierarchy.object.tr_handle == ESYS_TR_RH_PLATFORM ?
                 "TPM2_RH_PLATFORM" : "TPM2_RH_LOCKOUT");
 
+    return tpm2_clearcontrol(ectx, &ctx.auth_hierarchy.object,
+        ctx.disable_clear, &ctx.cp_hash, ctx.parameter_hash_algorithm);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
     if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_clearcontrol(ectx, &ctx.auth_hierarchy.object,
-        ctx.disable_clear, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
         }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
         return rc;
     }
 
-    return tpm2_clearcontrol(ectx, &ctx.auth_hierarchy.object,
-    ctx.disable_clear, NULL);
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    return rc;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_L | TPM2_HANDLE_FLAGS_P);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid lockout authorization");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    if (!ctx.disable_clear
+            && ctx.auth_hierarchy.object.tr_handle == ESYS_TR_RH_LOCKOUT) {
+        LOG_ERR("Only platform hierarchy handle can be specified"
+                " for CLEAR operation on disableClear");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    if (ctx.disable_clear != 0 && ctx.disable_clear != 1) {
+        LOG_ERR("Please use 0|1|s|c as the argument to specify operation");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
 }
 
 static bool on_arg(int argc, char **argv) {
@@ -77,12 +179,7 @@
     bool result = tpm2_util_string_to_uint32(argv0, &value);
     if (!result) {
         LOG_ERR("Please specify 0|1|s|c. Could not convert string, got: \"%s\"",
-                argv0);
-        return false;
-    }
-
-    if (value != 0 && value != 1) {
-        LOG_ERR("Please use 0|1|s|c as the argument to specify operation");
+            argv0);
         return false;
     }
     ctx.disable_clear = value;
@@ -110,47 +207,71 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
-        { "hierarchy",      required_argument, NULL, 'C' },
-        { "auth",           required_argument, NULL, 'P' },
-        { "cphash",         required_argument, NULL,  0  },
+        { "hierarchy",      required_argument, 0, 'C' },
+        { "auth",           required_argument, 0, 'P' },
+        { "cphash",         required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("C:P:", ARRAY_LEN(topts), topts, on_option, on_arg,
             0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_P | TPM2_HANDLE_FLAGS_L);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid authorization");
         return rc;
     }
 
-    if (!ctx.disable_clear
-            && ctx.auth_hierarchy.object.tr_handle == ESYS_TR_RH_LOCKOUT) {
-        LOG_ERR("Only platform hierarchy handle can be specified"
-                " for CLEAR operation on disableClear");
-        return tool_rc_general_error;
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    if (ctx.cp_hash_path) {
-        LOG_WARN("Calculating cpHash. Exiting without configuring disableClear");
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = clearcontrol(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return clearcontrol(ectx);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("clearcontrol", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("clearcontrol", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_clockrateadjust.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_clockrateadjust.c Changed

@@ -7,53 +7,174 @@
 #include "tpm2_tool.h"
 #include "tpm2_util.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm2_setclock_ctx tpm2_setclock_ctx;
 struct tpm2_setclock_ctx {
+    /*
+     * Inputs
+     */
+    struct {
+        const char *ctx_path;
+        const char *auth_str;
+        tpm2_loaded_object object;
+    } auth_hierarchy;
+
+    const char *adjustment;
     TPM2_CLOCK_ADJUST adjust;
-    const char *auth_hierarchy;
-    tpm2_loaded_object object;
-    const char *auth_value;
-    char *cp_hash_path;
+    bool is_slower;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm2_setclock_ctx ctx = {
-        .auth_hierarchy = "o" /* default to owner hierarchy */
+    .auth_hierarchy.ctx_path = "o", /* default to owner hierarchy */
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static bool on_arg(int argc, char **argv) {
 
-    if (argc != 1) {
-        LOG_ERR("Can only specify 1 clock rate adjust specifier, got: %d", argc);
-        return false;
+static tool_rc clockrateadjust(ESYS_CONTEXT *ectx) {
+
+    return tpm2_clockrateadjust(ectx, &ctx.auth_hierarchy.object, ctx.adjust,
+        &ctx.cp_hash, ctx.parameter_hash_algorithm);
+}
+
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    return rc;
+}
+
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid lockout authorization");
+        return rc;
     }
 
-    const char *adjustment = argv0;
+    /*
+     * 2. Restore auxiliary sessions
+     */
 
-    size_t len = strlen(adjustment);
+    /*
+     * 3. Command specific initializations
+     */
+    if (ctx.is_slower) {
+        ctx.adjust -= strlen(ctx.adjustment);
+    } else {
+        ctx.adjust += strlen(ctx.adjustment);
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    size_t len = strlen(ctx.adjustment);
     if (len > 3) {
         LOG_ERR("Expected at most 3 adjustment characters");
-        return false;
+        return tool_rc_option_error;
     }
 
     static const char slower = "sss";
     static const char faster = "fff";
+    ctx.is_slower = ctx.adjustment0 == 's';
+    const char *compare = ctx.is_slower ? slower : faster;
 
-    bool is_slower = adjustment0 == 's';
-    const char *compare = is_slower ? slower : faster;
-
-    bool is_equal = !strncmp(adjustment, compare, len);
+    bool is_equal = !strncmp(ctx.adjustment, compare, len);
     if (!is_equal) {
         LOG_ERR("Adjustment specifier should be consistent, either all "
-                "'s' or all 'f' characters got: \"%s\"", adjustment);
-        return false;
+                "'s' or all 'f' characters got: \"%s\"", ctx.adjustment);
+        return tool_rc_option_error;
     }
 
-    if (is_slower) {
-        ctx.adjust -= len;
-    } else {
-        ctx.adjust += len;
+    LOG_INFO("adjust value: %d", ctx.adjust);
+
+    return tool_rc_success;
+}
+
+static bool on_arg(int argc, char **argv) {
+
+    if (argc != 1) {
+        LOG_ERR("Can only specify 1 clock rate adjust specifier, got: %d", argc);
+        return false;
     }
 
+    ctx.adjustment = argv0;
+
     return true;
 }
 
@@ -61,10 +182,10 @@
 
     switch (key) {
     case 'c':
-        ctx.auth_hierarchy = value;
+        ctx.auth_hierarchy.ctx_path = value;
         break;
     case 'p':
-        ctx.auth_value = value;
+        ctx.auth_hierarchy.auth_str = value;
         break;
     case 0:
         ctx.cp_hash_path = value;
@@ -78,52 +199,71 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
-        { "hierarchy", required_argument, NULL, 'c' },
-        { "auth",      required_argument, NULL, 'p' },
-        { "cphash",    required_argument, NULL,  0  },
+        { "hierarchy", required_argument, 0, 'c' },
+        { "auth",      required_argument, 0, 'p' },
+        { "cphash",    required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("c:p:", ARRAY_LEN(topts), topts, on_option,
     on_arg, 0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy,
-            ctx.auth_value, &ctx.object, false,
-            TPM2_HANDLE_FLAGS_P|TPM2_HANDLE_FLAGS_O);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    LOG_INFO("adjust value: %d", ctx.adjust);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
 
-    if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        LOG_WARN("Calculating cpHash. Exiting without setting clock.");
-        rc = tpm2_clockrateadjust(ectx, &ctx.object, ctx.adjust, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = clockrateadjust(ectx);
+    if (rc != tool_rc_success) {
         return rc;
     }
 
-    return tpm2_clockrateadjust(ectx, &ctx.object, ctx.adjust, NULL);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    return tpm2_session_close(&ctx.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("clockrateadjust", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("clockrateadjust", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_commit.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_commit.c Changed

@@ -11,7 +11,9 @@
 
 typedef struct tpm_ecephemeral_ctx tpm_ecephemeral_ctx;
 struct tpm_ecephemeral_ctx {
-
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -21,99 +23,88 @@
     char *basepoint_x_coordinate_data_path;
     char *basepoint_y_data_path;
     char *eccpoint_M_data_path;
-    char *eccpoint_K_data_path;
-    char *eccpoint_L_data_path;
-    char *eccpoint_E_data_path;
-    char *commit_counter_path;
 
     TPM2B_ECC_POINT P1;
     TPM2B_SENSITIVE_DATA s2;
     TPM2B_ECC_PARAMETER y2;
 
+    /*
+     * Outputs
+     */
+    char *eccpoint_K_data_path;
     TPM2B_ECC_POINT *K;
+    char *eccpoint_L_data_path;
     TPM2B_ECC_POINT *L;
+    char *eccpoint_E_data_path;
     TPM2B_ECC_POINT *E;
-
+    char *commit_counter_path;
     uint16_t counter;
+
+    /*
+     * Parameter hashes
+     */
+    char *cp_hash_path;
+    TPM2B_DIGEST *cphash;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
 };
 
 static tpm_ecephemeral_ctx ctx;
 
-static bool on_option(char key, char *value) {
+static tool_rc commit(ESYS_CONTEXT *ectx) {
 
-    switch (key) {
-        case 'p':
-            ctx.signing_key.auth_str = value;
-            break;
-        case 'c':
-            ctx.signing_key.ctx_path = value;
-            break;
-        case 0:
-            ctx.basepoint_y_data_path = value;
-            break;
-        case 1:
-            ctx.eccpoint_M_data_path = value;
-            break;
-        case 2:
-            ctx.eccpoint_K_data_path = value;
-            break;
-        case 3:
-            ctx.eccpoint_L_data_path = value;
-            break;
-        case 'u':
-            ctx.eccpoint_E_data_path = value;
-            break;
-        case 't':
-            ctx.commit_counter_path = value;
-            break;
-    };
-
-    return true;
+    return tpm2_commit(ectx, &ctx.signing_key.object, &ctx.P1, &ctx.s2, &ctx.y2,
+        &ctx.K, &ctx.L, &ctx.E, &ctx.counter, ctx.cphash);
 }
 
-static bool on_args(int argc, char **argv) {
-
-    if (argc > 1) {
-        LOG_ERR("Specify single argument with file input containing the "
-                "octet array used to derive x-coordinate of a base point");
-        return false;
-    }
-
-    ctx.basepoint_x_coordinate_data_path = strcmp("-", argv0) ? argv0 : NULL;
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
 
-    return files_load_bytes_from_buffer_or_file_or_stdin(NULL,
-        ctx.basepoint_x_coordinate_data_path, &ctx.s2.size, ctx.s2.buffer);
-}
+    UNUSED(ectx);
 
-static bool tpm2_tool_onstart(tpm2_options **opts) {
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-    static struct option topts = {
-      { "auth",        required_argument, NULL, 'p' },
-      { "context",     required_argument, NULL, 'c' },
-      { "basepoint-y", required_argument, NULL,  0  },
-      { "eccpoint-P",  required_argument, NULL,  1  },
-      { "eccpoint-K",  required_argument, NULL,  2  },
-      { "eccpoint-L",  required_argument, NULL,  3  },
-      { "public",      required_argument, NULL, 'u' },
-      { "counter",     required_argument, NULL, 't' },
-    };
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
 
-    *opts = tpm2_options_new("p:c:t:u:", ARRAY_LEN(topts), topts,
-            on_option, on_args, 0);
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
 
-    return *opts != NULL;
-}
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    is_file_op_success = files_save_ecc_point(ctx.K, ctx.eccpoint_K_data_path);
+    if (!is_file_op_success) {
+        LOG_ERR("Failed to write out the ECC point K");
+        return tool_rc_general_error;
+    }
 
-static tool_rc check_options(void) {
+    is_file_op_success = files_save_ecc_point(ctx.L, ctx.eccpoint_L_data_path);
+    if (!is_file_op_success) {
+        LOG_ERR("Failed to write out the ECC point L");
+        return tool_rc_general_error;
+    }
 
-    if (!ctx.signing_key.ctx_path) {
-        LOG_ERR("Specify a signing key");
-        return tool_rc_option_error;
+    is_file_op_success = files_save_ecc_point(ctx.E, ctx.eccpoint_E_data_path);
+    if (!is_file_op_success) {
+        LOG_ERR("Failed to write out the ECC point E");
+        return tool_rc_general_error;
     }
 
-    if (ctx.basepoint_y_data_path && !ctx.basepoint_x_coordinate_data_path) {
-        LOG_ERR("Specify parameter data for basepoint X coordinate derivation");
-        return tool_rc_option_error;
+    FILE *fp = fopen(ctx.commit_counter_path, "wb");
+    is_file_op_success = files_write_16(fp, ctx.counter);
+    fclose(fp);
+    if (!is_file_op_success) {
+        LOG_ERR("Failed to write out the ECC commit count");
+        return tool_rc_general_error;
     }
 
     return tool_rc_success;
@@ -121,6 +112,18 @@
 
 static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
     tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
             ctx.signing_key.auth_str, &ctx.signing_key.object, false,
             TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
@@ -128,6 +131,14 @@
         return rc;
     }
 
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
     bool result = true;
     if (ctx.basepoint_x_coordinate_data_path) {
         result = files_load_ecc_point(ctx.eccpoint_M_data_path, &ctx.P1);
@@ -145,68 +156,160 @@
         return tool_rc_general_error;
     }
 
-    return tool_rc_success;
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+    ctx.cphash = ctx.cp_hash_path ? &ctx.cp_hash : 0;
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
 }
 
-static tool_rc process_outputs(void) {
+static tool_rc check_options(void) {
 
-    bool result = files_save_ecc_point(ctx.K, ctx.eccpoint_K_data_path);
-    if (!result) {
-        LOG_ERR("Failed to write out the ECC point K");
-        return tool_rc_general_error;
+    if (!ctx.signing_key.ctx_path) {
+        LOG_ERR("Specify a signing key");
+        return tool_rc_option_error;
     }
 
-    result = files_save_ecc_point(ctx.L, ctx.eccpoint_L_data_path);
-    if (!result) {
-        LOG_ERR("Failed to write out the ECC point L");
-        return tool_rc_general_error;
+    if (ctx.basepoint_y_data_path && !ctx.basepoint_x_coordinate_data_path) {
+        LOG_ERR("Specify parameter data for basepoint X coordinate derivation");
+        return tool_rc_option_error;
     }
 
-    result = files_save_ecc_point(ctx.E, ctx.eccpoint_E_data_path);
-    if (!result) {
-        LOG_ERR("Failed to write out the ECC point E");
-        return tool_rc_general_error;
-    }
+    return tool_rc_success;
+}
 
-    FILE *fp = fopen(ctx.commit_counter_path, "wb");
-    result = files_write_16(fp, ctx.counter);
-    fclose(fp);
-    if (!result) {
-        LOG_ERR("Failed to write out the ECC commit count");
-        return tool_rc_general_error;
+static bool on_args(int argc, char **argv) {
+
+    if (argc > 1) {
+        LOG_ERR("Specify single argument with file input containing the "
+                "octet array used to derive x-coordinate of a base point");
+        return false;
     }
 
-    return tool_rc_success;
+    ctx.basepoint_x_coordinate_data_path = strcmp("-", argv0) ? argv0 : 0;
+
+    return files_load_bytes_from_buffer_or_file_or_stdin(0,
+        ctx.basepoint_x_coordinate_data_path, &ctx.s2.size, ctx.s2.buffer);
+}
+
+static bool on_option(char key, char *value) {
+
+    switch (key) {
+        case 'p':
+            ctx.signing_key.auth_str = value;
+            break;
+        case 'c':
+            ctx.signing_key.ctx_path = value;
+            break;
+        case 0:
+            ctx.basepoint_y_data_path = value;
+            break;
+        case 1:
+            ctx.eccpoint_M_data_path = value;
+            break;
+        case 2:
+            ctx.eccpoint_K_data_path = value;
+            break;
+        case 3:
+            ctx.eccpoint_L_data_path = value;
+            break;
+        case 'u':
+            ctx.eccpoint_E_data_path = value;
+            break;
+        case 't':
+            ctx.commit_counter_path = value;
+            break;
+        case 4:
+            ctx.cp_hash_path = value;
+            break;
+    };
+
+    return true;
+}
+
+static bool tpm2_tool_onstart(tpm2_options **opts) {
+
+    static struct option topts = {
+      { "auth",        required_argument, 0, 'p' },
+      { "context",     required_argument, 0, 'c' },
+      { "basepoint-y", required_argument, 0,  0  },
+      { "eccpoint-P",  required_argument, 0,  1  },
+      { "eccpoint-K",  required_argument, 0,  2  },
+      { "eccpoint-L",  required_argument, 0,  3  },
+      { "public",      required_argument, 0, 'u' },
+      { "counter",     required_argument, 0, 't' },
+      { "cphash",      required_argument, 0,  4  },
+    };
+
+    *opts = tpm2_options_new("p:c:t:u:", ARRAY_LEN(topts), topts,
+            on_option, on_args, 0);
+
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    // Check input options and arguments
+    /*
+     * 1. Process options
+     */
     tool_rc rc = check_options();
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    // Process inputs
+    /*
+     * 2. Process inputs
+     */
     rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    // ESAPI call
-    rc = tpm2_commit(ectx, &ctx.signing_key.object, &ctx.P1, &ctx.s2, &ctx.y2,
-        &ctx.K, &ctx.L, &ctx.E, &ctx.counter);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = commit(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    // Process outputs
-    rc = process_outputs();
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
+}
 
-    return rc;
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return tool_rc_success;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("commit", tpm2_tool_onstart, tpm2_tool_onrun, NULL, NULL)
+TPM2_TOOL_REGISTER("commit", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_create.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_create.c Changed

@@ -7,18 +7,20 @@
 #include "log.h"
 #include "pcr.h"
 #include "tpm2.h"
+#include "tpm2_convert.h"
 #include "tpm2_tool.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_auth_util.h"
 #include "tpm2_options.h"
-
-#define DEFAULT_ATTRS \
-     TPMA_OBJECT_DECRYPT|TPMA_OBJECT_SIGN_ENCRYPT|TPMA_OBJECT_FIXEDTPM \
-    |TPMA_OBJECT_FIXEDPARENT|TPMA_OBJECT_SENSITIVEDATAORIGIN \
-    |TPMA_OBJECT_USERWITHAUTH
+#include "tpm2_util.h"
 
 typedef struct tpm_create_ctx tpm_create_ctx;
+#define MAX_AUX_SESSIONS 2
+#define MAX_SESSIONS 3
 struct tpm_create_ctx {
+        /*
+         * Inputs
+         */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -26,73 +28,113 @@
     } parent;
 
     struct {
-        TPM2B_SENSITIVE_CREATE sensitive;
-        TPM2B_PUBLIC public;
         char *sealed_data;
-        char *public_path;
-        char *private_path;
         char *auth_str;
-        const char *ctx_path;
-        char *creation_data_file;
-        char *creation_ticket_file;
-        char *creation_hash_file;
-        char *template_data_path;
+        TPM2B_SENSITIVE_CREATE sensitive;
+        TPM2B_PUBLIC in_public;
+        TPM2B_DATA outside_info;
+        TPML_PCR_SELECTION creation_pcr;
+        char *outside_info_data;
         char *alg;
         char *attrs;
         char *name_alg;
         char *policy;
-    } object;
-
-    char *outside_info_data;
+        bool is_object_alg_specified;
+        bool is_sealing_input_specified;
 
-    TPML_PCR_SELECTION creation_pcr;
+        /*
+         * Outputs
+         */
+        char *public_path;
+        TPM2B_PUBLIC *out_public;
+        const char *ctx_path;
+        char *private_path;
+        TPM2B_PRIVATE *out_private;
+        char *creation_data_file;
+        TPM2B_CREATION_DATA *creation_data;
+        char *creation_hash_file;
+        TPM2B_DIGEST *creation_hash;
+        char *creation_ticket_file;
+        TPMT_TK_CREATION *creation_ticket;
+        char *template_data_path;
+        ESYS_TR object_handle;
+    } object;
 
-    struct {
-        UINT8 a :1;
-        UINT8 i :1;
-        UINT8 L :1;
-        UINT8 u :1;
-        UINT8 r :1;
-        UINT8 G :1;
-    } flags;
-
-    char *cp_hash_path;
+    bool is_createloaded;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+    bool is_command_dispatch;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
+
+    /*
+     * Formated public key output
+     */
+    char *output_path;
+    bool format_set;
+    tpm2_convert_pubkey_fmt format;
 };
 
 #define DEFAULT_KEY_ALG "rsa2048"
 
 static tpm_create_ctx ctx = {
-        .object = { .alg = DEFAULT_KEY_ALG },
-        .creation_pcr = { .count = 0 },
+        .object = {
+            .alg = DEFAULT_KEY_ALG,
+            .creation_pcr = { .count = 0 },
+            .object_handle = ESYS_TR_NONE,
+            .outside_info.size = 0,
+        },
+        .aux_session_handle0 = ESYS_TR_NONE,
+        .aux_session_handle1 = ESYS_TR_NONE,
+        .cp_hash.size = 0,
+        .is_command_dispatch = true,
+        .parameter_hash_algorithm = TPM2_ALG_ERROR,
+        .format = pubkey_format_tss,
 };
 
 static bool load_outside_info(TPM2B_DATA *outside_info) {
 
     outside_info->size = sizeof(outside_info->buffer);
-    return tpm2_util_bin_from_hex_or_file(ctx.outside_info_data,
-            &outside_info->size,
-            outside_info->buffer);
+    return tpm2_util_bin_from_hex_or_file(ctx.object.outside_info_data,
+        &outside_info->size, outside_info->buffer);
 }
 
-static tool_rc create(ESYS_CONTEXT *ectx) {
+static void print_help_message() {
 
-    tool_rc rc = tool_rc_general_error;
+    static const char *msg =
+        "NOTE: The TPM does not support CreateLoaded command!\n"
+        "Use tpm2_create with the -u and -r options and then\n"
+        "call tpm2_load with -c and use the -u and -r outputs\n"
+        "of tpm2_create in tpm2_load.";
 
-    TPM2B_PUBLIC *out_public;
-    TPM2B_PRIVATE *out_private;
+    tpm2_tool_output("%s\n", msg);
+}
 
-    ESYS_TR object_handle = ESYS_TR_NONE;
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    if (ctx.object.ctx_path &&
-        (!ctx.object.creation_data_file &&
-         !ctx.object.creation_ticket_file &&
-         !ctx.object.creation_hash_file)
-       ) {
+static tool_rc create(ESYS_CONTEXT *ectx) {
 
+    /*
+     * 1. TPM2_CC_<command> OR Retrieve cpHash
+     */
+
+    /* TPM2_CC_CreateLoaded */
+    if (ctx.is_createloaded) {
         size_t offset = 0;
         TPM2B_TEMPLATE template = { .size = 0 };
         tool_rc tmp_rc = tpm2_mu_tpmt_public_marshal(
-                &ctx.object.public.publicArea, &template.buffer0,
+                &ctx.object.in_public.publicArea, &template.buffer0,
                 sizeof(TPMT_PUBLIC), &offset);
         if (tmp_rc != tool_rc_success) {
             return tmp_rc;
@@ -100,145 +142,334 @@
 
         template.size = offset;
 
-        if (ctx.cp_hash_path) {
-            tmp_rc = tpm2_create_loaded(ectx, &ctx.parent.object,
-                &ctx.object.sensitive, &template, &object_handle, &out_private,
-                &out_public, &cp_hash);
-            if (tmp_rc == tool_rc_success) {
-                bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-                if (!result) {
-                    LOG_ERR("Failed to save cp hash");
-                    tmp_rc = tool_rc_general_error;
-                }
-            }
-            return tmp_rc;
-        }
-
         tmp_rc = tpm2_create_loaded(ectx, &ctx.parent.object,
-                &ctx.object.sensitive, &template, &object_handle, &out_private,
-                &out_public, NULL);
+            &ctx.object.sensitive, &template, &ctx.object.object_handle,
+            &ctx.object.out_private, &ctx.object.out_public, &ctx.cp_hash,
+            &ctx.rp_hash, ctx.parameter_hash_algorithm,
+            ctx.aux_session_handle0, ctx.aux_session_handle1);
         if (tmp_rc != tool_rc_success) {
+            if (tmp_rc == tool_rc_unsupported) {
+                print_help_message();
+            }
             return tmp_rc;
         }
-    } else {
+    }
+
+    /* TPM2_CC_Create */
+    if (!ctx.is_createloaded) {
         /*
          * Outside data is optional. If not specified default to 0
          */
-        bool result = true;
-        TPM2B_DATA outside_info = TPM2B_EMPTY_INIT;
-        if (ctx.outside_info_data) {
-            result = load_outside_info(&outside_info);
-        }
+        bool result = ctx.object.outside_info_data ?
+        load_outside_info(&ctx.object.outside_info) : true;
         if (!result) {
             return tool_rc_general_error;
         }
 
-        tool_rc tmp_rc = tool_rc_success;
-        if (ctx.cp_hash_path) {
-            tmp_rc = tpm2_create(ectx, &ctx.parent.object,
-                &ctx.object.sensitive, &ctx.object.public, &outside_info,
-                &ctx.creation_pcr, &out_private, &out_public, NULL, NULL, NULL,
-                &cp_hash);
-            if (tmp_rc == tool_rc_success) {
-                result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-                if (!result) {
-                    LOG_ERR("Failed to save cp hash");
-                    tmp_rc = tool_rc_general_error;
-                }
-            }
-            return tmp_rc;
-        }
-        TPM2B_CREATION_DATA *creation_data = NULL;
-        TPM2B_DIGEST *creation_hash = NULL;
-        TPMT_TK_CREATION *creation_ticket = NULL;
-        tmp_rc = tpm2_create(ectx, &ctx.parent.object,
-                &ctx.object.sensitive, &ctx.object.public, &outside_info,
-                &ctx.creation_pcr, &out_private, &out_public, &creation_data,
-                &creation_hash, &creation_ticket, NULL);
+        tool_rc tmp_rc = tpm2_create(ectx, &ctx.parent.object,
+            &ctx.object.sensitive, &ctx.object.in_public,
+            &ctx.object.outside_info, &ctx.object.creation_pcr,
+            &ctx.object.out_private, &ctx.object.out_public,
+            &ctx.object.creation_data, &ctx.object.creation_hash,
+            &ctx.object.creation_ticket, &ctx.cp_hash, &ctx.rp_hash,
+            ctx.parameter_hash_algorithm, ctx.aux_session_handle0,
+            ctx.aux_session_handle1);
         if (tmp_rc != tool_rc_success) {
             return tmp_rc;
         }
+    }
+
+    return tool_rc_success;
+}
+
+static void setup_attributes(TPMA_OBJECT *attrs) {
+
+    if (ctx.object.is_sealing_input_specified && !ctx.object.attrs) {
+        *attrs &= ~TPMA_OBJECT_SIGN_ENCRYPT;
+        *attrs &= ~TPMA_OBJECT_DECRYPT;
+        *attrs &= ~TPMA_OBJECT_SENSITIVEDATAORIGIN;
+    }
 
-        if (ctx.object.creation_data_file && creation_data->size) {
-            result = files_save_creation_data(creation_data,
-                ctx.object.creation_data_file);
+    if (!ctx.object.is_sealing_input_specified && !ctx.object.attrs &&
+        !strncmp("hmac", ctx.object.alg, 4)) {
+        *attrs &= ~TPMA_OBJECT_DECRYPT;
+    }
+
+    if (!ctx.object.attrs && ctx.object.policy && !ctx.object.auth_str) {
+        *attrs &= ~TPMA_OBJECT_USERWITHAUTH;
+    }
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.is_createloaded && ctx.object.template_data_path) {
+        is_file_op_success = files_save_template(
+            &ctx.object.in_public.publicArea, ctx.object.template_data_path);
+        
+        if (!is_file_op_success) {
+            LOG_ERR("Could not save public template to file.");
+            return tool_rc_general_error;
         }
-        if (!result) {
+    }
+
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            LOG_ERR("Failed to save cp hash");
+            return tool_rc_general_error;
+        }
+    }
+
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    /* TPM2_CC_Create outputs */
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_createloaded && ctx.object.creation_data_file &&
+        ctx.object.creation_data->size) {
+        is_file_op_success = files_save_creation_data(ctx.object.creation_data,
+            ctx.object.creation_data_file);
+
+        if (!is_file_op_success) {
             LOG_ERR("Failed saving creation data.");
-            tmp_rc = tool_rc_general_error;
+            rc = tool_rc_general_error;
             goto create_out;
         }
+    }
 
-        if (ctx.object.creation_ticket_file && creation_ticket->digest.size) {
-            result = files_save_creation_ticket(creation_ticket,
-                ctx.object.creation_ticket_file);
-        }
-        if (!result) {
+    if (!ctx.is_createloaded && ctx.object.creation_ticket_file &&
+        ctx.object.creation_ticket->digest.size) {
+        is_file_op_success = files_save_creation_ticket(
+            ctx.object.creation_ticket, ctx.object.creation_ticket_file);
+
+        if (!is_file_op_success) {
             LOG_ERR("Failed saving creation ticket.");
-            tmp_rc = tool_rc_general_error;
+            rc = tool_rc_general_error;
             goto create_out;
         }
+    }
+
+    if (!ctx.is_createloaded && ctx.object.creation_hash_file &&
+        ctx.object.creation_hash->size) {
+        is_file_op_success = files_save_digest(ctx.object.creation_hash,
+            ctx.object.creation_hash_file);
 
-        if (ctx.object.creation_hash_file && creation_hash->size) {
-            result = files_save_digest(creation_hash,
-                ctx.object.creation_hash_file);
+        if (!is_file_op_success) {
+            LOG_ERR("Failed saving creation hash.");
+            rc = tool_rc_general_error;
         }
+    }
+
+    if (ctx.output_path) {
+        bool result = tpm2_convert_pubkey_save(ctx.object.out_public, ctx.format, ctx.output_path);
         if (!result) {
-            LOG_ERR("Failed saving creation hash.");
-            tmp_rc = tool_rc_general_error;
-            goto create_out;
+            LOG_ERR("Failed saving public key.");
+            return tool_rc_general_error;
         }
+    }
 
 create_out:
-        free(creation_data);
-        free(creation_hash);
-        free(creation_ticket);
-        if (tmp_rc != tool_rc_success) {
-            return tmp_rc;
-        }
+    free(ctx.object.creation_data);
+    free(ctx.object.creation_hash);
+    free(ctx.object.creation_ticket);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    if (ctx.object.template_data_path) {
-        bool res = files_save_template(&ctx.object.public.publicArea,
-        ctx.object.template_data_path);
+    /* Common- TPM2_CC_Create/ TPM2_CC_CreateLoaded outputs*/
+    tpm2_util_public_to_yaml(ctx.object.out_public, NULL);
 
-        if (!res) {
-            LOG_ERR("Could not save public template to file.");
+    if (ctx.object.public_path) {
+        is_file_op_success = files_save_public(ctx.object.out_public,
+            ctx.object.public_path);
+
+        if (!is_file_op_success) {
             rc = tool_rc_general_error;
             goto out;
         }
     }
 
-    tpm2_util_public_to_yaml(out_public, NULL);
+    if (ctx.object.private_path) {
+        is_file_op_success = files_save_private(ctx.object.out_private,
+            ctx.object.private_path);
 
-    if (ctx.flags.u) {
-        bool res = files_save_public(out_public, ctx.object.public_path);
-        if (!res) {
+        if (!is_file_op_success) {
+            rc = tool_rc_general_error;
             goto out;
         }
     }
 
-    if (ctx.flags.r) {
-        bool res = files_save_private(out_private, ctx.object.private_path);
-        if (!res) {
+    if (ctx.object.ctx_path) {
+        rc = files_save_tpm_context_to_path(ectx, ctx.object.object_handle,
+            ctx.object.ctx_path);
+        
+        if (rc != tool_rc_success) {
             goto out;
         }
     }
 
-    if (ctx.object.ctx_path) {
-        rc = files_save_tpm_context_to_path(ectx, object_handle,
-                ctx.object.ctx_path);
-    } else {
-        rc = tool_rc_success;
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+
+        if (!is_file_op_success) {
+            rc = tool_rc_general_error;
+        }
     }
 
 out:
-    free(out_private);
-    free(out_public);
+    free(ctx.object.out_private);
+    free(ctx.object.out_public);
 
     return rc;
 }
 
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+    tpm2_session *tmp;
+    tool_rc rc = tpm2_auth_util_from_optarg(NULL, ctx.object.auth_str, &tmp,
+        true);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid key authorization");
+        return rc;
+    }
+    TPM2B_AUTH const *auth = tpm2_session_get_auth_value(tmp);
+    ctx.object.sensitive.sensitive.userAuth = *auth;
+    tpm2_session_close(&tmp);
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    rc = tpm2_util_object_load_auth(ectx, ctx.parent.ctx_path,
+        ctx.parent.auth_str, &ctx.parent.object, false, TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /* Setup attributes */
+    TPMA_OBJECT attrs = DEFAULT_CREATE_ATTRS;
+    setup_attributes(&attrs);
+
+    /* Initialize object */
+    rc = tpm2_alg_util_public_init(ctx.object.alg, ctx.object.name_alg,
+        ctx.object.attrs, ctx.object.policy, attrs, &ctx.object.in_public);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /* Check object validitity */
+    if (ctx.object.is_sealing_input_specified &&
+        ctx.object.in_public.publicArea.type != TPM2_ALG_KEYEDHASH) {
+        LOG_ERR("Only TPM2_ALG_KEYEDHASH algorithm is allowed when sealing data");
+        return tool_rc_general_error;
+    }
+
+    /* Check command type */
+    if ((ctx.object.ctx_path || ctx.object.template_data_path) &&
+        (!ctx.object.creation_data_file && !ctx.object.creation_ticket_file &&
+        !ctx.object.creation_hash_file)) {
+        ctx.is_createloaded = true;
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.parent.object.session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.cp_hash_path && !ctx.rp_hash_path) ?
+        false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(void) {
+
+    if (!ctx.parent.ctx_path) {
+        LOG_ERR("Must specify parent object via -C.");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.object.is_sealing_input_specified && ctx.object.is_object_alg_specified) {
+        LOG_ERR("Cannot specify -G and -i together.");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.cp_hash_path && !ctx.rp_hash_path &&
+       (ctx.object.public_path || ctx.object.private_path ||
+        ctx.object.creation_data_file || ctx.object.creation_hash_file ||
+        ctx.object.creation_ticket_file || ctx.object.ctx_path)) {
+        LOG_ERR("CpHash Error: Cannot specify pub, priv, creation - data, hash, ticket");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.format_set && !ctx.output_path) {
+        LOG_ERR("Cannot specify --format/-f without specifying --output/-o");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
+
+static bool load_sensitive(void) {
+
+    ctx.object.sensitive.sensitive.data.size = BUFFER_SIZE(
+            typeof(ctx.object.sensitive.sensitive.data), buffer);
+
+    return files_load_bytes_from_buffer_or_file_or_stdin(NULL,
+        ctx.object.sealed_data, &ctx.object.sensitive.sensitive.data.size,
+        ctx.object.sensitive.sensitive.data.buffer);
+}
+
 static bool on_option(char key, char *value) {
 
     switch (key) {
@@ -253,27 +484,28 @@
         break;
     case 'G':
         ctx.object.alg = value;
-        ctx.flags.G = 1;
+        ctx.object.is_object_alg_specified = true;
         break;
     case 'a':
         ctx.object.attrs = value;
-        ctx.flags.a = 1;
         break;
     case 'i':
         ctx.object.sealed_data = strcmp("-", value) ? value : NULL;
-        ctx.flags.i = 1;
+        ctx.object.alg = "keyedhash";
+        ctx.object.is_sealing_input_specified = true;
+        bool res = load_sensitive();
+        if (!res) {
+            return false;
+        }
         break;
     case 'L':
         ctx.object.policy = value;
-        ctx.flags.L = 1;
         break;
     case 'u':
         ctx.object.public_path = value;
-        ctx.flags.u = 1;
         break;
     case 'r':
         ctx.object.private_path = value;
-        ctx.flags.r = 1;
         break;
     case 'C':
         ctx.parent.ctx_path = value;
@@ -294,10 +526,10 @@
         ctx.object.creation_hash_file = value;
         break;
     case 'q':
-        ctx.outside_info_data = value;
+        ctx.object.outside_info_data = value;
         break;
     case 'l':
-        if (!pcr_parse_selections(value, &ctx.creation_pcr)) {
+        if (!pcr_parse_selections(value, &ctx.object.creation_pcr)) {
             LOG_ERR("Could not parse pcr selections, got: \"%s\"", value);
             return false;
         }
@@ -305,6 +537,29 @@
     case 2:
         ctx.cp_hash_path = value;
         break;
+    case 3:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
+    case 'f':
+        ctx.format = tpm2_convert_pubkey_fmt_from_optarg(value);
+        if (ctx.format == pubkey_format_err) {
+            return false;
+        }
+        ctx.format_set = true;
+        break;
+    case 'o':
+        ctx.output_path = value;
+        break;
+        /* no default */
     };
 
     return true;
@@ -331,118 +586,85 @@
       { "outside-info",   required_argument, NULL, 'q' },
       { "pcr-list",       required_argument, NULL, 'l' },
       { "cphash",         required_argument, NULL,  2  },
+      { "rphash",         required_argument, NULL,  3  },
+      { "session",        required_argument, NULL, 'S' },
+      { "format",         required_argument, NULL, 'f' },
+      { "output",         required_argument, NULL, 'o' },
     };
 
-    *opts = tpm2_options_new("P:p:g:G:a:i:L:u:r:C:c:t:d:q:l:", ARRAY_LEN(topts), topts,
-            on_option, NULL, 0);
+    *opts = tpm2_options_new("P:p:g:G:a:i:L:u:r:C:c:t:d:q:l:S:o:f:",
+    ARRAY_LEN(topts), topts, on_option, NULL, 0);
 
     return *opts != NULL;
 }
 
-static bool load_sensitive(void) {
-
-    ctx.object.sensitive.sensitive.data.size = BUFFER_SIZE(
-            typeof(ctx.object.sensitive.sensitive.data), buffer);
-    return files_load_bytes_from_buffer_or_file_or_stdin(NULL,
-            ctx.object.sealed_data, &ctx.object.sensitive.sensitive.data.size,
-            ctx.object.sensitive.sensitive.data.buffer);
-}
-
-static tool_rc check_options(void) {
-
-    if (!ctx.parent.ctx_path) {
-        LOG_ERR("Must specify parent object via -C.");
-        return tool_rc_option_error;
-    }
-
-    if (ctx.flags.i && ctx.flags.G) {
-        LOG_ERR("Cannot specify -G and -i together.");
-        return tool_rc_option_error;
-    }
-
-    if (ctx.cp_hash_path && (ctx.object.public_path || ctx.object.private_path
-        || ctx.object.creation_data_file || ctx.object.creation_hash_file ||
-        ctx.object.creation_ticket_file || ctx.object.ctx_path)) {
-        LOG_ERR("CpHash Error: Cannot specify pub, priv, creation - data, hash, ticket");
-        return tool_rc_option_error;
-    }
-
-    return tool_rc_success;
-}
-
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    TPMA_OBJECT attrs = DEFAULT_ATTRS;
-
+    /*
+     * 1. Process options
+     */
     tool_rc rc = check_options();
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    if (ctx.flags.i) {
-
-        bool res = load_sensitive();
-        if (!res) {
-            return tool_rc_general_error;
-        }
-
-        ctx.object.alg = "keyedhash";
-
-        if (!ctx.flags.a) {
-            attrs &= ~TPMA_OBJECT_SIGN_ENCRYPT;
-            attrs &= ~TPMA_OBJECT_DECRYPT;
-            attrs &= ~TPMA_OBJECT_SENSITIVEDATAORIGIN;
-        }
-    } else if (!ctx.flags.a && !strncmp("hmac", ctx.object.alg, 4)) {
-        attrs &= ~TPMA_OBJECT_DECRYPT;
-    }
-
-    rc = tpm2_alg_util_public_init(ctx.object.alg, ctx.object.name_alg,
-            ctx.object.attrs, ctx.object.policy, attrs, &ctx.object.public);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
-
-    if (!ctx.flags.a && ctx.flags.L && !ctx.object.auth_str) {
-        ctx.object.public.publicArea.objectAttributes &=
-                ~TPMA_OBJECT_USERWITHAUTH;
-    }
-
-    if (ctx.flags.i
-            && ctx.object.public.publicArea.type != TPM2_ALG_KEYEDHASH) {
-        LOG_ERR("Only TPM2_ALG_KEYEDHASH algorithm is allowed when sealing data");
-        return tool_rc_general_error;
-    }
-
-    rc = tpm2_util_object_load_auth(ectx, ctx.parent.ctx_path,
-            ctx.parent.auth_str, &ctx.parent.object, false,
-            TPM2_HANDLE_ALL_W_NV);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    tpm2_session *tmp;
-    rc = tpm2_auth_util_from_optarg(NULL, ctx.object.auth_str, &tmp, true);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = create(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid key authorization");
         return rc;
     }
 
-    TPM2B_AUTH const *auth = tpm2_session_get_auth_value(tmp);
-    ctx.object.sensitive.sensitive.userAuth = *auth;
-
-    tpm2_session_close(&tmp);
-
-    return create(ectx);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    return tpm2_session_close(&ctx.parent.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.parent.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
+    }
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("create", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("create", tpm2_tool_onstart, tpm2_tool_onrun,
+tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_createak.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_createak.c Changed

@@ -2,15 +2,86 @@
 
 #include <stdbool.h>
 #include <stdlib.h>
+#include <string.h>
 
 #include "files.h"
 #include "log.h"
 #include "object.h"
+#include "tpm2.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_auth_util.h"
 #include "tpm2_convert.h"
 #include "tpm2_tool.h"
 
+#define ATTRS  \
+    TPMA_OBJECT_RESTRICTED|TPMA_OBJECT_USERWITHAUTH| \
+    TPMA_OBJECT_SIGN_ENCRYPT|TPMA_OBJECT_FIXEDTPM| \
+    TPMA_OBJECT_FIXEDPARENT|TPMA_OBJECT_SENSITIVEDATAORIGIN
+
+/* Templates from TCG EK Credential Profile TPM 2.0, Version 2.4 Rev. 3, 2021 */
+
+static const TPM2B_DIGEST policy_a_sha384 = {
+    .size = 48,
+    .buffer = {
+        0x8b, 0xbf, 0x22, 0x66, 0x53, 0x7c, 0x17, 0x1c, 0xb5, 0x6e,
+        0x40, 0x3c, 0x4d, 0xc1, 0xd4, 0xb6, 0x4f, 0x43, 0x26, 0x11,
+        0xdc, 0x38, 0x6e, 0x6f, 0x53, 0x20, 0x50, 0xc3, 0x27, 0x8c,
+        0x93, 0x0e, 0x14, 0x3e, 0x8b, 0xb1, 0x13, 0x38, 0x24, 0xcc,
+        0xb4, 0x31, 0x05, 0x38, 0x71, 0xc6, 0xdb, 0x53 }
+};
+
+static const TPM2B_DIGEST policy_a_sha512 = {
+    .size = 64,
+    .buffer = {
+        0x1e, 0x3b, 0x76, 0x50, 0x2c, 0x8a, 0x14, 0x25, 0xaa, 0x0b,
+        0x7b, 0x3f, 0xc6, 0x46, 0xa1, 0xb0, 0xfa, 0xe0, 0x63, 0xb0,
+        0x3b, 0x53, 0x68, 0xf9, 0xc4, 0xcd, 0xde, 0xca, 0xff, 0x08,
+        0x91, 0xdd, 0x68, 0x2b, 0xac, 0x1a, 0x85, 0xd4, 0xd8, 0x32,
+        0xb7, 0x81, 0xea, 0x45, 0x19, 0x15, 0xde, 0x5f, 0xc5, 0xbf,
+        0x0d, 0xc4, 0xa1, 0x91, 0x7c, 0xd4, 0x2f, 0xa0, 0x41, 0xe3,
+        0xf9, 0x98, 0xe0, 0xee }
+};
+
+static const TPM2B_DIGEST policy_a_sm3_256 = {
+    .size = 32,
+    .buffer = {
+        0xc6, 0x7f, 0x7d, 0x35, 0xf6, 0x6f, 0x3b, 0xec, 0x13, 0xc8,
+        0x9f, 0xe8, 0x98, 0x92, 0x1c, 0x65, 0x1b, 0x0c, 0xb5, 0xa3,
+        0x8a, 0x92, 0x69, 0x0a, 0x62, 0xa4, 0x3c, 0x00, 0x12, 0xe4,
+        0xfb, 0x8b }
+};
+
+static const TPM2B_DIGEST policy_c_sha384 = {
+    .size = 48,
+    .buffer = {
+        0xd6, 0x03, 0x2c, 0xe6, 0x1f, 0x2f, 0xb3, 0xc2, 0x40, 0xeb,
+        0x3c, 0xf6, 0xa3, 0x32, 0x37, 0xef, 0x2b, 0x6a, 0x16, 0xf4,
+        0x29, 0x3c, 0x22, 0xb4, 0x55, 0xe2, 0x61, 0xcf, 0xfd, 0x21,
+        0x7a, 0xd5, 0xb4, 0x94, 0x7c, 0x2d, 0x73, 0xe6, 0x30, 0x05,
+        0xee, 0xd2, 0xdc, 0x2b, 0x35, 0x93, 0xd1, 0x65 }
+};
+
+static const TPM2B_DIGEST policy_c_sha512 = {
+    .size = 64,
+    .buffer = {
+        0x58, 0x9e, 0xe1, 0xe1, 0x46, 0x54, 0x47, 0x16, 0xe8, 0xde,
+        0xaf, 0xe6, 0xdb, 0x24, 0x7b, 0x01, 0xb8, 0x1e, 0x9f, 0x9c,
+        0x7d, 0xd1, 0x6b, 0x81, 0x4a, 0xa1, 0x59, 0x13, 0x87, 0x49,
+        0x10, 0x5f, 0xba, 0x53, 0x88, 0xdd, 0x1d, 0xea, 0x70, 0x2f,
+        0x35, 0x24, 0x0c, 0x18, 0x49, 0x33, 0x12, 0x1e, 0x2c, 0x61,
+        0xb8, 0xf5, 0x0d, 0x3e, 0xf9, 0x13, 0x93, 0xa4, 0x9a, 0x38,
+        0xc3, 0xf7, 0x3f, 0xc8 }
+};
+
+static const TPM2B_DIGEST policy_c_sm3_256 = {
+    .size = 32,
+    .buffer = {
+        0x2d, 0x4e, 0x81, 0x57, 0x8c, 0x35, 0x31, 0xd9, 0xbd, 0x1c,
+        0xdd, 0x7d, 0x02, 0xba, 0x29, 0x8d, 0x56, 0x99, 0xa3, 0xe3,
+        0x9f, 0xc3, 0x55, 0x1b, 0xfe, 0xff, 0xcf, 0x13, 0x2b, 0x49,
+        0xe1, 0x1d }
+};
+
 typedef struct createak_context createak_context;
 struct createak_context {
     struct {
@@ -23,9 +94,9 @@
         struct {
             TPM2B_SENSITIVE_CREATE in_sensitive;
             struct {
-                TPM2_ALG_ID type;
-                TPM2_ALG_ID digest;
-                TPM2_ALG_ID sign;
+                const char *type;
+                const char *digest;
+                const char *sign;
             } alg;
         } in;
         struct {
@@ -47,9 +118,9 @@
     .ak = {
         .in = {
             .alg = {
-                .type = TPM2_ALG_RSA,
-                .digest = TPM2_ALG_SHA256,
-                .sign = TPM2_ALG_NULL
+                .type = "rsa2048",
+                .digest = "sha256",
+                .sign = "null"
             },
         },
         .out = {
@@ -59,131 +130,34 @@
     .flags = { 0 },
 };
 
-/*
- * TODO: All these set_xxx_signing_algorithm() routines could likely somehow be refactored into one.
- */
-static bool set_rsa_signing_algorithm(UINT32 sign_alg, UINT32 digest_alg,
-        TPM2B_PUBLIC *in_public) {
+static tool_rc init_ak_public(TPMI_ALG_HASH name_alg, TPM2B_PUBLIC *public) {
 
-    if (sign_alg == TPM2_ALG_NULL) {
-        sign_alg = TPM2_ALG_RSASSA;
-    }
-
-    in_public->publicArea.parameters.rsaDetail.scheme.scheme = sign_alg;
-    switch (sign_alg) {
-    case TPM2_ALG_RSASSA:
-    case TPM2_ALG_RSAPSS:
-        in_public->publicArea.parameters.rsaDetail.scheme.details.anySig.hashAlg =
-                digest_alg;
-        break;
-    default:
-        LOG_ERR("The RSA signing algorithm type input(%4.4x) is not supported!",
-                sign_alg);
-        return false;
-    }
-
-    return true;
-}
-
-static bool set_ecc_signing_algorithm(UINT32 sign_alg, UINT32 digest_alg,
-        TPM2B_PUBLIC *in_public) {
-
-    if (sign_alg == TPM2_ALG_NULL) {
-        sign_alg = TPM2_ALG_ECDSA;
-    }
-
-    in_public->publicArea.parameters.eccDetail.scheme.scheme = sign_alg;
-    switch (sign_alg) {
-    case TPM2_ALG_ECDSA:
-    case TPM2_ALG_SM2:
-    case TPM2_ALG_ECSCHNORR:
-    case TPM2_ALG_ECDAA:
-        in_public->publicArea.parameters.eccDetail.scheme.details.anySig.hashAlg =
-                digest_alg;
-        break;
-    default:
-        LOG_ERR("The ECC signing algorithm type input(%4.4x) is not supported!",
-                sign_alg);
-        return false;
-    }
-
-    return true;
-}
+    const char *name_halg;
+    char alg256;
 
-static bool set_keyed_hash_signing_algorithm(UINT32 sign_alg, UINT32 digest_alg,
-        TPM2B_PUBLIC *in_public) {
+    name_halg = tpm2_alg_util_algtostr(name_alg, tpm2_alg_util_flags_hash);
 
-    if (sign_alg == TPM2_ALG_NULL) {
-        sign_alg = TPM2_ALG_HMAC;
+    if (!strcmp(ctx.ak.in.alg.sign, "null")) {
+        if (!strncmp(ctx.ak.in.alg.type, "rsa", 3)) {
+            ctx.ak.in.alg.sign = "rsassa";
+        } else if (!strncmp(ctx.ak.in.alg.type, "ecc", 3)) {
+            ctx.ak.in.alg.sign = "ecdsa";
+        }
     }
-
-    in_public->publicArea.parameters.keyedHashDetail.scheme.scheme = sign_alg;
-    switch (sign_alg) {
-    case TPM2_ALG_HMAC:
-        in_public->publicArea.parameters.keyedHashDetail.scheme.details.hmac.hashAlg =
-                digest_alg;
-        break;
-    default:
-        LOG_ERR(
-                "The Keyedhash signing algorithm type input(%4.4x) is not supported!",
-                sign_alg);
-        return false;
+    if (!strcmp(ctx.ak.in.alg.type, "keyedhash"))
+    {
+        ctx.ak.in.alg.type = "hmac";
     }
+    if (!strcmp(ctx.ak.in.alg.type, "hmac"))
+    {
+        snprintf(alg, sizeof(alg), "%s:%s", ctx.ak.in.alg.type,
+            ctx.ak.in.alg.digest);
 
-    return true;
-}
-
-static bool set_key_algorithm(TPM2B_PUBLIC *in_public) {
-    in_public->publicArea.nameAlg = TPM2_ALG_SHA256;
-    // First clear attributes bit field.
-    in_public->publicArea.objectAttributes = 0;
-    in_public->publicArea.objectAttributes |= TPMA_OBJECT_RESTRICTED;
-    in_public->publicArea.objectAttributes |= TPMA_OBJECT_USERWITHAUTH;
-    in_public->publicArea.objectAttributes |= TPMA_OBJECT_SIGN_ENCRYPT;
-    in_public->publicArea.objectAttributes &= ~TPMA_OBJECT_DECRYPT;
-    in_public->publicArea.objectAttributes |= TPMA_OBJECT_FIXEDTPM;
-    in_public->publicArea.objectAttributes |= TPMA_OBJECT_FIXEDPARENT;
-    in_public->publicArea.objectAttributes |= TPMA_OBJECT_SENSITIVEDATAORIGIN;
-    in_public->publicArea.authPolicy.size = 0;
-
-    in_public->publicArea.type = ctx.ak.in.alg.type;
-
-    switch (ctx.ak.in.alg.type) {
-    case TPM2_ALG_RSA:
-        in_public->publicArea.parameters.rsaDetail.symmetric.algorithm =
-                TPM2_ALG_NULL;
-        in_public->publicArea.parameters.rsaDetail.symmetric.keyBits.aes = 0;
-        in_public->publicArea.parameters.rsaDetail.symmetric.mode.aes =
-                TPM2_ALG_NULL;
-        in_public->publicArea.parameters.rsaDetail.keyBits = 2048;
-        in_public->publicArea.parameters.rsaDetail.exponent = 0;
-        in_public->publicArea.unique.rsa.size = 0;
-        return set_rsa_signing_algorithm(ctx.ak.in.alg.sign,
-                ctx.ak.in.alg.digest, in_public);
-    case TPM2_ALG_ECC:
-        in_public->publicArea.parameters.eccDetail.symmetric.algorithm =
-                TPM2_ALG_NULL;
-        in_public->publicArea.parameters.eccDetail.symmetric.mode.sym =
-                TPM2_ALG_NULL;
-        in_public->publicArea.parameters.eccDetail.symmetric.keyBits.sym = 0;
-        in_public->publicArea.parameters.eccDetail.curveID = TPM2_ECC_NIST_P256;
-        in_public->publicArea.parameters.eccDetail.kdf.scheme = TPM2_ALG_NULL;
-        in_public->publicArea.unique.ecc.x.size = 0;
-        in_public->publicArea.unique.ecc.y.size = 0;
-        return set_ecc_signing_algorithm(ctx.ak.in.alg.sign,
-                ctx.ak.in.alg.digest, in_public);
-    case TPM2_ALG_KEYEDHASH:
-        in_public->publicArea.unique.keyedHash.size = 0;
-        return set_keyed_hash_signing_algorithm(ctx.ak.in.alg.sign,
-                ctx.ak.in.alg.digest, in_public);
-    case TPM2_ALG_SYMCIPHER:
-    default:
-        LOG_ERR("The algorithm type input(%4.4x) is not supported!",
-                ctx.ak.in.alg.type);
-        return false;
+    } else {
+        snprintf(alg, sizeof(alg), "%s:%s-%s:null", ctx.ak.in.alg.type,
+        ctx.ak.in.alg.sign, ctx.ak.in.alg.digest);
     }
-
-    return true;
+    return tpm2_alg_util_public_init(alg, name_halg, NULL, NULL, ATTRS, public);
 }
 
 static tool_rc create_ak(ESYS_CONTEXT *ectx) {
@@ -194,21 +168,49 @@
     TPM2B_DATA outside_info = TPM2B_EMPTY_INIT;
     TPM2B_PUBLIC *out_public;
     TPM2B_PRIVATE *out_private;
-    TPM2B_PUBLIC in_public = TPM2B_EMPTY_INIT;
+    TPM2B_PUBLIC in_public;
+    TPML_DIGEST pHashList = { .count = 2 };
 
-    bool result = set_key_algorithm(&in_public);
-    if (!result) {
+    /* get the nameAlg of the EK */
+    TPM2_ALG_ID ek_name_alg = tpm2_alg_util_get_name_alg(ectx, ctx.ek.ek_ctx.tr_handle);
+    if (ek_name_alg == TPM2_ALG_ERROR) {
         return tool_rc_general_error;
     }
 
+    /* select the matching EK templates */
+    switch (ek_name_alg) {
+    case TPM2_ALG_SHA384:
+        pHashList.digests0 = policy_a_sha384;
+        pHashList.digests1 = policy_c_sha384;
+        break;
+    case TPM2_ALG_SHA512:
+        pHashList.digests0 = policy_a_sha512;
+        pHashList.digests1 = policy_c_sha512;
+        break;
+    case TPM2_ALG_SM3_256:
+        pHashList.digests0 = policy_a_sm3_256;
+        pHashList.digests1 = policy_c_sm3_256;
+        break;
+    case TPM2_ALG_SHA256:
+    default:
+        pHashList.count = 0;
+        break;
+    }
+
+    tool_rc tmp_rc = init_ak_public(ek_name_alg, &in_public);
+    if (tmp_rc != tool_rc_success) {
+        return tmp_rc;
+    }
+
     tpm2_session_data *data = tpm2_session_data_new(TPM2_SE_POLICY);
     if (!data) {
         LOG_ERR("oom");
         return tool_rc_general_error;
     }
+    tpm2_session_set_authhash(data, ek_name_alg);
 
     tpm2_session *session = NULL;
-    tool_rc tmp_rc = tpm2_session_open(ectx, data, &session);
+    tmp_rc = tpm2_session_open(ectx, data, &session);
     if (tmp_rc != tool_rc_success) {
         LOG_ERR("Could not start tpm session");
         return tmp_rc;
@@ -236,6 +238,15 @@
 
     LOG_INFO("Esys_PolicySecret success");
 
+    if (pHashList.count > 1) {
+        rval = Esys_PolicyOR(ectx, sess_handle, ESYS_TR_NONE, ESYS_TR_NONE,
+                ESYS_TR_NONE, &pHashList);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_PolicyOR, rval);
+            goto out_session;
+        }
+    }
+
     TPM2B_CREATION_DATA *creation_data = NULL;
     rval = Esys_Create(ectx, ctx.ek.ek_ctx.tr_handle, sess_handle, ESYS_TR_NONE,
             ESYS_TR_NONE, &ctx.ak.in.in_sensitive, &in_public, &outside_info,
@@ -256,6 +267,7 @@
         LOG_ERR("oom");
         goto out;
     }
+    tpm2_session_set_authhash(data, ek_name_alg);
 
     tmp_rc = tpm2_session_open(ectx, data, &session);
     if (tmp_rc != tool_rc_success) {
@@ -283,6 +295,15 @@
     }
     LOG_INFO("Esys_PolicySecret success");
 
+    if (pHashList.count > 1) {
+        rval = Esys_PolicyOR(ectx, sess_handle, ESYS_TR_NONE, ESYS_TR_NONE,
+                ESYS_TR_NONE, &pHashList);
+        if (rval != TPM2_RC_SUCCESS) {
+            LOG_PERR(Esys_PolicyOR, rval);
+            goto out;
+        }
+    }
+
     ESYS_TR loaded_sha1_key_handle;
     rval = Esys_Load(ectx, ctx.ek.ek_ctx.tr_handle, sess_handle, ESYS_TR_NONE,
             ESYS_TR_NONE, out_private, out_public, &loaded_sha1_key_handle);
@@ -326,19 +347,17 @@
 
     // write name to ak.name file
     if (ctx.ak.out.name_file) {
-        result = files_save_bytes_to_file(ctx.ak.out.name_file, key_name->name,
-                key_name->size);
-        if (!result) {
-            LOG_ERR("Failed to save AK name into file \"%s\"",
+        if (!files_save_bytes_to_file(ctx.ak.out.name_file, key_name->name,
+                key_name->size)) {
+             LOG_ERR("Failed to save AK name into file \"%s\"",
                     ctx.ak.out.name_file);
             goto nameout;
         }
     }
 
     if (ctx.ak.out.qname_file) {
-        result = files_save_bytes_to_file(ctx.ak.out.qname_file, qname.name,
-                qname.size);
-        if (!result) {
+        if (!files_save_bytes_to_file(ctx.ak.out.qname_file, qname.name,
+                qname.size)) {
             LOG_ERR("Failed to save AK qualified name into file \"%s\"",
                     ctx.ak.out.name_file);
             goto nameout;
@@ -356,16 +375,14 @@
     }
 
     if (ctx.ak.out.pub_file) {
-        result = tpm2_convert_pubkey_save(out_public, ctx.ak.out.pub_fmt,
-                ctx.ak.out.pub_file);
-        if (!result) {
+        if (!tpm2_convert_pubkey_save(out_public, ctx.ak.out.pub_fmt,
+                ctx.ak.out.pub_file)) {
             goto nameout;
         }
     }
 
     if (ctx.ak.out.priv_file) {
-        result = files_save_private(out_private, ctx.ak.out.priv_file);
-        if (!result) {
+        if (!files_save_private(out_private, ctx.ak.out.priv_file)) {
             goto nameout;
         }
     }
@@ -391,26 +408,26 @@
         ctx.ek.ctx_arg = value;
         break;
     case 'G':
-        ctx.ak.in.alg.type = tpm2_alg_util_from_optarg(value,
-                tpm2_alg_util_flags_base);
-        if (ctx.ak.in.alg.type == TPM2_ALG_ERROR) {
-            LOG_ERR("Could not convert algorithm. got: \"%s\".", value);
+        ctx.ak.in.alg.type = tpm2_alg_util_numtoalgstr(value,
+                                 tpm2_alg_util_flags_base);
+        if (!ctx.ak.in.alg.type) {
+            LOG_ERR("Could not convert key algorithm, got \"%s\"", value);
             return false;
         }
         break;
     case 'g':
-        ctx.ak.in.alg.digest = tpm2_alg_util_from_optarg(value,
-                tpm2_alg_util_flags_hash);
-        if (ctx.ak.in.alg.digest == TPM2_ALG_ERROR) {
-            LOG_ERR("Could not convert digest algorithm.");
+        ctx.ak.in.alg.digest = tpm2_alg_util_numtoalgstr(value,
+                                tpm2_alg_util_flags_hash);
+        if (!ctx.ak.in.alg.digest) {
+            LOG_ERR("Could not convert digest algorithm, got \"%s\"", value);
             return false;
         }
         break;
     case 's':
-        ctx.ak.in.alg.sign = tpm2_alg_util_from_optarg(value,
-                tpm2_alg_util_flags_sig);
-        if (ctx.ak.in.alg.sign == TPM2_ALG_ERROR) {
-            LOG_ERR("Could not convert signing algorithm.");
+         ctx.ak.in.alg.sign = tpm2_alg_util_numtoalgstr(value,
+                                tpm2_alg_util_flags_sig);
+        if (!ctx.ak.in.alg.sign) {
+            LOG_ERR("Could not convert signing algorithm, got \"%s\"", value);
             return false;
         }
         break;

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_createek.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_createek.c Changed

@@ -7,6 +7,7 @@
 #include <tss2/tss2_mu.h>
 
 #include "files.h"
+#include "tpm2.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_convert.h"
 #include "tpm2_ctx_mgmt.h"
@@ -18,6 +19,61 @@
 #define ECC_EK_NONCE_NV_INDEX 0x01c0000b
 #define ECC_EK_TEMPLATE_NV_INDEX 0x01c0000c
 
+#define DEFAULT_KEY_ALG "rsa2048"
+
+/* Templates from TCG EK Credential Profile TPM 2.0, Version 2.4 Rev. 3, 2021 */
+
+#define ATTRS_A \
+    TPMA_OBJECT_FIXEDTPM|TPMA_OBJECT_FIXEDPARENT| \
+    TPMA_OBJECT_SENSITIVEDATAORIGIN|TPMA_OBJECT_ADMINWITHPOLICY| \
+    TPMA_OBJECT_RESTRICTED|TPMA_OBJECT_DECRYPT
+
+#define ATTRS_B ATTRS_A|TPMA_OBJECT_USERWITHAUTH
+
+static const TPM2B_DIGEST policy_a_sha256 = {
+    .size = 32,
+    .buffer = {
+        0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xB3, 0xF8, 0x1A, 0x90,
+        0xCC, 0x8D, 0x46, 0xA5, 0xD7, 0x24, 0xFD, 0x52, 0xD7, 0x6E,
+        0x06, 0x52, 0x0B, 0x64, 0xF2, 0xA1, 0xDA, 0x1B, 0x33, 0x14,
+        0x69, 0xAA
+    }
+};
+
+static const TPM2B_DIGEST policy_b_sha384 = {
+    .size = 48,
+    .buffer = {
+        0xB2, 0x6E, 0x7D, 0x28, 0xD1, 0x1A, 0x50, 0xBC, 0x53, 0xD8,
+        0x82, 0xBC, 0xF5, 0xFD, 0x3A, 0x1A, 0x07, 0x41, 0x48, 0xBB,
+        0x35, 0xD3, 0xB4, 0xE4, 0xCB, 0x1C, 0x0A, 0xD9, 0xBD, 0xE4,
+        0x19, 0xCA, 0xCB, 0x47, 0xBA, 0x09, 0x69, 0x96, 0x46, 0x15,
+        0x0F, 0x9F, 0xC0, 0x00, 0xF3, 0xF8, 0x0E, 0x12
+    }
+};
+
+static const TPM2B_DIGEST policy_b_sha512 = {
+    .size = 64,
+    .buffer = {
+        0xB8, 0x22, 0x1C, 0xA6, 0x9E, 0x85, 0x50, 0xA4, 0x91, 0x4D,
+        0xE3, 0xFA, 0xA6, 0xA1, 0x8C, 0x07, 0x2C, 0xC0, 0x12, 0x08,
+        0x07, 0x3A, 0x92, 0x8D, 0x5D, 0x66, 0xD5, 0x9E, 0xF7, 0x9E,
+        0x49, 0xA4, 0x29, 0xC4, 0x1A, 0x6B, 0x26, 0x95, 0x71, 0xD5,
+        0x7E, 0xDB, 0x25, 0xFB, 0xDB, 0x18, 0x38, 0x42, 0x56, 0x08,
+        0xB4, 0x13, 0xCD, 0x61, 0x6A, 0x5F, 0x6D, 0xB5, 0xB6, 0x07,
+        0x1A, 0xF9, 0x9B, 0xEA
+    }
+};
+
+static const TPM2B_DIGEST policy_b_sm3_256 = {
+    .size = 32,
+    .buffer = {
+        0x16, 0x78, 0x60, 0xA3, 0x5F, 0x2C, 0x5C, 0x35, 0x67, 0xF9,
+        0xC9, 0x27, 0xAC, 0x56, 0xC0, 0x32, 0xF3, 0xB3, 0xA6, 0x46,
+        0x2F, 0x8D, 0x03, 0x79, 0x98, 0xE7, 0xA1, 0x0F, 0x77, 0xFA,
+        0x45, 0x4A
+    }
+};
+
 typedef struct createek_context createek_context;
 struct createek_context {
 
@@ -39,6 +95,7 @@
         tpm2_loaded_object object;
     } auth_ek;
 
+    const char *key_alg;
     tpm2_hierarchy_pdata objdata;
     char *out_file_path;
     tpm2_convert_pubkey_fmt format;
@@ -52,59 +109,80 @@
 
 static createek_context ctx = {
     .format = pubkey_format_tss,
-    .objdata = TPM2_HIERARCHY_DATA_INIT,
+    .key_alg = DEFAULT_KEY_ALG,
+    .objdata = {
+        .in = {
+            .sensitive = TPM2B_SENSITIVE_CREATE_EMPTY_INIT,
+            .hierarchy = TPM2_RH_ENDORSEMENT
+        },
+    },
     .flags = { 0 },
     .find_persistent_handle = false
 };
 
-static bool set_key_algorithm(TPM2B_PUBLIC *input_public) {
+typedef struct alg_map alg_map;
+struct alg_map {
+   const char *input;
+   const char *alg;
+   const char *namealg;
+   const TPM2B_DIGEST *policy;
+   const TPMA_OBJECT attrs;
+};
+
+static const alg_map alg_maps = {
+    { "rsa",           "rsa2048:aes128cfb", "sha256", &policy_a_sha256, ATTRS_A },
+    { "rsa2048",       "rsa2048:aes128cfb", "sha256", &policy_a_sha256, ATTRS_A },
+    { "rsa3072",       "rsa3072:aes256cfb", "sha384", &policy_b_sha384, ATTRS_B },
+    { "rsa4096",       "rsa4096:aes256cfb", "sha384", &policy_b_sha384, ATTRS_B },
+    { "ecc",           "ecc_nist_p256:aes128cfb", "sha256", &policy_a_sha256, ATTRS_A },
+    { "ecc256",        "ecc_nist_p256:aes128cfb", "sha256", &policy_a_sha256, ATTRS_A },
+    { "ecc384",        "ecc_nist_p384:aes256cfb", "sha384", &policy_b_sha384, ATTRS_B },
+    { "ecc521",        "ecc_nist_p521:aes256cfb", "sha512", &policy_b_sha512, ATTRS_B },
+    { "ecc_nist_p256", "ecc_nist_p256:aes128cfb", "sha256", &policy_a_sha256, ATTRS_A },
+    { "ecc_nist_p384", "ecc_nist_p384:aes256cfb", "sha384", &policy_b_sha384, ATTRS_B },
+    { "ecc_nist_p521", "ecc_nist_p521:aes256cfb", "sha512", &policy_b_sha512, ATTRS_B },
+    { "ecc_sm2",       "ecc_sm2_p256:sm4_128cfb", "sm3_256", &policy_b_sm3_256, ATTRS_B },
+    { "ecc_sm2_p256",  "ecc_sm2_p256:sm4_128cfb", "sm3_256", &policy_b_sm3_256, ATTRS_B },
+    { "keyedhash",     "xor", "sha256", &policy_a_sha256, ATTRS_A },
+};
 
-    switch (input_public->publicArea.type) {
-    case TPM2_ALG_RSA:
-        input_public->publicArea.parameters.rsaDetail.symmetric.algorithm =
-                TPM2_ALG_AES;
-        input_public->publicArea.parameters.rsaDetail.symmetric.keyBits.aes = 128;
-        input_public->publicArea.parameters.rsaDetail.symmetric.mode.aes =
-                TPM2_ALG_CFB;
-        input_public->publicArea.parameters.rsaDetail.scheme.scheme = TPM2_ALG_NULL;
-        input_public->publicArea.parameters.rsaDetail.keyBits = 2048;
-        input_public->publicArea.parameters.rsaDetail.exponent = 0;
-        input_public->publicArea.unique.rsa.size = 256;
-        break;
-    case TPM2_ALG_KEYEDHASH:
-        input_public->publicArea.parameters.keyedHashDetail.scheme.scheme =
-                TPM2_ALG_XOR;
-        input_public->publicArea.parameters.keyedHashDetail.scheme.details.exclusiveOr.hashAlg =
-                TPM2_ALG_SHA256;
-        input_public->publicArea.parameters.keyedHashDetail.scheme.details.exclusiveOr.kdf =
-                TPM2_ALG_KDF1_SP800_108;
-        input_public->publicArea.unique.keyedHash.size = 0;
-        break;
-    case TPM2_ALG_ECC:
-        input_public->publicArea.parameters.eccDetail.symmetric.algorithm =
-                TPM2_ALG_AES;
-        input_public->publicArea.parameters.eccDetail.symmetric.keyBits.aes = 128;
-        input_public->publicArea.parameters.eccDetail.symmetric.mode.sym =
-                TPM2_ALG_CFB;
-        input_public->publicArea.parameters.eccDetail.scheme.scheme = TPM2_ALG_NULL;
-        input_public->publicArea.parameters.eccDetail.curveID = TPM2_ECC_NIST_P256;
-        input_public->publicArea.parameters.eccDetail.kdf.scheme = TPM2_ALG_NULL;
-        input_public->publicArea.unique.ecc.x.size = 32;
-        input_public->publicArea.unique.ecc.y.size = 32;
-        break;
-    case TPM2_ALG_SYMCIPHER:
-        input_public->publicArea.parameters.symDetail.sym.algorithm = TPM2_ALG_AES;
-        input_public->publicArea.parameters.symDetail.sym.keyBits.aes = 128;
-        input_public->publicArea.parameters.symDetail.sym.mode.sym = TPM2_ALG_CFB;
-        input_public->publicArea.unique.sym.size = 0;
-        break;
-    default:
-        LOG_ERR("The algorithm type input(%4.4x) is not supported!",
-                input_public->publicArea.type);
-        return false;
+static const alg_map *lookup_alg_map(const char *alg) {
+    size_t i;
+
+    for (i = 0; i < ARRAY_LEN(alg_maps); i++)
+    {
+        if (!strcmp(alg, alg_mapsi.input)) {
+            return &alg_mapsi;
+        }
+    }
+    return NULL;
+}
+
+static tool_rc init_ek_public(const char *key_alg, TPM2B_PUBLIC *public) {
+    const alg_map *m = lookup_alg_map(key_alg);
+
+    if (!m) {
+        LOG_ERR("Invalid key algorithm, got \"%s\"", key_alg);
+        return tool_rc_unsupported;
     }
 
-    return true;
+    tool_rc rc = tpm2_alg_util_public_init(m->alg, m->namealg, NULL, NULL,
+                                           m->attrs, public);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    public->publicArea.authPolicy = *m->policy;
+
+    if (public->publicArea.type == TPM2_ALG_ECC &&
+        public->publicArea.parameters.eccDetail.curveID == TPM2_ECC_NIST_P256) {
+        public->publicArea.unique.ecc.x.size = 32;
+        public->publicArea.unique.ecc.y.size = 32;
+    } else  if (public->publicArea.type == TPM2_ALG_RSA &&
+                public->publicArea.parameters.rsaDetail.keyBits == 2048) {
+        public->publicArea.unique.rsa.size = 256;
+    }
+    return tool_rc_success;
 }
 
 static tool_rc set_ek_template(ESYS_CONTEXT *ectx, TPM2B_PUBLIC *input_public) {
@@ -130,9 +208,12 @@
     UINT8* nonce = NULL;
 
     // Read EK template
-    UINT16 template_size;
+    UINT16 template_size = 0;
+    TPM2B_DIGEST cp_hash = { 0 };
+    TPM2B_DIGEST rp_hash = { 0 };
     tool_rc rc = tpm2_util_nv_read(ectx, template_nv_index, 0, 0,
-        &ctx.auth_owner_hierarchy.object, &template, &template_size, NULL);
+        &ctx.auth_owner_hierarchy.object, &template, &template_size, &cp_hash,
+        &rp_hash, TPM2_ALG_SHA256, 0, ESYS_TR_NONE, ESYS_TR_NONE, NULL);
     if (rc != tool_rc_success) {
         goto out;
     }
@@ -146,9 +227,10 @@
     }
 
     // Read EK nonce
-    UINT16 nonce_size;
+    UINT16 nonce_size = 0;
     rc = tpm2_util_nv_read(ectx, nonce_nv_index, 0, 0,
-        &ctx.auth_owner_hierarchy.object, &nonce, &nonce_size, NULL);
+        &ctx.auth_owner_hierarchy.object, &nonce, &nonce_size, &cp_hash,
+        &rp_hash, TPM2_ALG_SHA256, 0, ESYS_TR_NONE, ESYS_TR_NONE, NULL);
     if (rc != tool_rc_success) {
         goto out;
     }
@@ -176,20 +258,24 @@
 
 static tool_rc create_ek_handle(ESYS_CONTEXT *ectx) {
 
+    tool_rc rc = init_ek_public(ctx.key_alg, &ctx.objdata.in.public);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
     if (ctx.flags.t) {
         tool_rc rc = set_ek_template(ectx, &ctx.objdata.in.public);
         if (rc != tool_rc_success) {
             return rc;
         }
-    } else {
-        bool result = set_key_algorithm(&ctx.objdata.in.public);
-        if (!result) {
-            return tool_rc_general_error;
-        }
     }
 
-    tool_rc rc = tpm2_hierarchy_create_primary(ectx,
-        ctx.auth_endorse_hierarchy.object.session, &ctx.objdata, NULL);
+    rc = tpm2_create_primary(ectx, &ctx.auth_endorse_hierarchy.object,
+        &ctx.objdata.in.sensitive, &ctx.objdata.in.public,
+        &ctx.objdata.in.outside_info, &ctx.objdata.in.creation_pcr,
+        &ctx.objdata.out.handle, &ctx.objdata.out.public,
+        &ctx.objdata.out.creation.data, &ctx.objdata.out.hash,
+        &ctx.objdata.out.creation.ticket, 0, TPM2_ALG_ERROR);
     if (rc != tool_rc_success) {
         return rc;
     }
@@ -203,7 +289,8 @@
             return rc;
         }
 
-        rc = tpm2_flush_context(ectx, ctx.objdata.out.handle);
+        rc = tpm2_flush_context(ectx, ctx.objdata.out.handle, NULL,
+            TPM2_ALG_NULL);
         if (rc != tool_rc_success) {
             return rc;
         }
@@ -241,15 +328,13 @@
         ctx.auth_ek.auth_str = value;
         break;
     case 'G': {
-        TPMI_ALG_PUBLIC type = tpm2_alg_util_from_optarg(value,
-                tpm2_alg_util_flags_base);
-        if (type == TPM2_ALG_ERROR) {
+        ctx.key_alg = tpm2_alg_util_numtoalgstr(value, tpm2_alg_util_flags_base);
+        if (!ctx.key_alg) {
             LOG_ERR("Invalid key algorithm, got \"%s\"", value);
             return false;
         }
-        ctx.objdata.in.public.publicArea.type = type;
-    }
         break;
+    }
     case 'u':
         if (!value) {
             LOG_ERR("Please specify an output file to save the pub ek to.");
@@ -293,33 +378,6 @@
     return *opts != NULL;
 }
 
-static void set_default_obj_attrs(void) {
-
-    ctx.objdata.in.public.publicArea.objectAttributes =
-      TPMA_OBJECT_RESTRICTED  | TPMA_OBJECT_ADMINWITHPOLICY
-    | TPMA_OBJECT_DECRYPT     | TPMA_OBJECT_FIXEDTPM
-    | TPMA_OBJECT_FIXEDPARENT | TPMA_OBJECT_SENSITIVEDATAORIGIN;
-}
-
-static void set_default_auth_policy(void) {
-
-    static const TPM2B_DIGEST auth_policy = {
-        .size = 32,
-        .buffer = {
-            0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xB3, 0xF8, 0x1A, 0x90, 0xCC,
-            0x8D, 0x46, 0xA5, 0xD7, 0x24, 0xFD, 0x52, 0xD7, 0x6E, 0x06, 0x52,
-            0x0B, 0x64, 0xF2, 0xA1, 0xDA, 0x1B, 0x33, 0x14, 0x69, 0xAA
-        }
-    };
-
-    TPM2B_DIGEST *authp = &ctx.objdata.in.public.publicArea.authPolicy;
-    *authp = auth_policy;
-}
-
-static void set_default_hierarchy(void) {
-    ctx.objdata.in.hierarchy = TPM2_RH_ENDORSEMENT;
-}
-
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
@@ -395,15 +453,6 @@
         goto out;
     }
 
-    /* override the default attrs */
-    set_default_obj_attrs();
-
-    /* set the auth policy */
-    set_default_auth_policy();
-
-    /* set the default hierarchy */
-    set_default_hierarchy();
-
     /* normalize 0 success 1 failure */
     rc = create_ek_handle(ectx);

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_createpolicy.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_createpolicy.c Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_createprimary.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_createprimary.c Changed

@@ -4,45 +4,59 @@
 
 #include "files.h"
 #include "log.h"
+#include "object.h"
 #include "pcr.h"
+#include "tpm2.h"
 #include "tpm2_tool.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_auth_util.h"
+#include "tpm2_convert.h"
 #include "tpm2_hierarchy.h"
 #include "tpm2_options.h"
 
-#define DEFAULT_ATTRS \
-     TPMA_OBJECT_RESTRICTED|TPMA_OBJECT_DECRYPT \
-    |TPMA_OBJECT_FIXEDTPM|TPMA_OBJECT_FIXEDPARENT \
-    |TPMA_OBJECT_SENSITIVEDATAORIGIN|TPMA_OBJECT_USERWITHAUTH
-
-#define DEFAULT_PRIMARY_KEY_ALG "rsa2048:null:aes128cfb"
-
+#define MAX_SESSIONS 3
 typedef struct tpm_createprimary_ctx tpm_createprimary_ctx;
 struct tpm_createprimary_ctx {
+    /*
+     * Inputs
+     */
     struct {
-        char *auth_str;
-        tpm2_session *session;
-    } parent;
+        const char *ctx_path;
+        const char *auth_str;
+        tpm2_loaded_object object;
+    } auth_hierarchy;
 
     tpm2_hierarchy_pdata objdata;
-    char *context_file;
-    char *unique_file;
+    char *alg;
+    char *halg;
+    char *attrs;
+    char *policy;
     char *key_auth_str;
+    char *unique_file;
+    char *outside_info_data;
+
+    /*
+     * Outputs
+     */
     char *creation_data_file;
     char *creation_ticket_file;
     char *creation_hash_file;
-    char *outside_info_data;
     char *template_data_path;
+    char *context_file;
+    char *output_path;
+    bool format_set;
+    tpm2_convert_pubkey_fmt format;
 
-    char *alg;
-    char *halg;
-    char *attrs;
-    char *policy;
-
-    char *cp_hash_path;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
+#define DEFAULT_PRIMARY_KEY_ALG "rsa2048:null:aes128cfb"
 static tpm_createprimary_ctx ctx = {
     .alg = DEFAULT_PRIMARY_KEY_ALG,
     .objdata = {
@@ -51,127 +65,120 @@
             .hierarchy = TPM2_RH_OWNER
         },
     },
+    .format = pubkey_format_tss,
+    .auth_hierarchy.ctx_path = "owner",
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static bool on_option(char key, char *value) {
+static tool_rc createprimary(ESYS_CONTEXT *ectx) {
 
-    bool res;
+    return tpm2_create_primary(ectx, &ctx.auth_hierarchy.object,
+        &ctx.objdata.in.sensitive, &ctx.objdata.in.public,
+        &ctx.objdata.in.outside_info, &ctx.objdata.in.creation_pcr,
+        &ctx.objdata.out.handle, &ctx.objdata.out.public,
+        &ctx.objdata.out.creation.data, &ctx.objdata.out.hash,
+        &ctx.objdata.out.creation.ticket, &ctx.cp_hash,
+        ctx.parameter_hash_algorithm);
+}
 
-    switch (key) {
-    case 'C': {
-        res = tpm2_util_handle_from_optarg(value, &ctx.objdata.in.hierarchy,
-                TPM2_HANDLE_FLAGS_ALL_HIERACHIES);
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
-        if (!res) {
-            return false;
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
         }
-        break;
     }
-    case 'P':
-        ctx.parent.auth_str = value;
-        break;
-    case 'p':
-        ctx.key_auth_str = value;
-        break;
-    case 'g':
-        ctx.halg = value;
-        break;
-    case 'G':
-        ctx.alg = value;
-        break;
-    case 'c':
-        ctx.context_file = value;
-        break;
-    case 'u':
-        ctx.unique_file = value;
-        break;
-    case 'L':
-        ctx.policy = value;
-        break;
-    case 'a':
-        ctx.attrs = value;
-        break;
-    case 0:
-        ctx.creation_data_file = value;
-        break;
-    case 1:
-        ctx.template_data_path = value;
-        break;
-    case 't':
-        ctx.creation_ticket_file = value;
-        break;
-    case 'd':
-        ctx.creation_hash_file = value;
-        break;
-    case 'q':
-        ctx.outside_info_data = value;
-        break;
-    case 'l':
-        if (!pcr_parse_selections(value, &ctx.objdata.in.creation_pcr)) {
-            LOG_ERR("Could not parse pcr selections, got: \"%s\"", value);
-            return false;
+
+    if (ctx.template_data_path) {
+        bool result = files_save_template(&ctx.objdata.in.public.publicArea,
+            ctx.template_data_path);
+        if (!result) {
+            LOG_ERR("Could not save public template to file.");
+            return tool_rc_general_error;
         }
-        break;
-    case 2:
-        ctx.cp_hash_path = value;
-        break;
-        /* no default */
     }
 
-    return true;
-}
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
 
-static bool tpm2_tool_onstart(tpm2_options **opts) {
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    tpm2_util_public_to_yaml(ctx.objdata.out.public, 0);
 
-    const struct option topts = {
-        { "hierarchy",      required_argument, NULL, 'C' },
-        { "hierarchy-auth", required_argument, NULL, 'P' },
-        { "key-auth",       required_argument, NULL, 'p' },
-        { "hash-algorithm", required_argument, NULL, 'g' },
-        { "key-algorithm",  required_argument, NULL, 'G' },
-        { "key-context",    required_argument, NULL, 'c' },
-        { "policy",         required_argument, NULL, 'L' },
-        { "attributes",     required_argument, NULL, 'a' },
-        { "unique-data",    required_argument, NULL, 'u' },
-        { "creation-data",  required_argument, NULL,  0  },
-        { "template-data",  required_argument, NULL,  1  },
-        { "creation-ticket",required_argument, NULL, 't' },
-        { "creation-hash",  required_argument, NULL, 'd' },
-        { "outside-info",   required_argument, NULL, 'q' },
-        { "pcr-list",       required_argument, NULL, 'l' },
-        { "cphash",         required_argument, NULL,  2  },
-    };
+    rc = ctx.context_file ? files_save_tpm_context_to_path(ectx,
+        ctx.objdata.out.handle, ctx.context_file) : tool_rc_success;
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed saving object context.");
+        return rc;
+    }
 
-    *opts = tpm2_options_new("C:P:p:g:G:c:L:a:u:t:d:q:l:", ARRAY_LEN(topts), topts,
-            on_option, NULL, 0);
+    bool result = true;
+    if (ctx.creation_data_file) {
+        result = files_save_creation_data(ctx.objdata.out.creation.data,
+            ctx.creation_data_file);
+    }
+    if (!result) {
+        LOG_ERR("Failed saving creation data.");
+        return tool_rc_general_error;
+    }
 
-    return *opts != NULL;
-}
+    if (ctx.creation_ticket_file) {
+        result = files_save_creation_ticket(ctx.objdata.out.creation.ticket,
+            ctx.creation_ticket_file);
+    }
+    if (!result) {
+        LOG_ERR("Failed saving creation ticket.");
+        return tool_rc_general_error;
+    }
 
-static tool_rc validate_input_options(void) {
+    if (ctx.creation_hash_file) {
+        result = files_save_digest(ctx.objdata.out.hash,
+            ctx.creation_hash_file);
+    }
+    if (!result) {
+        LOG_ERR("Failed saving creation hash.");
+        return tool_rc_general_error;
+    }
 
-    if (ctx.cp_hash_path && (ctx.creation_data_file || ctx.creation_hash_file ||
-    ctx.creation_ticket_file || ctx.context_file)) {
-        LOG_ERR("Cannot generate outputs when calculating cpHash");
-        return tool_rc_option_error;
+    if (ctx.output_path) {
+        result = tpm2_convert_pubkey_save(ctx.objdata.out.public, ctx.format, ctx.output_path);
+        if (!result) {
+            LOG_ERR("Failed saving public key.");
+            return tool_rc_general_error;
+        }
     }
 
-    return tool_rc_success;
+    return rc;
 }
 
+#define DEFAULT_ATTRS \
+     TPMA_OBJECT_RESTRICTED|TPMA_OBJECT_DECRYPT \
+    |TPMA_OBJECT_FIXEDTPM|TPMA_OBJECT_FIXEDPARENT \
+    |TPMA_OBJECT_SENSITIVEDATAORIGIN|TPMA_OBJECT_USERWITHAUTH
+
 static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
-    /* Parent/ Hierarchy Auth */
-    tool_rc rc = tpm2_auth_util_from_optarg(ectx, ctx.parent.auth_str,
-            &ctx.parent.session, false);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Invalid parent key authorization");
-        return rc;
-    }
+    /*
+     * 1. Object and auth initializations
+     */
 
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
     /* Primary key auth */
     tpm2_session *tmp;
-    rc = tpm2_auth_util_from_optarg(NULL, ctx.key_auth_str, &tmp, true);
+    tool_rc rc = tpm2_auth_util_from_optarg(0, ctx.key_auth_str, &tmp, true);
     if (rc != tool_rc_success) {
         LOG_ERR("Invalid new key authorization");
         return rc;
@@ -183,6 +190,27 @@
     tpm2_session_close(&tmp);
 
     /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+        ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+        TPM2_HANDLE_FLAGS_ALL_HIERACHIES);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid hierarchy authorization");
+        return rc;
+    }
+    ctx.objdata.in.hierarchy = ctx.auth_hierarchy.object.handle;
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    /*
      * Initialize the public properties of the key
      */
     rc = tpm2_alg_util_public_init(ctx.alg, ctx.halg, ctx.attrs,
@@ -214,119 +242,201 @@
     }
 
     /*
-     * Template saved regardless of execution of the TPM2_CC_CreatePrimary.
-     *
-     * TODO: Does this need to be part of the no_execute_only_process_params
-     *       along side processing cphash.
-     *
+     * 4. Configuration for calculating the pHash
      */
-    if (ctx.template_data_path) {
-        bool result = files_save_template(&ctx.objdata.in.public.publicArea,
-            ctx.template_data_path);
-        if (!result) {
-            LOG_ERR("Could not save public template to file.");
-            return tool_rc_general_error;
-        }
-    }
 
-    return tool_rc_success;
-}
-
-static tool_rc no_execute_only_process_params(ESYS_CONTEXT *ectx) {
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        0,
+        0
+    };
 
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    tool_rc rc = tpm2_hierarchy_create_primary(ectx, ctx.parent.session,
-    &ctx.objdata, &cp_hash);
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
 
-    if (rc == tool_rc_success) {
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            LOG_ERR("Failed to save cp hash");
-            rc = tool_rc_general_error;
-        }
-    }
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
 
     return rc;
 }
 
-static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
 
-    tpm2_util_public_to_yaml(ctx.objdata.out.public, NULL);
+    UNUSED(ectx);
 
-    tool_rc  rc = ctx.context_file ? files_save_tpm_context_to_path(ectx,
-    ctx.objdata.out.handle, ctx.context_file) : tool_rc_success;
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed saving object context.");
-        return rc;
+    if (ctx.cp_hash_path && (ctx.creation_data_file || ctx.creation_hash_file ||
+    ctx.creation_ticket_file || ctx.context_file)) {
+        LOG_ERR("Cannot generate outputs when calculating cpHash");
+        return tool_rc_option_error;
     }
 
-    bool result = true;
-    if (ctx.creation_data_file) {
-        result = files_save_creation_data(ctx.objdata.out.creation.data,
-            ctx.creation_data_file);
-    }
-    if (!result) {
-        LOG_ERR("Failed saving creation data.");
-        return tool_rc_general_error;
+    if (ctx.format_set && !ctx.output_path) {
+        LOG_ERR("Cannot specify --format/-f without specifying --output/-o");
+        return tool_rc_option_error;
     }
 
-    if (ctx.creation_ticket_file) {
-        result = files_save_creation_ticket(ctx.objdata.out.creation.ticket,
-            ctx.creation_ticket_file);
-    }
-    if (!result) {
-        LOG_ERR("Failed saving creation ticket.");
-        return tool_rc_general_error;
-    }
+    return tool_rc_success;
+}
 
-    if (ctx.creation_hash_file) {
-        result = files_save_digest(ctx.objdata.out.hash,
-            ctx.creation_hash_file);
-    }
-    if (!result) {
-        LOG_ERR("Failed saving creation hash.");
-        return tool_rc_general_error;
+static bool on_option(char key, char *value) {
+
+    bool result = true;
+    switch (key) {
+    case 'C':
+        ctx.auth_hierarchy.ctx_path = value;
+        break;
+    case 'P':
+        ctx.auth_hierarchy.auth_str = value;
+        break;
+    case 'p':
+        ctx.key_auth_str = value;
+        break;
+    case 'g':
+        ctx.halg = value;
+        break;
+    case 'G':
+        ctx.alg = value;
+        break;
+    case 'c':
+        ctx.context_file = value;
+        break;
+    case 'u':
+        ctx.unique_file = value;
+        break;
+    case 'L':
+        ctx.policy = value;
+        break;
+    case 'a':
+        ctx.attrs = value;
+        break;
+    case 0:
+        ctx.creation_data_file = value;
+        break;
+    case 1:
+        ctx.template_data_path = value;
+        break;
+    case 't':
+        ctx.creation_ticket_file = value;
+        break;
+    case 'd':
+        ctx.creation_hash_file = value;
+        break;
+    case 'q':
+        ctx.outside_info_data = value;
+        break;
+    case 'l':
+        result = pcr_parse_selections(value, &ctx.objdata.in.creation_pcr);
+        if (!result) {
+            LOG_ERR("Could not parse pcr selections, got: \"%s\"", value);
+            return result;
+        }
+        break;
+    case 2:
+        ctx.cp_hash_path = value;
+        break;
+    case 'f':
+        ctx.format = tpm2_convert_pubkey_fmt_from_optarg(value);
+        if (ctx.format == pubkey_format_err) {
+            return false;
+        }
+        ctx.format_set = true;
+        break;
+    case 'o':
+        ctx.output_path = value;
+        break;
+        /* no default */
     }
 
-    return tool_rc_success;
+    return result;
+}
+
+static bool tpm2_tool_onstart(tpm2_options **opts) {
+
+    const struct option topts = {
+        { "hierarchy",      required_argument, 0, 'C' },
+        { "hierarchy-auth", required_argument, 0, 'P' },
+        { "key-auth",       required_argument, 0, 'p' },
+        { "hash-algorithm", required_argument, 0, 'g' },
+        { "key-algorithm",  required_argument, 0, 'G' },
+        { "key-context",    required_argument, 0, 'c' },
+        { "policy",         required_argument, 0, 'L' },
+        { "attributes",     required_argument, 0, 'a' },
+        { "unique-data",    required_argument, 0, 'u' },
+        { "creation-data",  required_argument, 0,  0  },
+        { "template-data",  required_argument, 0,  1  },
+        { "creation-ticket",required_argument, 0, 't' },
+        { "creation-hash",  required_argument, 0, 'd' },
+        { "outside-info",   required_argument, 0, 'q' },
+        { "pcr-list",       required_argument, 0, 'l' },
+        { "cphash",         required_argument, 0,  2  },
+        { "format",         required_argument, 0, 'f' },
+        { "output",         required_argument, 0, 'o' },
+    };
+
+    *opts = tpm2_options_new("C:P:p:g:G:c:L:a:u:t:d:q:l:o:f:", ARRAY_LEN(topts),
+        topts, on_option, 0, 0);
+
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    /* Validate input options */
-    tool_rc rc = validate_input_options();
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
     if (rc != tool_rc_success) {
-        return tool_rc_option_error;
+        return rc;
     }
 
-    /* Process inputs */
+    /*
+     * 2. Process inputs
+     */
     rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    /* Process & return uncoditionally if no execute paths are to be executed */
-    if (ctx.cp_hash_path) { // One of the conditions for no execute
-        return no_execute_only_process_params(ectx);
-    }
-
-    /* Dispatch TPM2_CC_CreatePrimary */
-    rc = tpm2_hierarchy_create_primary(ectx, ctx.parent.session, &ctx.objdata,
-    NULL);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = createprimary(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    /* Process outputs and return */
-    return process_outputs(ectx);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    return tpm2_session_close(&ctx.parent.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 static void tpm2_tool_onexit(void) {
@@ -335,4 +445,5 @@
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("createprimary", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, tpm2_tool_onexit)
+TPM2_TOOL_REGISTER("createprimary", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, tpm2_tool_onexit)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_dictionarylockout.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_dictionarylockout.c Changed

@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: BSD-3-Clause */
 
 #include <stdbool.h>
+#include <stdlib.h>
 
 #include "files.h"
 #include "log.h"
@@ -8,8 +9,12 @@
 #include "tpm2_tool.h"
 #include "tpm2_options.h"
 
+#define MAX_SESSIONS 3
 typedef struct dictionarylockout_ctx dictionarylockout_ctx;
 struct dictionarylockout_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -21,13 +26,202 @@
     UINT32 lockout_recovery_time;
     bool clear_lockout;
     bool setup_parameters;
-    char *cp_hash_path;
+    bool is_setup_max_tries;
+    bool is_setup_recovery_time;
+    bool is_setup_lockoutrecovery_time;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static dictionarylockout_ctx ctx = {
     .auth_hierarchy.ctx_path = "l",
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
+
+static tool_rc dictionarylockout(ESYS_CONTEXT *ectx) {
+
+    /*
+     * If setup params and clear lockout are both required, clear lockout should
+     * precede parameters setup.
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tool_rc_success;
+    if (ctx.clear_lockout) {
+        tmp_rc = tpm2_dictionarylockout_reset(ectx, &ctx.auth_hierarchy.object,
+            &ctx.cp_hash, ctx.parameter_hash_algorithm);
+        if (tmp_rc != tool_rc_success) {
+            LOG_ERR("Failed DictionaryLockout Reset");
+            rc = tmp_rc;
+        }
+    }
+
+    if (ctx.setup_parameters) {
+        tmp_rc = tpm2_dictionarylockout_setup(ectx, &ctx.auth_hierarchy.object,
+            ctx.max_tries, ctx.recovery_time, ctx.lockout_recovery_time,
+            &ctx.cp_hash, ctx.parameter_hash_algorithm);
+        if (tmp_rc != tool_rc_success) {
+            LOG_ERR("Failed DictionaryLockout Setup");
+            rc = tmp_rc;
+        }
+    }
+
+    return rc;
+}
+
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    return rc;
+}
+
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_L);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid lockout authorization");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    if (ctx.setup_parameters && ctx.is_command_dispatch) {
+        TPMS_CAPABILITY_DATA *capabilities = 0;
+        rc = tpm2_getcap(ectx, TPM2_CAP_TPM_PROPERTIES, TPM2_PT_VAR,
+            TPM2_MAX_TPM_PROPERTIES, 0, &capabilities);
+        if (rc != tool_rc_success) {
+            LOG_ERR("Couldn't read the currently setup parameters.");
+            return rc;
+        }
+
+        TPMS_TAGGED_PROPERTY *properties = capabilities->data.tpmProperties.tpmProperty;
+        size_t count = capabilities->data.tpmProperties.count;
+
+        if (!count) {
+            LOG_ERR("Couldn't read the currently setup parameters.");
+            free(capabilities);
+            return tool_rc_general_error;
+        }
+
+        size_t i;
+        for (i = 0; i < count; i++) {
+            if (!ctx.is_setup_max_tries &&
+                propertiesi.property == TPM2_PT_MAX_AUTH_FAIL) {
+                ctx.max_tries = propertiesi.value;
+                continue;
+            }
+            if (!ctx.is_setup_recovery_time &&
+                propertiesi.property == TPM2_PT_LOCKOUT_INTERVAL) {
+                ctx.recovery_time = propertiesi.value;
+                continue;
+            }
+            if (!ctx.is_setup_lockoutrecovery_time &&
+                propertiesi.property == TPM2_PT_LOCKOUT_RECOVERY) {
+                ctx.lockout_recovery_time = propertiesi.value;
+                continue;
+            }
+        }
+        free(capabilities);
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    if (!ctx.clear_lockout && !ctx.setup_parameters) {
+        LOG_ERR("Invalid operational input: Neither Setup nor Clear lockout "
+            "requested.");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.setup_parameters && ctx.clear_lockout && ctx.cp_hash_path) {
+        LOG_ERR("When calculating pHash, select parameter setup or reset,"
+            " not both");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
+
 static bool on_option(char key, char *value) {
 
     bool result;
@@ -53,6 +247,8 @@
         if (ctx.max_tries == 0) {
             return false;
         }
+
+        ctx.is_setup_max_tries = true;
         break;
     case 't':
         result = tpm2_util_string_to_uint32(value, &ctx.recovery_time);
@@ -61,6 +257,8 @@
                     value);
             return false;
         }
+
+        ctx.is_setup_recovery_time = true;
         break;
     case 'l':
         result = tpm2_util_string_to_uint32(value, &ctx.lockout_recovery_time);
@@ -69,6 +267,7 @@
                 "\"%s\"", value);
             return false;
         }
+        ctx.is_setup_lockoutrecovery_time = true;
         break;
     case 0:
         ctx.cp_hash_path = value;
@@ -81,90 +280,75 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
-        { "max-tries",             required_argument, NULL, 'n' },
-        { "recovery-time",         required_argument, NULL, 't' },
-        { "lockout-recovery-time", required_argument, NULL, 'l' },
-        { "auth",                  required_argument, NULL, 'p' },
-        { "clear-lockout",         no_argument,       NULL, 'c' },
-        { "setup-parameters",      no_argument,       NULL, 's' },
-        { "cphash",                required_argument, NULL,  0  },
+        { "max-tries",             required_argument, 0, 'n' },
+        { "recovery-time",         required_argument, 0, 't' },
+        { "lockout-recovery-time", required_argument, 0, 'l' },
+        { "auth",                  required_argument, 0, 'p' },
+        { "clear-lockout",         no_argument,       0, 'c' },
+        { "setup-parameters",      no_argument,       0, 's' },
+        { "cphash",                required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("n:t:l:p:cs", ARRAY_LEN(topts), topts, on_option,
-    NULL, 0);
+        0, 0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    if (!ctx.clear_lockout && !ctx.setup_parameters) {
-        LOG_ERR("Invalid operational input: Neither Setup nor Clear lockout "
-                "requested.");
-        return tool_rc_option_error;
-    }
-
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_L);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid authorization");
         return rc;
     }
 
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    if (ctx.cp_hash_path && ctx.clear_lockout) {
-        LOG_WARN("Calculating cpHash. Exiting without resetting dictionary lockout");
-        tool_rc rc = tpm2_dictionarylockout_reset(ectx,
-        &ctx.auth_hierarchy.object, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-        goto out;
-    }
-
-    if (ctx.cp_hash_path && ctx.setup_parameters) {
-        LOG_WARN("Calculating cpHash. Exiting without setting dictionary lockout");
-        tool_rc rc = tpm2_dictionarylockout_setup(ectx,
-        &ctx.auth_hierarchy.object, ctx.max_tries, ctx.recovery_time,
-        ctx.lockout_recovery_time, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-        goto out;
-    }
-
     /*
-     * If setup params and clear lockout are both required, clear lockout should
-     * precede parameters setup.
+     * 2. Process inputs
      */
-    if (ctx.clear_lockout) {
-        return tpm2_dictionarylockout_reset(ectx, &ctx.auth_hierarchy.object,
-        NULL);
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    if (ctx.setup_parameters) {
-        return tpm2_dictionarylockout_setup(ectx, &ctx.auth_hierarchy.object,
-        ctx.max_tries, ctx.recovery_time, ctx.lockout_recovery_time, NULL);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = dictionarylockout(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-out:
-    if (ctx.cp_hash_path) {
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
-    }
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("dictionarylockout", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("dictionarylockout", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_duplicate.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_duplicate.c Changed

@@ -2,250 +2,357 @@
 
 #include <stdbool.h>
 #include <stdlib.h>
+#include <string.h>
+
+#include <tss2/tss2_mu.h>
 
 #include "files.h"
 #include "log.h"
 #include "tpm2.h"
-#include "tpm2_tool.h"
 #include "tpm2_alg_util.h"
+#include "tpm2_identity_util.h"
+#include "tpm2_openssl.h"
 #include "tpm2_options.h"
+#include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_duplicate_ctx tpm_duplicate_ctx;
 struct tpm_duplicate_ctx {
+    /*
+     * Inputs
+     */
+    /* common */
     struct {
         const char *ctx_path;
         const char *auth_str;
+        char *policy_str;
         tpm2_loaded_object object;
     } duplicable_key;
 
+    char *key_type;
+
+    /* tpm2_duplicate only */
     struct {
         const char *ctx_path;
         tpm2_loaded_object object;
     } new_parent_key;
 
-    char *duplicate_key_public_file;
-    char *duplicate_key_private_file;
+    TPMT_SYM_DEF_OBJECT sym_alg;
 
-    TPMI_ALG_PUBLIC key_type;
     char *sym_key_in;
-    char *sym_key_out;
+    TPM2B_DATA in_key;
+
+    /* tpm2_openssl */
+    const char *in_private_key_file;
+    TPM2B_SENSITIVE in_private_key_data;
+    const char *in_parent_public_key_file;
+    TPM2B_PUBLIC in_parent_public_key_data;
+
+    bool is_openssl_duplicate;
 
+    /*
+     * Outputs
+     */
+    /*common*/
+    const char *out_duplicate_key_private_file;
     char *enc_seed_out;
 
-    struct {
-        UINT16 c :1;
-        UINT16 C :1;
-        UINT16 g :1;
-        UINT16 i :1;
-        UINT16 o :1;
-        UINT16 r :1;
-        UINT16 s :1;
-    } flags;
-
-    char *cp_hash_path;
+    /* tpm2_openssl */
+    const char *out_duplicate_key_public_file;
+    TPM2B_PUBLIC out_public_data;
+
+    /*tpm2_duplicate*/
+    TPM2B_ENCRYPTED_SECRET *out_sym_seed;
+
+    char *sym_key_out;
+    TPM2B_DATA *out_key;
+
+    TPM2B_PRIVATE *out_private_data;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_duplicate_ctx ctx = {
-    .key_type = TPM2_ALG_ERROR,
+    .out_public_data = TPM2B_EMPTY_INIT,
+    .in_private_key_data = TPM2B_EMPTY_INIT,
+    .in_parent_public_key_data = TPM2B_EMPTY_INIT,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tool_rc do_duplicate(ESYS_CONTEXT *ectx, TPM2B_DATA *in_key,
-        TPMT_SYM_DEF_OBJECT *sym_alg, TPM2B_DATA **out_key,
-        TPM2B_PRIVATE **duplicate, TPM2B_ENCRYPTED_SECRET **encrypted_seed) {
-
-    if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_duplicate(ectx, &ctx.duplicable_key.object,
-            &ctx.new_parent_key.object, in_key, sym_alg, out_key, duplicate,
-            encrypted_seed, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
-        return rc;
-    }
+static tool_rc duplicate(ESYS_CONTEXT *ectx) {
 
     return tpm2_duplicate(ectx, &ctx.duplicable_key.object,
-            &ctx.new_parent_key.object, in_key, sym_alg, out_key, duplicate,
-            encrypted_seed, NULL);
+        &ctx.new_parent_key.object, &ctx.in_key, &ctx.sym_alg, &ctx.out_key,
+        &ctx.out_private_data, &ctx.out_sym_seed, &ctx.cp_hash,
+        ctx.parameter_hash_algorithm);
 }
 
-static bool on_option(char key, char *value) {
+static tool_rc openssl_create_duplicate(void) {
 
-    switch (key) {
-    case 'p':
-        ctx.duplicable_key.auth_str = value;
-        break;
-    case 'G':
-        ctx.key_type = tpm2_alg_util_from_optarg(value,
-                tpm2_alg_util_flags_symmetric | tpm2_alg_util_flags_misc);
-        if (ctx.key_type != TPM2_ALG_ERROR) {
-            ctx.flags.g = 1;
-        }
-        break;
-    case 'i':
-        ctx.sym_key_in = value;
-        ctx.flags.i = 1;
-        break;
-    case 'o':
-        ctx.sym_key_out = value;
-        ctx.flags.o = 1;
-        break;
-    case 'C':
-        ctx.new_parent_key.ctx_path = value;
-        ctx.flags.C = 1;
-        break;
-    case 'c':
-        ctx.duplicable_key.ctx_path = value;
-        ctx.flags.c = 1;
-        break;
-    case 'r':
-        ctx.duplicate_key_private_file = value;
-        ctx.flags.r = 1;
-        break;
-    case 's':
-        ctx.enc_seed_out = value;
-        ctx.flags.s = 1;
-        break;
-    case 0:
-        ctx.cp_hash_path = value;
-        break;
-    default:
-        LOG_ERR("Invalid option");
-        return false;
+    /*
+     * Calculate the object name.
+     */
+    tool_rc rc = tool_rc_success;
+    TPM2B_NAME pubname = TPM2B_TYPE_INIT(TPM2B_NAME, name);
+    bool result = tpm2_identity_create_name(&ctx.out_public_data, &pubname);
+    if (!result) {
+        rc = tool_rc_general_error;
+        goto out;
     }
 
-    return true;
-}
+    TPM2B_DIGEST * seed = &ctx.in_private_key_data.sensitiveArea.seedValue;
+    TPM2B_MAX_BUFFER hmac_key;
+    TPM2B_MAX_BUFFER enc_key;
+    tpm2_identity_util_calc_outer_integrity_hmac_key_and_dupsensitive_enc_key(
+        &ctx.in_parent_public_key_data, &pubname, seed, &hmac_key, &enc_key);
+
+    /*
+     * Marshall the private key into a buffer
+     */
+    TPM2B_MAX_BUFFER marshalled_sensitive = TPM2B_EMPTY_INIT;
+    size_t marshalled_sensitive_size = 0;
+    TSS2_RC rval = Tss2_MU_TPMT_SENSITIVE_Marshal(
+        &ctx.in_private_key_data.sensitiveArea,
+        marshalled_sensitive.buffer + sizeof(marshalled_sensitive.size),
+        TPM2_MAX_DIGEST_BUFFER, &marshalled_sensitive_size);
+    if (rval != TPM2_RC_SUCCESS) {
+        LOG_ERR("Error serializing sensitive area");
+        rc = tool_rc_general_error;
+        goto out;
+    }
 
-static bool tpm2_tool_onstart(tpm2_options **opts) {
+    size_t marshalled_sensitive_size_info = 0;
+    rval = Tss2_MU_UINT16_Marshal(marshalled_sensitive_size,
+        marshalled_sensitive.buffer, sizeof(marshalled_sensitive.size),
+        &marshalled_sensitive_size_info);
+    if (rval != TPM2_RC_SUCCESS) {
+        LOG_ERR("Error serializing sensitive area size");
+        rc = tool_rc_general_error;
+        goto out;
+    }
 
-    const struct option topts = {
-      { "auth",              required_argument, NULL, 'p'},
-      { "wrapper-algorithm", required_argument, NULL, 'G'},
-      { "private",           required_argument, NULL, 'r'},
-      { "encryptionkey-in",  required_argument, NULL, 'i'},
-      { "encryptionkey-out", required_argument, NULL, 'o'},
-      { "encrypted-seed",    required_argument, NULL, 's'},
-      { "parent-context",    required_argument, NULL, 'C'},
-      { "key-context",       required_argument, NULL, 'c'},
-      { "cphash",            required_argument, NULL,  0 },
-    };
+    marshalled_sensitive.size =
+        marshalled_sensitive_size + marshalled_sensitive_size_info;
+
+    /*
+     * Compute the outer HMAC over the marshalled sensitive area
+     * and encrypt it with the seed value.
+     */
+    TPM2B_DIGEST outer_hmac = TPM2B_EMPTY_INIT;
+    TPM2B_MAX_BUFFER encrypted_duplicate_sensitive = TPM2B_EMPTY_INIT;
+    tpm2_identity_util_calculate_outer_integrity(
+        ctx.in_parent_public_key_data.publicArea.nameAlg,
+        &pubname, &marshalled_sensitive, &hmac_key, &enc_key,
+        &ctx.in_parent_public_key_data.publicArea.parameters.rsaDetail.symmetric,
+        &encrypted_duplicate_sensitive, &outer_hmac);
+
+    /*
+     * Build the private data structure for writing out
+     */
+    TPM2B_PRIVATE private = TPM2B_EMPTY_INIT;
+    UINT16 parent_hash_size = tpm2_alg_util_get_hash_size(
+        ctx.in_parent_public_key_data.publicArea.nameAlg);
+
+    private.size = sizeof(parent_hash_size) +
+        parent_hash_size + encrypted_duplicate_sensitive.size;
+
+    size_t hmac_size_offset = 0;
+    rval = Tss2_MU_UINT16_Marshal(parent_hash_size, private.buffer,
+        sizeof(parent_hash_size), &hmac_size_offset);
+    if (rval != TPM2_RC_SUCCESS) {
+        LOG_ERR("Error serializing hmac size");
+        rc = tool_rc_general_error;
+        goto out;
+    }
+
+    memcpy(private.buffer + hmac_size_offset, outer_hmac.buffer,
+        parent_hash_size);
+    memcpy(private.buffer + hmac_size_offset + parent_hash_size,
+        encrypted_duplicate_sensitive.buffer,
+        encrypted_duplicate_sensitive.size);
 
-    *opts = tpm2_options_new("p:G:i:C:o:s:r:c:", ARRAY_LEN(topts), topts,
-            on_option, NULL, 0);
+    ctx.out_private_data = malloc(private.size + sizeof(private.size));
+    memcpy(ctx.out_private_data, &private, private.size + sizeof(private.size));
 
-    return *opts != NULL;
+out:
+    return rc;
 }
 
-/**
- * Check all options and report as many errors as possible via LOG_ERR.
- * @return
- *  true on success, false on failure.
- */
-static bool check_options(void) {
+#define DEFAULT_DUPLICATE_ATTRS (TPMA_OBJECT_USERWITHAUTH|TPMA_OBJECT_DECRYPT|TPMA_OBJECT_SIGN_ENCRYPT)
+static void setup_default_attrs(TPMA_OBJECT *attrs, bool has_policy,
+    bool has_auth) {
 
-    bool result = true;
+    /* Handle Default Setup */
+    *attrs = DEFAULT_DUPLICATE_ATTRS;
 
-    /* Check for NULL alg & (keyin | keyout) */
-    if (ctx.flags.g == 0) {
-        LOG_ERR("Expected key type to be specified via \"-G\","
-                " missing option.");
-        result = false;
+    /*
+     * IMPORTANT: if the object we're creating has a policy and NO authvalue, turn off userwith auth
+     * so empty passwords don't work on the object.
+     */
+    if (has_policy && !has_auth) {
+        *attrs &= ~TPMA_OBJECT_USERWITHAUTH;
     }
+}
 
-    if (ctx.key_type != TPM2_ALG_NULL) {
-        if ((ctx.flags.i == 0) && (ctx.flags.o == 0)) {
-            LOG_ERR("Expected in or out encryption key file \"-k/K\","
-                    " missing option.");
-            result = false;
-        }
-        if (ctx.flags.i && ctx.flags.o) {
-            LOG_ERR("Expected either in or out encryption key file \"-k/K\","
-                    " conflicting options.");
-            result = false;
-        }
-    } else {
-        if (ctx.flags.i || ctx.flags.o) {
-            LOG_ERR("Expected neither in nor out encryption key file \"-k/K\","
-                    " conflicting options.");
-            result = false;
-        }
-    }
+static tool_rc process_openssl_duplicate(void) {
 
-    if (ctx.flags.C == 0) {
-        LOG_ERR("Expected new parent object to be specified via \"-C\","
-                " missing option.");
-        result = false;
+    bool result = files_load_public(ctx.in_parent_public_key_file,
+        &ctx.in_parent_public_key_data);
+    if (!result) {
+        return tool_rc_general_error;
     }
 
-    if (ctx.flags.c == 0) {
-        LOG_ERR("Expected object to be specified via \"-c\","
-                " missing option.");
-        result = false;
-    }
+    TPMA_OBJECT attrs = 0;
+    bool is_policy_specified = (ctx.duplicable_key.policy_str != 0);
+    bool is_auth_specified = (ctx.duplicable_key.auth_str != 0);
+    setup_default_attrs(&attrs, is_policy_specified, is_auth_specified);
 
-    if (ctx.flags.s == 0) {
-        LOG_ERR(
-                "Expected encrypted seed out filename to be specified via \"-S\","
-                        " missing option.");
-        result = false;
+    TPM2B_PUBLIC template = { 0 };
+    tool_rc rc = tpm2_alg_util_public_init(ctx.key_type, 0, 0,
+        ctx.duplicable_key.policy_str, attrs, &template);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    if (ctx.flags.r == 0) {
-        LOG_ERR("Expected private key out filename to be specified via \"-r\","
-                " missing option.");
-        result = false;
+    TPM2B_ENCRYPTED_SECRET encrypted_seed = TPM2B_EMPTY_INIT;
+    result = tpm2_openssl_import_keys(&ctx.in_parent_public_key_data, &encrypted_seed,
+        ctx.duplicable_key.auth_str, ctx.in_private_key_file, 0, &template,
+        &ctx.in_private_key_data, &ctx.out_public_data);
+    if (!result) {
+        return tool_rc_general_error;
     }
 
-    return result;
+    ctx.out_sym_seed = malloc(encrypted_seed.size +
+        sizeof(encrypted_seed.size));
+    memcpy(ctx.out_sym_seed, &encrypted_seed,
+        encrypted_seed.size + sizeof(encrypted_seed.size));
+
+    return tool_rc_success;
 }
 
-static bool set_key_algorithm(TPMI_ALG_PUBLIC alg, TPMT_SYM_DEF_OBJECT * obj) {
-    bool result = true;
-    switch (alg) {
-    case TPM2_ALG_AES:
+static bool set_key_algorithm(const char *algstr, TPMT_SYM_DEF_OBJECT * obj) {
+
+    bool is_algstr_null = (strcmp(algstr, "null") == 0);
+    if (is_algstr_null) {
+        obj->algorithm = TPM2_ALG_NULL;
+        return true;
+    }
+    
+    bool is_algstr_aes = (strcmp(algstr, "aes") == 0);
+    if (is_algstr_aes) {
         obj->algorithm = TPM2_ALG_AES;
         obj->keyBits.aes = 128;
         obj->mode.aes = TPM2_ALG_CFB;
-        break;
-    case TPM2_ALG_NULL:
-        obj->algorithm = TPM2_ALG_NULL;
-        break;
-    default:
-        LOG_ERR("The algorithm type input(0x%x) is not supported!", alg);
-        result = false;
-        break;
+        return true;
     }
-    return result;
-}
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
-    UNUSED(flags);
+    LOG_ERR("The algorithm \"%s\" is not supported!", algstr);
+    return false;
+}
 
-    tool_rc rc = tool_rc_general_error;
-    TPMT_SYM_DEF_OBJECT sym_alg;
-    TPM2B_DATA in_key;
-    TPM2B_DATA* out_key = NULL;
-    TPM2B_PRIVATE* duplicate;
-    TPM2B_ENCRYPTED_SECRET* out_sym_seed;
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
-    bool result = check_options();
-    if (!result) {
-        return tool_rc_option_error;
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path && !ctx.is_openssl_duplicate) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
     }
 
-    rc = tpm2_util_object_load(ectx, ctx.new_parent_key.ctx_path,
-            &ctx.new_parent_key.object, TPM2_HANDLE_ALL_W_NV);
-    if (rc != tool_rc_success) {
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch && !ctx.is_openssl_duplicate) {
         return rc;
     }
 
-    rc = tpm2_util_object_load_auth(ectx, ctx.duplicable_key.ctx_path,
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    if (ctx.sym_key_out && !ctx.is_openssl_duplicate) {
+        if (ctx.out_key == 0) {
+            LOG_ERR("No encryption key from TPM ");
+            rc = tool_rc_general_error;
+            goto out;
+        }
+        is_file_op_success = files_save_bytes_to_file(ctx.sym_key_out,
+            ctx.out_key->buffer, ctx.out_key->size);
+        if (!is_file_op_success) {
+            LOG_ERR("Failed to save encryption key out into file \"%s\"",
+                    ctx.sym_key_out);
+            rc = tool_rc_general_error;
+            goto out;
+        }
+    }
+
+    is_file_op_success = files_save_encrypted_seed(ctx.out_sym_seed, ctx.enc_seed_out);
+    if (!is_file_op_success) {
+        LOG_ERR("Failed to save encryption seed into file \"%s\"",
+                ctx.enc_seed_out);
+        rc = tool_rc_general_error;
+        goto out;
+    }
+
+    is_file_op_success = files_save_private(ctx.out_private_data,
+        ctx.out_duplicate_key_private_file);
+    if (!is_file_op_success) {
+        LOG_ERR("Failed to save private key into file \"%s\"",
+                ctx.out_duplicate_key_private_file);
+        rc = tool_rc_general_error;
+        goto out;
+    }
+
+    if (ctx.is_openssl_duplicate) {
+        is_file_op_success = files_save_public(&ctx.out_public_data,
+            ctx.out_duplicate_key_public_file);
+        if (!is_file_op_success) {
+            LOG_ERR("Failed to save public key into file \"%s\"",
+                ctx.out_duplicate_key_public_file);
+            rc = tool_rc_general_error;
+            goto out;
+        }
+    }
+
+out:
+    return rc;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 3.a Command specific initializations
+     *
+     * No further processing as duplication is handled without going to the TPM
+     * 
+     */
+    if (ctx.is_openssl_duplicate) {
+        return process_openssl_duplicate();
+    }
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.duplicable_key.ctx_path,
             ctx.duplicable_key.auth_str, &ctx.duplicable_key.object, false,
             TPM2_HANDLE_ALL_W_NV);
     if (rc != tool_rc_success) {
@@ -253,79 +360,275 @@
         return rc;
     }
 
-    result = set_key_algorithm(ctx.key_type, &sym_alg);
+    /* Object #2 */
+    rc = tpm2_util_object_load(ectx, ctx.new_parent_key.ctx_path,
+            &ctx.new_parent_key.object, TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3.b Command specific initializations
+     */
+    bool result = set_key_algorithm(ctx.key_type, &ctx.sym_alg);
     if (!result) {
         return tool_rc_general_error;
     }
 
-    if (ctx.flags.i) {
-        in_key.size = 16;
-        result = files_load_bytes_from_path(ctx.sym_key_in, in_key.buffer,
-                &in_key.size);
+    if (ctx.sym_key_in) {
+        ctx.in_key.size = 16;
+        result = files_load_bytes_from_path(ctx.sym_key_in, ctx.in_key.buffer,
+                &ctx.in_key.size);
         if (!result) {
             return tool_rc_general_error;
         }
-        if (in_key.size != 16) {
+        if (ctx.in_key.size != 16) {
             LOG_ERR("Invalid AES key size, got %u bytes, expected 16",
-                    in_key.size);
+                    ctx.in_key.size);
             return tool_rc_general_error;
         }
     }
 
-    rc = do_duplicate(ectx, ctx.flags.i ? &in_key : NULL, &sym_alg,
-            ctx.flags.o ? &out_key : NULL, &duplicate, &out_sym_seed);
-    if (rc != tool_rc_success || ctx.cp_hash_path) {
-        return rc;
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.duplicable_key.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    bool result = true;
+    /* Check for NULL alg & (keyin | keyout) */
+    if (!ctx.key_type) {
+        LOG_ERR("Expected key type to be specified via \"-G\","
+                " missing option.");
+        result = false;
     }
 
-    /* Maybe a false positive from scan-build but we'll check out_key anyway */
-    if (ctx.flags.o) {
-        if (out_key == NULL) {
-            LOG_ERR("No encryption key from TPM ");
-            rc = tool_rc_general_error;
-            goto out;
+    /* If -G is not "null" we need an encryption key */
+    bool is_key_type_not_null = strcmp(ctx.key_type, "null");
+    bool is_in_or_out_enc_key_expected =
+        (is_key_type_not_null && !ctx.in_parent_public_key_file);
+
+    if (is_in_or_out_enc_key_expected) {
+        if (!ctx.sym_key_in && !ctx.sym_key_out) {
+            LOG_ERR("Expected in or out encryption key file \"-i/o\","
+                    " missing option.");
+            result = false;
         }
-        result = files_save_bytes_to_file(ctx.sym_key_out, out_key->buffer,
-                out_key->size);
-        if (!result) {
-            LOG_ERR("Failed to save encryption key out into file \"%s\"",
-                    ctx.sym_key_out);
-            rc = tool_rc_general_error;
-            goto out;
+
+        if (ctx.sym_key_in && ctx.sym_key_out) {
+            LOG_ERR("Expected either in or out encryption key file \"-i/o\","
+                    " conflicting options.");
+            result = false;
         }
     }
 
-    result = files_save_encrypted_seed(out_sym_seed, ctx.enc_seed_out);
-    if (!result) {
-        LOG_ERR("Failed to save encryption seed into file \"%s\"",
-                ctx.enc_seed_out);
-        rc = tool_rc_general_error;
-        goto out;
+    if (!is_in_or_out_enc_key_expected && (ctx.sym_key_in || ctx.sym_key_out)) {
+        LOG_ERR("Expected neither in nor out encryption key file \"-i/o\","
+                " conflicting options.");
+        result = false;
     }
 
-    result = files_save_private(duplicate, ctx.duplicate_key_private_file);
-    if (!result) {
-        LOG_ERR("Failed to save private key into file \"%s\"",
-                ctx.duplicate_key_private_file);
-        rc = tool_rc_general_error;
-        goto out;
+    bool is_parent_public_specified = (ctx.in_parent_public_key_file != 0);
+    bool is_local_private_specified = (ctx.in_private_key_file != 0);
+    bool is_parent_public_and_local_private_availability_conflict =
+        (is_parent_public_specified != is_local_private_specified);
+
+    if (is_parent_public_and_local_private_availability_conflict) {
+        LOG_ERR("Conflicting options: remote public key and local private key "
+                "must both be specified");
+        result = false;
     }
 
-    rc = tool_rc_success;
+    bool is_neither_parent_public_nor_local_private_spcified =
+        (!is_parent_public_specified && !is_local_private_specified);
+    if (is_neither_parent_public_nor_local_private_spcified) {
+	    if (!ctx.new_parent_key.ctx_path) {
+	        LOG_ERR("Expected new parent object to be specified via \"-C\","
+	        " missing option.");
+	        result = false;
+	    }
+
+	    if (!ctx.duplicable_key.ctx_path) {
+	        LOG_ERR("Expected object to be specified via \"-c\","
+	        " missing option.");
+	        result = false;
+	    }
+
+	    if (!ctx.enc_seed_out) {
+	        LOG_ERR(
+	        "Expected encrypted seed out filename to be specified via \"-S\","
+	    	    " missing option.");
+	        result = false;
+	    }
+
+	    if (!ctx.out_duplicate_key_private_file) {
+	        LOG_ERR("Expected private key out filename to be specified via \"-r\","
+	        " missing option.");
+	        result = false;
+	    }
+    }
 
-out:
-    free(out_key);
-    free(out_sym_seed);
-    free(duplicate);
+    return result ? tool_rc_success : tool_rc_option_error;
+}
 
-    return rc;
+static bool on_option(char key, char *value) {
+
+    switch (key) {
+    case 'p':
+        ctx.duplicable_key.auth_str = value;
+        break;
+    case 'L':
+        ctx.duplicable_key.policy_str = value;
+        break;
+    case 'G':
+        ctx.key_type = value;
+        break;
+    case 'i':
+        ctx.sym_key_in = value;
+        break;
+    case 'o':
+        ctx.sym_key_out = value;
+        break;
+    case 'C':
+        ctx.new_parent_key.ctx_path = value;
+        break;
+    case 'c':
+        ctx.duplicable_key.ctx_path = value;
+        break;
+    case 'r':
+        ctx.out_duplicate_key_private_file = value;
+        break;
+    case 'u':
+        ctx.out_duplicate_key_public_file = value;
+        break;
+    case 's':
+        ctx.enc_seed_out = value;
+        break;
+    case 'U':
+        ctx.in_parent_public_key_file = value;
+        ctx.is_openssl_duplicate = true;
+        break;
+    case 'k':
+        ctx.in_private_key_file = value;
+        break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
+    default:
+        LOG_ERR("Invalid option");
+        return false;
+    }
+
+    return true;
+}
+
+static bool tpm2_tool_onstart(tpm2_options **opts) {
+
+    const struct option topts = {
+      { "auth",              required_argument, 0, 'p'},
+      { "policy",            required_argument, 0, 'L'},
+      { "wrapper-algorithm", required_argument, 0, 'G'},
+      { "private",           required_argument, 0, 'r'},
+      { "public",            required_argument, 0, 'u'},
+      { "private-key",       required_argument, 0, 'k'},
+      { "encryptionkey-in",  required_argument, 0, 'i'},
+      { "encryptionkey-out", required_argument, 0, 'o'},
+      { "encrypted-seed",    required_argument, 0, 's'},
+      { "parent-context",    required_argument, 0, 'C'},
+      { "parent-public",     required_argument, 0, 'U'},
+      { "key-context",       required_argument, 0, 'c'},
+      { "cphash",            required_argument, 0,  0 },
+    };
+
+    *opts = tpm2_options_new("p:L:G:i:C:o:s:r:c:U:k:u:", ARRAY_LEN(topts), topts,
+            on_option, 0, TPM2_OPTIONS_OPTIONAL_SAPI);
+
+    return *opts != 0;
+}
+
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+
+    UNUSED(flags);
+
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = ctx.is_openssl_duplicate ? openssl_create_duplicate() : duplicate(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    return tpm2_session_close(&ctx.duplicable_key.object.session);
+    /*
+     * 1. Free objects
+     */
+    free(ctx.out_key);
+    free(ctx.out_sym_seed);
+    free(ctx.out_private_data);
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.duplicable_key.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("duplicate", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("duplicate", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_ecdhkeygen.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_ecdhkeygen.c Changed

@@ -6,53 +6,142 @@
 #include "tpm2_tool.h"
 #include "tpm2_options.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_ecdhkeygen_ctx tpm_ecdhkeygen_ctx;
 struct tpm_ecdhkeygen_ctx {
-
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         tpm2_loaded_object object;
     } ecc_public_key;
 
+    /*
+     * Outputs
+     */
     const char *ecdh_pub_path;
-    const char *ecdh_Z_path;
+    TPM2B_ECC_POINT *Q;
 
+    const char *ecdh_Z_path;
     TPM2B_ECC_POINT *Z;
-    TPM2B_ECC_POINT *Q;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
 };
 
-static tpm_ecdhkeygen_ctx ctx;
+static tpm_ecdhkeygen_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+};
 
-static bool on_option(char key, char *value) {
+static tool_rc ecdhkeygen(ESYS_CONTEXT *ectx) {
 
-    switch (key) {
+    tool_rc rc = tpm2_ecdhkeygen(ectx, &ctx.ecc_public_key.object, &ctx.Z,
+        &ctx.Q, &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed TPM2_CC_ECDH_KeyGen");
+    }
 
-        case 'c':
-            ctx.ecc_public_key.ctx_path = value;
-            break;
-        case 'u':
-            ctx.ecdh_pub_path = value;
-            break;
-        case 'o':
-            ctx.ecdh_Z_path = value;
-            break;
-    };
+    return rc;
+}
 
-    return true;
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    bool result = files_save_ecc_point(ctx.Q, ctx.ecdh_pub_path);
+    if (!result) {
+        LOG_ERR("Failed to write out the public");
+        return tool_rc_general_error;
+    }
+
+    result = files_save_ecc_point(ctx.Z, ctx.ecdh_Z_path);
+    if (!result) {
+        LOG_ERR("Failed to write out the public");
+        return tool_rc_general_error;
+    }
+
+    return tool_rc_success;
 }
 
-static bool tpm2_tool_onstart(tpm2_options **opts) {
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
-    static struct option topts = {
-      { "context", required_argument, NULL, 'c' },
-      { "public",  required_argument, NULL, 'u' },
-      { "output",  required_argument, NULL, 'o' },
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_util_object_load(ectx, ctx.ecc_public_key.ctx_path,
+        &ctx.ecc_public_key.object,
+        TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        0,
+        0,
+        0
     };
 
-    *opts = tpm2_options_new("c:u:o:", ARRAY_LEN(topts), topts,
-            on_option, NULL, 0);
+        const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
 
-    return *opts != NULL;
+    return rc;
 }
 
 static tool_rc check_options(void) {
@@ -70,52 +159,95 @@
     return tool_rc_success;
 }
 
-static tool_rc process_outputs(void) {
+static bool on_option(char key, char *value) {
 
-    bool result = files_save_ecc_point(ctx.Q, ctx.ecdh_pub_path);
-    if (!result) {
-        LOG_ERR("Failed to write out the public");
-        return tool_rc_general_error;
-    }
+    switch (key) {
 
-    result = files_save_ecc_point(ctx.Z, ctx.ecdh_Z_path);
-    if (!result) {
-        LOG_ERR("Failed to write out the public");
-        return tool_rc_general_error;
-    }
+        case 'c':
+            ctx.ecc_public_key.ctx_path = value;
+            break;
+        case 'u':
+            ctx.ecdh_pub_path = value;
+            break;
+        case 'o':
+            ctx.ecdh_Z_path = value;
+            break;
+        case 0:
+            ctx.cp_hash_path = value;
+        break;
+    };
 
-    return tool_rc_success;
+    return true;
+}
+
+static bool tpm2_tool_onstart(tpm2_options **opts) {
+
+    static struct option topts = {
+      { "context", required_argument, 0, 'c' },
+      { "public",  required_argument, 0, 'u' },
+      { "output",  required_argument, 0, 'o' },
+      { "cphash",  required_argument, 0,  0  },
+    };
+
+    *opts = tpm2_options_new("c:u:o:", ARRAY_LEN(topts), topts,
+            on_option, 0, 0);
+
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    // Check input options and arguments
+    /*
+     * 1. Process options
+     */
     tool_rc rc = check_options();
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    // Process inputs
-    rc = tpm2_util_object_load(ectx, ctx.ecc_public_key.ctx_path,
-        &ctx.ecc_public_key.object,
-        TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    // ESAPI call
-    rc = tpm2_ecdhkeygen(ectx, &ctx.ecc_public_key.object, &ctx.Z, &ctx.Q);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = ecdhkeygen(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    // Process outputs
-    rc = process_outputs();
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
+}
 
-    return rc;
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return tool_rc_success;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("ecdhkeygen", tpm2_tool_onstart, tpm2_tool_onrun, NULL, NULL)
+TPM2_TOOL_REGISTER("ecdhkeygen", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_ecdhzgen.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_ecdhzgen.c Changed

@@ -7,70 +7,80 @@
 #include "tpm2_auth_util.h"
 #include "tpm2_options.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_ecdhzgen_ctx tpm_ecdhzgen_ctx;
 struct tpm_ecdhzgen_ctx {
-
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
         tpm2_loaded_object object;
     } ecc_key;
 
+    TPM2B_ECC_POINT Q;
     const char *ecdh_pub_path;
-    const char *ecdh_Z_path;
 
+    /*
+     * Outputs
+     */
+    const char *ecdh_Z_path;
     TPM2B_ECC_POINT *Z;
-    TPM2B_ECC_POINT Q;
-};
+    
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 
-static tpm_ecdhzgen_ctx ctx;
+};
 
-static bool on_option(char key, char *value) {
+static tpm_ecdhzgen_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR
+};
 
-    switch (key) {
+static tool_rc ecdhzgen(ESYS_CONTEXT *ectx) {
 
-        case 'c':
-            ctx.ecc_key.ctx_path = value;
-            break;
-        case 'p':
-            ctx.ecc_key.auth_str = value;
-            break;
-        case 'u':
-            ctx.ecdh_pub_path = value;
-            break;
-        case 'o':
-            ctx.ecdh_Z_path = value;
-            break;
-    };
+    tool_rc rc = tpm2_ecdhzgen(ectx, &ctx.ecc_key.object, &ctx.Z,
+        &ctx.Q, &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed TPM2_CC_ECDH_ZGen");
+    }
 
-    return true;
+    return rc;
 }
 
-static bool tpm2_tool_onstart(tpm2_options **opts) {
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
 
-    static struct option topts = {
-      { "key-context", required_argument, NULL, 'c' },
-      { "key-auth",    required_argument, NULL, 'p' },
-      { "public",      required_argument, NULL, 'u' },
-      { "output",      required_argument, NULL, 'o' },
-    };
+    UNUSED(ectx);
 
-    *opts = tpm2_options_new("c:p:u:o:", ARRAY_LEN(topts), topts,
-            on_option, NULL, 0);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-    return *opts != NULL;
-}
-
-static tool_rc check_options(void) {
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
 
-    if (!ctx.ecc_key.ctx_path) {
-        LOG_ERR("Specify an ecc public key handle for context");
-        return tool_rc_option_error;
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
     }
 
-    if (!ctx.ecdh_Z_path) {
-        LOG_ERR("Specify path to save the ecdh secret or Z point");
-        return tool_rc_option_error;
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    is_file_op_success = files_save_ecc_point(ctx.Z, ctx.ecdh_Z_path);
+    if (!is_file_op_success) {
+        LOG_ERR("Failed to write out the public");
+        return tool_rc_general_error;
     }
 
     return tool_rc_success;
@@ -78,6 +88,18 @@
 
 static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
     tool_rc  rc = tpm2_util_object_load_auth(ectx, ctx.ecc_key.ctx_path,
         ctx.ecc_key.auth_str, &ctx.ecc_key.object, false,
         TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
@@ -85,48 +107,153 @@
         LOG_ERR("Failed to load object/ auth");
         return rc;
     }
+    /*
+     * 2. Restore auxiliary sessions
+     */
 
-    bool result = true;
-    result = files_load_ecc_point(ctx.ecdh_pub_path, &ctx.Q);
-    if (!result) {
+    /*
+     * 3. Command specific initializations
+     */
+    bool is_file_op_success = true;
+    is_file_op_success = files_load_ecc_point(ctx.ecdh_pub_path, &ctx.Q);
+    if (!is_file_op_success) {
         LOG_ERR("Failed to load public input ECC point Q");
         return tool_rc_general_error;
     }
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        0,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(void) {
+
+    if (!ctx.ecc_key.ctx_path) {
+        LOG_ERR("Specify an ecc public key handle for context");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.ecdh_Z_path) {
+        LOG_ERR("Specify path to save the ecdh secret or Z point");
+        return tool_rc_option_error;
+    }
 
     return tool_rc_success;
 }
 
+static bool on_option(char key, char *value) {
+
+    switch (key) {
+
+        case 'c':
+            ctx.ecc_key.ctx_path = value;
+            break;
+        case 'p':
+            ctx.ecc_key.auth_str = value;
+            break;
+        case 'u':
+            ctx.ecdh_pub_path = value;
+            break;
+        case 'o':
+            ctx.ecdh_Z_path = value;
+            break;
+        case 0:
+            ctx.cp_hash_path = value;
+        break;
+    };
+
+    return true;
+}
+
+static bool tpm2_tool_onstart(tpm2_options **opts) {
+
+    static struct option topts = {
+      { "key-context", required_argument, 0, 'c' },
+      { "key-auth",    required_argument, 0, 'p' },
+      { "public",      required_argument, 0, 'u' },
+      { "output",      required_argument, 0, 'o' },
+      { "cphash",      required_argument, 0,  0  },
+
+    };
+
+    *opts = tpm2_options_new("c:p:u:o:", ARRAY_LEN(topts), topts,
+            on_option, 0, 0);
+
+    return *opts != 0;
+}
+
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    // Check input options and arguments
+    /*
+     * 1. Process options
+     */
     tool_rc rc = check_options();
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    // Process inputs
-   rc = process_inputs(ectx);
-   if (rc != tool_rc_success) {
-       return rc;
-   }
-
-    // ESAPI call
-    rc = tpm2_ecdhzgen(ectx, &ctx.ecc_key.object, &ctx.Z, &ctx.Q);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    // Process outputs
-    bool result = files_save_ecc_point(ctx.Z, ctx.ecdh_Z_path);
-    if (!result) {
-        LOG_ERR("Failed to write out the public");
-        return tool_rc_general_error;
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = ecdhzgen(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
+}
+
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
     return tool_rc_success;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("ecdhzgen", tpm2_tool_onstart, tpm2_tool_onrun, NULL, NULL)
+TPM2_TOOL_REGISTER("ecdhzgen", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_ecephemeral.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_ecephemeral.c Changed

@@ -7,19 +7,157 @@
 #include "tpm2_alg_util.h"
 #include "tpm2_options.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_ecephemeral_ctx tpm_ecephemeral_ctx;
 struct tpm_ecephemeral_ctx {
+    /*
+     * Inputs
+     */
     TPMI_ECC_CURVE curve_id;
+
+    /*
+     * Outputs
+     */
     uint16_t counter;
     TPM2B_ECC_POINT *Q;
     char *commit_counter_path;
     char *ephemeral_pub_key_path;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
 };
 
 static tpm_ecephemeral_ctx ctx = {
     .curve_id = TPM2_ECC_NONE,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
+static tool_rc ecephemeral(ESYS_CONTEXT *ectx) {
+
+    tool_rc rc = tpm2_ecephemeral(ectx, ctx.curve_id, &ctx.Q, &ctx.counter,
+        &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed TPM2_CC_EC_Ephemeral");
+    }
+
+    return rc;
+}
+
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    FILE *fp = fopen(ctx.commit_counter_path, "wb");
+    is_file_op_success = files_write_16(fp, ctx.counter);
+    fclose(fp);
+    if (!is_file_op_success) {
+        LOG_ERR("Failed to write out the ECC commit count");
+        return tool_rc_general_error;
+    }
+
+    is_file_op_success = files_save_ecc_point(ctx.Q, ctx.ephemeral_pub_key_path);
+    if (!is_file_op_success) {
+        LOG_ERR("Failed to write out the ECC pub key");
+        return tool_rc_general_error;
+    }
+
+    return tool_rc_success;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        0,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
+
+    if (!ctx.ephemeral_pub_key_path) {
+        LOG_ERR("Invalid path specified for saving the ephemeral public key");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.commit_counter_path) {
+        LOG_ERR("Invalid path specified for saving the commit counter");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.curve_id == TPM2_ECC_NONE) {
+        LOG_ERR("Invalid/ unspecified ECC curve");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
+
 static bool on_option(char key, char *value) {
 
     switch (key) {
@@ -29,6 +167,9 @@
     case 't':
         ctx.commit_counter_path = value;
         break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
     };
 
     return true;
@@ -51,10 +192,6 @@
         result = false;
     }
 
-    if (algorithm.publicArea.parameters.eccDetail.curveID > TPM2_ECC_NIST_P521) {
-        result = false;
-    }
-
     if (!result) {
         LOG_ERR("Invalid/unsupported ECC curve: %s", argv0);
         return false;
@@ -68,77 +205,71 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static struct option topts = {
-      { "public",   required_argument, NULL, 'u' },
-      { "counter",  required_argument, NULL, 't' },
+      { "public",   required_argument, 0, 'u' },
+      { "counter",  required_argument, 0, 't' },
+      { "cphash",   required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("u:t:", ARRAY_LEN(topts), topts,
             on_option, on_args, 0);
 
-    return *opts != NULL;
-}
-
-static tool_rc check_options(void) {
-
-    if (!ctx.ephemeral_pub_key_path) {
-        LOG_ERR("Invalid path specified for saving the ephemeral public key");
-        return tool_rc_option_error;
-    }
-
-    if (!ctx.commit_counter_path) {
-        LOG_ERR("Invalid path specified for saving the commit counter");
-        return tool_rc_option_error;
-    }
-
-    if (ctx.curve_id == TPM2_ECC_NONE) {
-        LOG_ERR("Invalid/ unspecified ECC curve");
-        return tool_rc_option_error;
-    }
-
-    return tool_rc_success;
-}
-
-static tool_rc process_outputs(void) {
-
-    FILE *fp = fopen(ctx.commit_counter_path, "wb");
-    bool result = files_write_16(fp, ctx.counter);
-    fclose(fp);
-    if (!result) {
-        LOG_ERR("Failed to write out the ECC commit count");
-        return tool_rc_general_error;
-    }
-
-    result = files_save_ecc_point(ctx.Q, ctx.ephemeral_pub_key_path);
-    if (!result) {
-        LOG_ERR("Failed to write out the ECC pub key");
-        return tool_rc_general_error;
-    }
-
-    return tool_rc_success;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    // Check input options and arguments
+    /*
+     * 1. Process options
+     */
     tool_rc rc = check_options();
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    // ESAPI call
-    rc = tpm2_ecephemeral(ectx, ctx.curve_id, &ctx.Q, &ctx.counter);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    // Process outputs
-    rc = process_outputs();
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = ecephemeral(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
+}
+
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
     Esys_Free(ctx.Q);
 
-    return rc;
+    /*
+     * 2. Close authorization sessions
+     */
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return tool_rc_success;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("ecephemeral", tpm2_tool_onstart, tpm2_tool_onrun, NULL, NULL)
+TPM2_TOOL_REGISTER("ecephemeral", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_encryptdecrypt.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_encryptdecrypt.c Changed

@@ -16,9 +16,12 @@
 #include "tpm2_options.h"
 
 #define MAX_INPUT_DATA_SIZE UINT16_MAX
-
+#define MAX_SESSIONS 3
 typedef struct tpm_encrypt_decrypt_ctx tpm_encrypt_decrypt_ctx;
 struct tpm_encrypt_decrypt_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -31,19 +34,30 @@
     uint16_t input_data_size;
 
     const char *input_path;
-    char *out_file_path;
 
     uint8_t padded_block_len;
     bool is_padding_option_enabled;
 
     TPMI_ALG_SYM_MODE mode;
     struct {
-        char *in;
-        char *out;
+        char *in_path;
+        char *out_path;
     } iv;
 
-    TPM2B_IV iv_start;
-    char *cp_hash_path;
+    TPM2B_IV *iv_in;
+
+    /*
+     * Outputs
+     */
+    char *out_file_path;
+    FILE *out_file_ptr;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_encrypt_decrypt_ctx ctx = {
@@ -51,42 +65,55 @@
     .input_data_size = MAX_INPUT_DATA_SIZE,
     .padded_block_len = TPM2_MAX_SYM_BLOCK_SIZE,
     .is_padding_option_enabled = false,
-    .iv_start = { .size = sizeof(ctx.iv_start.buffer), .buffer = { 0 } },
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tool_rc readpub(ESYS_CONTEXT *ectx, TPM2B_PUBLIC **public) {
-
-    return tpm2_readpublic(ectx, ctx.encryption_key.object.tr_handle,
-            public, NULL, NULL);
-}
-
 static bool evaluate_pkcs7_padding_requirements(uint16_t remaining_bytes,
-bool expected) {
+    bool expected) {
 
     if (!ctx.is_padding_option_enabled) {
         return false;
     }
 
+    /*
+     * If it is a decrypt operation, we don't expect to apply/append padding to
+     * encrypted ciphertext prior to decrypting with tpm2_encryptdecrypt.
+     *
+     * If it is an encrypt operation, we do expect to apply/append padding to
+     * plaintext prior to encrypting with tpm2_encryptdecrypt.
+     *
+     * If it is a decrypt operation, we do expect to strip padding from
+     * decrypted text after decrypting with tpm2_encryptdecrypt.
+     *
+     * If it is an encrypt operation, we don't expect to perfom pad-stripping of
+     * encrypted ciphertext after encrypting with tpm2_encryptdecrypt.
+     */
     if (ctx.is_decrypt != expected) {
         return false;
     }
 
     /*
-     * If no ctx.mode was specified, the default cfb was set.
+     * If ctx.mode was not specified, cfb was chosen as default.
+     *
+     * For other modes of encryption, such as CTR or OFB or CFB,
+     * padding is not required because In these cases the ciphertext is
+     * always the same length as the plaintext, and a padding
+     * method is not applicable.
      */
     if (ctx.mode != TPM2_ALG_CBC && ctx.mode != TPM2_ALG_ECB) {
         return false;
     }
 
     /*
-     * Is last block?
+     * Only apply/ strip padding to the last block.
      */
-    if (!(remaining_bytes <= TPM2_MAX_DIGEST_BUFFER && remaining_bytes > 0)) {
+    bool is_last_block = (remaining_bytes <= TPM2_MAX_DIGEST_BUFFER &&
+        remaining_bytes > 0);
+    if (!is_last_block) {
         return false;
     }
 
     LOG_WARN("Processing pkcs7 padding.");
-
     return true;
 }
 
@@ -94,7 +121,7 @@
         uint16_t *in_data_size, uint16_t *remaining_bytes) {
 
     bool test_pad_reqs = evaluate_pkcs7_padding_requirements(*remaining_bytes,
-    false);
+        false);
     if (!test_pad_reqs) {
         return;
     }
@@ -116,7 +143,7 @@
         TPM2B_MAX_BUFFER *out_data, uint16_t *remaining_bytes) {
 
     bool test_pad_reqs = evaluate_pkcs7_padding_requirements(*remaining_bytes,
-    true);
+        true);
     if (!test_pad_reqs) {
         return;
     }
@@ -135,142 +162,110 @@
 
 static tool_rc encrypt_decrypt(ESYS_CONTEXT *ectx) {
 
-    tool_rc rc = tool_rc_general_error;
-
-    /*
-     * try EncryptDecrypt2 first, and if the command is not supported by the TPM
-     * fall back to EncryptDecrypt.
-     */
-
-    UINT16 data_offset = 0;
-    bool result = true;
-    FILE *out_file_ptr =
-            ctx.out_file_path ? fopen(ctx.out_file_path, "wb+") : stdout;
-    if (!out_file_ptr) {
-        LOG_ERR("Could not open file \"%s\", error: %s", ctx.out_file_path,
-                strerror(errno));
-        return tool_rc_general_error;
-    }
-
-    TPM2B_MAX_BUFFER *out_data = NULL;
-    TPM2B_MAX_BUFFER in_data;
-    TPM2B_IV *iv_out = NULL;
-    TPM2B_IV *iv_in = &ctx.iv_start;
+    tool_rc rc = tool_rc_success;
     uint8_t pad_data = 0;
-
+    UINT16 data_offset = 0;
     uint16_t remaining_bytes = ctx.input_data_size;
-    if (ctx.mode == TPM2_ALG_ECB) {
-        iv_in = NULL;
-    }
-
-    if (ctx.cp_hash_path) {
-        in_data.size = remaining_bytes;
-        append_pkcs7_padding_data_to_input(&pad_data, &in_data.size,
-                    &remaining_bytes);
-        memcpy(in_data.buffer, ctx.input_data, in_data.size);
-        LOG_WARN("Calculating cpHash. Exiting without performing encryptdecrypt.");
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_encryptdecrypt(ectx, &ctx.encryption_key.object,
-        ctx.is_decrypt, ctx.mode, iv_in, &in_data, &out_data, &iv_out,
-        &cp_hash);
-        if (rc != tool_rc_success) {
-            LOG_ERR("CpHash calculation failed!");
-            fclose(out_file_ptr);
-            return rc;
-        }
-
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
-        return rc;
-    }
-
     while (remaining_bytes > 0) {
-        in_data.size =
-                remaining_bytes > TPM2_MAX_DIGEST_BUFFER ?
-                        TPM2_MAX_DIGEST_BUFFER : remaining_bytes;
+        TPM2B_MAX_BUFFER in_data = {
+            .size = (remaining_bytes > TPM2_MAX_DIGEST_BUFFER) ?
+                    TPM2_MAX_DIGEST_BUFFER : remaining_bytes,
+        };
 
-        if (!pad_data) {
+        if (pad_data == 0) {
             append_pkcs7_padding_data_to_input(&pad_data, &in_data.size,
-                    &remaining_bytes);
+                &remaining_bytes);
         }
 
         memcpy(in_data.buffer, &ctx.input_datadata_offset, in_data.size);
 
+        TPM2B_MAX_BUFFER *out_data = 0;
+        TPM2B_IV *iv_out = 0;
         rc = tpm2_encryptdecrypt(ectx, &ctx.encryption_key.object,
-                ctx.is_decrypt, ctx.mode, iv_in, &in_data, &out_data, &iv_out,
-                NULL);
+            ctx.is_decrypt, ctx.mode, ctx.iv_in, &in_data, &out_data, &iv_out,
+            &ctx.cp_hash, ctx.parameter_hash_algorithm);
         if (rc != tool_rc_success) {
             goto out;
         }
+        data_offset += in_data.size;
 
-        /*
-         * Copy iv_out iv_in to use it in next loop iteration.
-         * This copy is also output from the tool for further chaining.
-         */
-        if (ctx.mode != TPM2_ALG_ECB) {
-            assert(iv_in);
-            assert(iv_out);
-            *iv_in = *iv_out;
-            free(iv_out);
-        }
-
-        strip_pkcs7_padding_data_from_output(&pad_data, out_data,
-                &remaining_bytes);
+        if (ctx.is_command_dispatch) {
+            /*
+             * Copy iv_out iv_in to use it in next loop iteration.
+             * This copy is also output from the tool for further chaining.
+             */
+            if (ctx.mode != TPM2_ALG_ECB) {
+                assert(ctx.iv_in);
+                assert(iv_out);
+                *ctx.iv_in = *iv_out;
+                free(iv_out);
+            }
+
+            strip_pkcs7_padding_data_from_output(&pad_data, out_data,
+                    &remaining_bytes);
 
-        result = files_write_bytes(out_file_ptr, out_data->buffer,
-                out_data->size);
-        free(out_data);
-        if (!result) {
-            LOG_ERR("Failed to save output data to file");
-            goto out;
+            bool result = files_write_bytes(ctx.out_file_ptr, out_data->buffer,
+                    out_data->size);
+            free(out_data);
+            if (!result) {
+                LOG_ERR("Failed to save output data to file");
+                goto out;
+            }
         }
 
         remaining_bytes -= in_data.size;
-        data_offset += in_data.size;
-    }
-
-    /*
-     * iv_in here is the copy of final iv_out from the loop above.
-     */
-    result =
-            (ctx.iv.out && iv_in) ?
-                    files_save_bytes_to_file(ctx.iv.out, iv_in->buffer,
-                            iv_in->size) :
-                    true;
-    if (!result) {
-        goto out;
     }
 
-    rc = tool_rc_success;
-
 out:
-    if (out_file_ptr != stdout) {
-        fclose(out_file_ptr);
+    if (ctx.out_file_ptr != stdout) {
+        fclose(ctx.out_file_ptr);
     }
 
     return rc;
 }
 
-static void parse_iv(char *value) {
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
-    ctx.iv.in = value;
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-    char *split = strchr(value, ':');
-    if (split) {
-        *split = '\0';
-        split++;
-        if (split) {
-            ctx.iv.out = split;
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
         }
     }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    /*
+     * iv_in here is the copy of final iv_out from the loop above.
+     */
+    if (ctx.iv.out_path && ctx.iv_in) {
+        is_file_op_success = files_save_bytes_to_file(ctx.iv.out_path,
+            ctx.iv_in->buffer, ctx.iv_in->size);
+    }
+    if (!is_file_op_success) {
+        rc = tool_rc_general_error;
+    }
+
+    return rc;
 }
 
 static bool setup_alg_mode(ESYS_CONTEXT *ectx) {
 
     TPM2B_PUBLIC *public;
-    tool_rc rc = readpub(ectx, &public);
+    tool_rc rc = tpm2_readpublic(ectx, ctx.encryption_key.object.tr_handle,
+        &public, 0, 0);
     if (rc != tool_rc_success) {
         return false;
     }
@@ -296,6 +291,163 @@
     return true;
 }
 
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.encryption_key.ctx_path,
+            ctx.encryption_key.auth_str, &ctx.encryption_key.object, false,
+            TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid object key authorization");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    bool result = files_load_bytes_from_buffer_or_file_or_stdin(0,
+            ctx.input_path, &ctx.input_data_size, ctx.input_data);
+    if (!result) {
+        LOG_ERR("Failed to read in the input.");
+        return tool_rc_general_error;
+    }
+
+    if (ctx.cp_hash_path && ctx.input_data_size > TPM2_MAX_DIGEST_BUFFER) {
+        LOG_ERR("Cannot calculate cpHash for buffer larger than max digest "
+                "buffer.");
+        return tool_rc_general_error;
+    }
+
+    TPM2B_IV iv_start = {
+        .size = sizeof(iv_start.buffer), .buffer = { 0 },
+    };
+
+    if (ctx.iv.in_path) {
+        unsigned long file_size;
+        result = files_get_file_size_path(ctx.iv.in_path, &file_size);
+        if (!result) {
+            LOG_ERR("Could not retrieve iv file size.");
+            return tool_rc_general_error;
+        }
+
+        if (file_size != iv_start.size) {
+            LOG_ERR("Iv should be 16 bytes, got %lu", file_size);
+            return tool_rc_general_error;
+        }
+
+        result = files_load_bytes_from_path(ctx.iv.in_path, iv_start.buffer,
+            &iv_start.size);
+        if (!result) {
+            LOG_ERR("Could not load the iv from the file.");
+            return tool_rc_general_error;
+        }
+    }
+
+    if (ctx.mode == TPM2_ALG_ECB) {
+        ctx.iv_in = 0;
+    } else {
+        ctx.iv_in = malloc(iv_start.size + sizeof(iv_start));
+        ctx.iv_in->size = iv_start.size;
+        memcpy(ctx.iv_in->buffer, &iv_start.buffer, iv_start.size);
+    }
+
+    result = setup_alg_mode(ectx);
+    if (!result) {
+        LOG_ERR("Failure to setup key mode.");
+        return tool_rc_general_error;
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.encryption_key.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    if (!ctx.encryption_key.ctx_path) {
+        LOG_ERR("Expected a context file or handle, got none.");
+        return tool_rc_option_error;
+    }
+
+    ctx.out_file_ptr = ctx.out_file_path ?
+        fopen(ctx.out_file_path, "wb+") : stdout;
+    if (!ctx.out_file_ptr) {
+        LOG_ERR("Could not open file \"%s\", error: %s", ctx.out_file_path,
+                strerror(errno));
+        return tool_rc_general_error;
+    }
+
+    if (!ctx.iv.in_path) {
+        LOG_WARN("Using a weak IV, try specifying an IV");
+    }
+
+    return tool_rc_success;
+}
+
+static bool on_args(int argc, char *argv) {
+
+    if (argc != 1) {
+        LOG_ERR("Expected one input file, got: %d", argc);
+        return false;
+    }
+
+    ctx.input_path = argv0;
+
+    return true;
+}
+
+static void parse_iv(char *value) {
+
+    ctx.iv.in_path = value;
+
+    char *split = strchr(value, ':');
+    if (split) {
+        *split = '\0';
+        split++;
+        if (split) {
+            ctx.iv.out_path = split;
+        }
+    }
+}
+
 static bool on_option(char key, char *value) {
 
     switch (key) {
@@ -332,115 +484,80 @@
     return true;
 }
 
-static bool on_args(int argc, char *argv) {
-
-    if (argc != 1) {
-        LOG_ERR("Expected one input file, got: %d", argc);
-        return false;
-    }
-
-    ctx.input_path = argv0;
-
-    return true;
-}
-
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
-        { "auth",        required_argument, NULL, 'p' },
-        { "decrypt",     no_argument,       NULL, 'd' },
-        { "iv",          required_argument, NULL, 't' },
-        { "mode",        required_argument, NULL, 'G' },
-        { "output",      required_argument, NULL, 'o' },
-        { "key-context", required_argument, NULL, 'c' },
-        { "pad",         no_argument,       NULL, 'e' },
-        { "cphash",      required_argument, NULL,  0  },
+        { "auth",        required_argument, 0, 'p' },
+        { "decrypt",     no_argument,       0, 'd' },
+        { "iv",          required_argument, 0, 't' },
+        { "mode",        required_argument, 0, 'G' },
+        { "output",      required_argument, 0, 'o' },
+        { "key-context", required_argument, 0, 'c' },
+        { "pad",         no_argument,       0, 'e' },
+        { "cphash",      required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("p:edi:o:c:G:t:", ARRAY_LEN(topts), topts,
             on_option, on_args, 0);
 
-    return *opts != NULL;
-}
-
-static bool is_input_options_args_valid(void) {
-
-    if (!ctx.encryption_key.ctx_path) {
-        LOG_ERR("Expected a context file or handle, got none.");
-        return false;
-    }
-
-    bool result = files_load_bytes_from_buffer_or_file_or_stdin(NULL,
-            ctx.input_path, &ctx.input_data_size, ctx.input_data);
-    if (!result) {
-        LOG_ERR("Failed to read in the input.");
-        return result;
-    }
-
-    if (!ctx.iv.in) {
-        LOG_WARN("Using a weak IV, try specifying an IV");
-    }
-
-    if (ctx.iv.in) {
-        unsigned long file_size;
-        result = files_get_file_size_path(ctx.iv.in, &file_size);
-        if (!result) {
-            LOG_ERR("Could not retrieve iv file size.");
-            return false;
-        }
-
-        if (file_size != ctx.iv_start.size) {
-            LOG_ERR("Iv should be 16 bytes, got %lu", file_size);
-            return false;
-        }
-
-        result = files_load_bytes_from_path(ctx.iv.in, ctx.iv_start.buffer,
-        &ctx.iv_start.size);
-        if (!result) {
-            LOG_ERR("Could not load the iv from the file.");
-            return false;
-        }
-    }
-
-    if (ctx.cp_hash_path && ctx.input_data_size > TPM2_MAX_DIGEST_BUFFER) {
-        LOG_ERR("Cannot calculate cpHash for buffer larger than max digest buffer.");
-        return false;
-    }
-
-    return true;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    bool retval = is_input_options_args_valid();
-    if (!retval) {
-        return tool_rc_option_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.encryption_key.ctx_path,
-            ctx.encryption_key.auth_str, &ctx.encryption_key.object, false,
-            TPM2_HANDLE_ALL_W_NV);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid object key authorization");
         return rc;
     }
 
-    bool result = setup_alg_mode(ectx);
-    if (!result) {
-        LOG_ERR("Failure to setup key mode.");
-        return tool_rc_general_error;
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = encrypt_decrypt(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return encrypt_decrypt(ectx);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    return tpm2_session_close(&ctx.encryption_key.object.session);
+    /*
+     * 1. Free objects
+     */
+    free(ctx.iv_in);
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.encryption_key.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("encryptdecrypt", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("encryptdecrypt", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_evictcontrol.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_evictcontrol.c Changed

@@ -8,8 +8,12 @@
 #include "tpm2_capability.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_evictcontrol_ctx tpm_evictcontrol_ctx;
 struct tpm_evictcontrol_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -22,21 +26,200 @@
     } to_persist_key;
 
     TPMI_DH_PERSISTENT persist_handle;
+    bool is_persistent_handle_specified;
 
+    /*
+     * Outputs
+     */
     const char *output_arg;
+    ESYS_TR out_tr;
 
-    struct {
-        UINT8 p :1;
-        UINT8 c :1;
-        UINT8 o :1;
-    } flags;
-    char *cp_hash_path;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_evictcontrol_ctx ctx = {
     .auth_hierarchy.ctx_path="o",
+    .out_tr = ESYS_TR_NONE,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
+static tool_rc evictcontrol(ESYS_CONTEXT *ectx) {
+
+    /*
+     * ESAPI is smart enough that if the object is persistent, to ignore the
+     * argument for persistent handle. Thus we can use ESYS_TR output to
+     * determine if it's evicted or not.
+     */
+    return tpm2_evictcontrol(ectx, &ctx.auth_hierarchy.object,
+        &ctx.to_persist_key.object, ctx.persist_handle, &ctx.out_tr,
+        &ctx.cp_hash, ctx.parameter_hash_algorithm);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    /*
+     * Only Close a TR object if it's still resident in the TPM.
+     * When these handles match, evictcontrol flushed it from the TPM.
+     * It's evicted when ESAPI sends back a none handle on evictcontrol.
+     *
+     * XXX: This output is wrong because we can't determine what handle was
+     * evicted on ESYS_TR input.
+     *
+     * See bug: https://github.com/tpm2-software/tpm2-tools/issues/1816
+     */
+    tpm2_tool_output("persistent-handle: 0x%x\n", ctx.persist_handle);
+
+    bool is_evicted = (ctx.out_tr == ESYS_TR_NONE);
+    tpm2_tool_output("action: %s\n", is_evicted ? "evicted" : "persisted");
+
+    tool_rc tmp_rc = tool_rc_success;
+    if (ctx.output_arg) {
+        tmp_rc = files_save_ESYS_TR(ectx, ctx.out_tr, ctx.output_arg);
+    }
+
+    if (!is_evicted) {
+        rc = tpm2_close(ectx, &ctx.out_tr);
+    }
+
+    return (tmp_rc == tool_rc_success) ? rc : tmp_rc;
+}
+
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /* Object #2 */
+    rc = tpm2_util_object_load(ectx, ctx.to_persist_key.ctx_path,
+        &ctx.to_persist_key.object, TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    if (ctx.to_persist_key.object.handle >> TPM2_HR_SHIFT
+            == TPM2_HT_PERSISTENT) {
+        ctx.persist_handle = ctx.to_persist_key.object.handle;
+        ctx.is_persistent_handle_specified = true;
+    }
+
+    /* If we've been given a handle or context object to persist and not an
+     * explicit persistent handle to use, find an available vacant handle in
+     * the persistent namespace and use that.
+     *
+     * XXX: We need away to figure out of object is persistent and skip it.
+     */
+    if (ctx.to_persist_key.ctx_path && !ctx.is_persistent_handle_specified) {
+        bool is_platform = ctx.auth_hierarchy.object.handle == TPM2_RH_PLATFORM;
+        rc = tpm2_capability_find_vacant_persistent_handle(ectx,
+                is_platform, &ctx.persist_handle);
+        if (rc != tool_rc_success) {
+            return rc;
+        }
+        /* we searched and found a persistent handle, so mark that peristent handle valid */
+        ctx.is_persistent_handle_specified = true;
+    }
+
+    if (ctx.output_arg && !ctx.is_persistent_handle_specified) {
+        LOG_ERR("Cannot specify -o without using a persistent handle");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    if (!ctx.to_persist_key.ctx_path) {
+        LOG_ERR("Must specify the key object to be evicted.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.auth_hierarchy.ctx_path) {
+        LOG_ERR("Must specify the auth hierarchy");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
+
 static bool on_option(char key, char *value) {
 
     switch (key) {
@@ -48,11 +231,9 @@
         break;
     case 'c':
         ctx.to_persist_key.ctx_path = value;
-        ctx.flags.c = 1;
         break;
     case 'o':
         ctx.output_arg = value;
-        ctx.flags.o = 1;
         break;
     case 0:
         ctx.cp_hash_path = value;
@@ -74,10 +255,10 @@
     bool result = tpm2_util_string_to_uint32(value, &ctx.persist_handle);
     if (!result) {
         LOG_ERR("Could not convert persistent handle to a number, got: \"%s\"",
-                value);
+            value);
         return false;
     }
-    ctx.flags.p = 1;
+    ctx.is_persistent_handle_specified = true;
 
     return true;
 }
@@ -85,132 +266,73 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
-      { "hierarchy",      required_argument, NULL, 'C' },
-      { "auth",           required_argument, NULL, 'P' },
-      { "object-context", required_argument, NULL, 'c' },
-      { "output",         required_argument, NULL, 'o' },
-      { "cphash",         required_argument, NULL,  0  },
+      { "hierarchy",      required_argument, 0, 'C' },
+      { "auth",           required_argument, 0, 'P' },
+      { "object-context", required_argument, 0, 'c' },
+      { "output",         required_argument, 0, 'o' },
+      { "cphash",         required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("C:P:c:o:", ARRAY_LEN(topts), topts, on_option,
-            on_arg, 0);
+         on_arg, 0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    tool_rc rc = tool_rc_general_error;
-    bool evicted = false;
-
-    /* load up the object/handle to work on */
-    tool_rc tmp_rc = tpm2_util_object_load(ectx, ctx.to_persist_key.ctx_path,
-            &ctx.to_persist_key.object, TPM2_HANDLE_ALL_W_NV);
-    if (tmp_rc != tool_rc_success) {
-        rc = tmp_rc;
-        goto out;
-    }
-
-    /* load up the auth hierarchy */
-    tmp_rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
-    if (tmp_rc != tool_rc_success) {
-        rc = tmp_rc;
-        goto out;
-    }
-
-    if (ctx.to_persist_key.object.handle >> TPM2_HR_SHIFT
-            == TPM2_HT_PERSISTENT) {
-        ctx.persist_handle = ctx.to_persist_key.object.handle;
-        ctx.flags.p = 1;
-    }
-
-    /* If we've been given a handle or context object to persist and not an
-     * explicit persistent handle to use, find an available vacant handle in
-     * the persistent namespace and use that.
-     *
-     * XXX: We need away to figure out of object is persistent and skip it.
+    /*
+     * 1. Process options
      */
-    if (ctx.flags.c && !ctx.flags.p) {
-        bool is_platform = ctx.auth_hierarchy.object.handle == TPM2_RH_PLATFORM;
-        tmp_rc = tpm2_capability_find_vacant_persistent_handle(ectx,
-                is_platform, &ctx.persist_handle);
-        if (tmp_rc != tool_rc_success) {
-            rc = tmp_rc;
-            goto out;
-        }
-        /* we searched and found a persistent handle, so mark that peristent handle valid */
-        ctx.flags.p = 1;
-    }
-
-    if (ctx.flags.o && !ctx.flags.p) {
-        LOG_ERR("Cannot specify -o without using a persistent handle");
-        goto out;
-    }
-
-    ESYS_TR out_tr;
-    if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        LOG_WARN("Calculating cpHash. Exiting without evicting objects.");
-        tool_rc rc = tpm2_evictcontrol(ectx, &ctx.auth_hierarchy.object,
-        &ctx.to_persist_key.object, ctx.persist_handle, &out_tr, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
+    tool_rc rc = check_options(ectx);
+    if (rc != tool_rc_success) {
         return rc;
     }
 
     /*
-     * ESAPI is smart enough that if the object is persistent, to ignore the argument
-     * for persistent handle. Thus we can use ESYS_TR output to determine if it's
-     * evicted or not.
+     * 2. Process inputs
      */
-    rc = tpm2_evictcontrol(ectx, &ctx.auth_hierarchy.object,
-            &ctx.to_persist_key.object, ctx.persist_handle, &out_tr, NULL);
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
-        goto out;
+        return rc;
     }
 
     /*
-     * Only Close a TR object if it's still resident in the TPM.
-     * When these handles match, evictcontrol flushed it from the TPM.
-     * It's evicted when ESAPI sends back a none handle on evictcontrol.
-     *
-     * XXX: This output is wrong because we can't determine what handle was
-     * evicted on ESYS_TR input.
-     *
-     * See bug: https://github.com/tpm2-software/tpm2-tools/issues/1816
+     * 3. TPM2_CC_<command> call
      */
-    evicted = out_tr == ESYS_TR_NONE;
-    tpm2_tool_output("persistent-handle: 0x%x\n", ctx.persist_handle);
-    tpm2_tool_output("action: %s\n", evicted ? "evicted" : "persisted");
-
-    if (ctx.output_arg) {
-        rc = files_save_ESYS_TR(ectx, out_tr, ctx.output_arg);
-    } else {
-        rc = tool_rc_success;
-    }
-
-out:
-    if (!evicted) {
-        rc = tpm2_close(ectx, &out_tr);
+    rc = evictcontrol(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("evictcontrol", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("evictcontrol", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_flushcontext.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_flushcontext.c Changed

@@ -2,20 +2,51 @@
 
 #include <stdlib.h>
 
+#include "files.h"
 #include "log.h"
 #include "object.h"
 #include "tpm2.h"
 #include "tpm2_tool.h"
 #include "tpm2_capability.h"
 #include "tpm2_options.h"
+#include "tpm2_session.h"
 
+#define MAX_SESSIONS 3
+#define TOTAL_CTX_TYPES 3 // contexts are transient/ loaded/ saved.
+#define MAX_CTX_COUNT 255
 struct tpm_flush_context_ctx {
-    TPM2_HANDLE property;
+    /*
+     * Inputs
+     */
+    unsigned encountered_option_flags;
+    TPM2_HANDLE propertyTOTAL_CTX_TYPES;
+    ESYS_TR context_handlesMAX_CTX_COUNT; //ESYS_TR
+    uint8_t context_handle_count;
+    bool is_t_l_s_specified; //t l s option combination
+
+    bool is_arg_session;
+    bool is_arg_transient;
     char *context_arg;
-    unsigned encountered_option;
+    tpm2_session *arg_session;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
 };
 
-static struct tpm_flush_context_ctx ctx;
+static struct tpm_flush_context_ctx ctx = {
+    .context_handles = {ESYS_TR_NONE},
+    .parameter_hash_algorithm = TPM2_ALG_ERROR
+};
 
 static const char *get_property_name(TPM2_HANDLE handle) {
 
@@ -31,144 +62,319 @@
     return "invalid";
 }
 
-static tool_rc flush_contexts_tpm2(ESYS_CONTEXT *ectx, TPM2_HANDLE handles,
-        UINT32 count) {
+static tool_rc flushcontext(ESYS_CONTEXT *ectx) {
+
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tool_rc_success;
+    uint32_t i;
+    for (i = 0; i < ctx.context_handle_count; ++i) {
+        /*
+         * Continue flushing the handles after error AND
+         * Capture the error as final return data.
+         */
+        tmp_rc = tpm2_flush_context(ectx, ctx.context_handlesi, &ctx.cp_hash,
+            ctx.parameter_hash_algorithm);
+        if (tmp_rc != tool_rc_success) {
+            LOG_ERR("Failed Flush Context for %s handle 0x%x",
+                get_property_name(ctx.context_handlesi),
+                ctx.context_handlesi);
+            rc = tmp_rc;
+        }
+    }
+
+    return rc;
+}
+
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-    UINT32 i;
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
 
-    for (i = 0; i < count; ++i) {
+    return tool_rc_success;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tool_rc_success;
+    TPM2_HANDLE sapi_handle = 0;
+    if (!ctx.is_t_l_s_specified) {
+        ctx.is_arg_transient = tpm2_util_string_to_uint32(ctx.context_arg,
+            &sapi_handle);
+    }
 
-        ESYS_TR handle;
-        tool_rc rc = tpm2_util_sys_handle_to_esys_handle(ectx, handlesi,
-                &handle);
+    if (ctx.is_arg_transient) {
+        rc = tpm2_util_sys_handle_to_esys_handle(ectx, sapi_handle,
+            ctx.context_handles);
         if (rc != tool_rc_success) {
+            LOG_ERR("Handle not found.");
             return rc;
         }
 
-        rc = tpm2_flush_context(ectx, handle);
+        ctx.context_handle_count++;
+    }
+    
+    if (!ctx.is_t_l_s_specified && !ctx.is_arg_transient) {
+        rc = tpm2_session_restore(ectx, ctx.context_arg, true,
+            &ctx.arg_session);
+        if (rc == tool_rc_success) {
+            ctx.is_arg_session = true;
+            ctx.context_handles0 = tpm2_session_get_handle(ctx.arg_session);
+            ctx.context_handle_count++;
+        }
+    }
+
+    if (!ctx.is_t_l_s_specified && !ctx.is_arg_transient &&
+    !ctx.is_arg_session) {
+        LOG_ERR("Argument neither a session nor a transient.");
+        return tool_rc_general_error;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * Populate ctx.context_handles with transient, loaded and saved handles
+     * Note: encountered_option is nil when context is specified as argument.
+     */
+    TPM2_HANDLE property3 = { 0 };
+    unsigned offset = 0;
+    if (ctx.encountered_option_flags & 1 << 0) {
+        propertyoffset++ = TPM2_TRANSIENT_FIRST;
+    }
+    if (ctx.encountered_option_flags & 1 << 1) {
+        propertyoffset++ = TPM2_LOADED_SESSION_FIRST;
+    }
+    if (ctx.encountered_option_flags & 1 << 2) {
+        propertyoffset++ = TPM2_ACTIVE_SESSION_FIRST;
+    }
+
+    unsigned i = 0; // Iterates through t,l,s types
+    for (i = 0; i < offset; i++) {
+        TPM2_HANDLE p = propertyi;
+        TPMS_CAPABILITY_DATA *capability_data;
+        rc = tpm2_capability_get(ectx, TPM2_CAP_HANDLES, p,
+            TPM2_MAX_CAP_HANDLES, &capability_data);
         if (rc != tool_rc_success) {
-            LOG_ERR("Failed Flush Context for %s handle 0x%x",
-                    get_property_name(handlesi), handlesi);
-            return rc;
+            LOG_ERR("Error reading handle info from TPM.");
+            return tool_rc_general_error;
+        }
+    
+        unsigned j = 0; //Iterates through all available handles in t/l/s
+        for (j = 0; j < capability_data->data.handles.count; j++) {
+            rc = tpm2_util_sys_handle_to_esys_handle(ectx,
+                capability_data->data.handles.handlej,
+                &ctx.context_handlesj);
+            if (rc != tool_rc_success) {
+                LOG_ERR("Error reading handle info from TPM.");
+                return tool_rc_general_error;
+            }
+            ctx.context_handle_count++;
         }
+
+        free(capability_data);
     }
 
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        0,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    /*
+     * Note: pHash cannot be calculated if multiple sessions are found needing
+     *       to be flushed. This is because pHash output needs to be written to
+     *       a single file which must contain a single pHash.
+     * 
+     *       This implies if ctx.context_handle_count > 1 and pHash must be
+     *       be calculated --> Error out.
+     */
+
     return tool_rc_success;
 }
 
-static bool flush_contexts_tr(ESYS_CONTEXT *ectx, ESYS_TR handles,
-        UINT32 count) {
+static tool_rc check_options(void) {
 
-    UINT32 i;
+    /*
+     * Either an argument specifying the context to flush
+     * OR
+     * Option to flush all must be specified
+     */
+    ctx.is_t_l_s_specified = ctx.encountered_option_flags;
+    if (!ctx.is_t_l_s_specified && !ctx.context_arg) {
+        LOG_ERR("Specify options to evict handles or a session context.");
+        return tool_rc_option_error;
+    }
 
-    for (i = 0; i < count; ++i) {
-        tool_rc rc = tpm2_flush_context(ectx, handlesi);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
+    /*
+     * Options are mutually exclusive of an argument
+     */
+    if (ctx.is_t_l_s_specified && ctx.context_arg) {
+        LOG_ERR("Specify either 't' 'l' 's' or a context. Cannot specify both");
+        return tool_rc_option_error;
     }
 
     return tool_rc_success;
 }
 
-static bool on_option(char key, char *value) {
-    UNUSED(value);
+static bool on_arg(int argc, char *argv) {
 
-    if (ctx.encountered_option) {
-        LOG_ERR("Options -t, -l and -s are mutually exclusive");
-        return false;
+    if (argc > 1) {
+        LOG_ERR("Specify one context.");
+        return tool_rc_option_error;
     }
 
-    ctx.encountered_option = true;
+    ctx.context_arg = argv0;
+
+    return true;
+}
+
+static bool on_option(char key, char *value) {
+
+    UNUSED(value);
 
     switch (key) {
     case 't':
-        ctx.property = TPM2_TRANSIENT_FIRST;
+        ctx.encountered_option_flags |= 1 << 0;
         break;
     case 'l':
-        ctx.property = TPM2_LOADED_SESSION_FIRST;
+        ctx.encountered_option_flags |= 1 << 1;
         break;
     case 's':
-        ctx.property = TPM2_ACTIVE_SESSION_FIRST;
+        ctx.encountered_option_flags |= 1 << 2;
+        break;
+    case 0:
+        ctx.cp_hash_path = value;
         break;
     }
 
     return true;
 }
 
-static bool on_arg(int argc, char *argv) {
-
-    if (ctx.encountered_option && argc != 0) {
-        LOG_ERR("Options are mutually exclusive of an argument");
-        return false;
-    }
-
-    ctx.context_arg = argv0;
-
-    return true;
-}
-
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static const struct option topts = {
-        { "transient-object", no_argument, NULL, 't' },
-        { "loaded-session",   no_argument, NULL, 'l' },
-        { "saved-session",    no_argument, NULL, 's' },
+        { "transient-object", no_argument, 0, 't' },
+        { "loaded-session",   no_argument, 0, 'l' },
+        { "saved-session",    no_argument, 0, 's' },
+        { "cphash",     required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("tls", ARRAY_LEN(topts), topts, on_option, on_arg,
             0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    if (ctx.property) {
-        TPMS_CAPABILITY_DATA *capability_data;
-        tool_rc rc = tpm2_capability_get(ectx, TPM2_CAP_HANDLES, ctx.property,
-                TPM2_MAX_CAP_HANDLES, &capability_data);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
+    }
 
-        TPML_HANDLE *handles = &capability_data->data.handles;
-        rc = flush_contexts_tpm2(ectx, handles->handle, handles->count);
-        free(capability_data);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
         return rc;
     }
 
-    if (!ctx.context_arg) {
-        LOG_ERR("Specify options to evict handles or a session context.");
-        return tool_rc_option_error;
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = flushcontext(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    TPM2_HANDLE handle;
-    bool result = tpm2_util_string_to_uint32(ctx.context_arg, &handle);
-    if (!result) {
-        /* hmm not a handle, try a session */
-        tpm2_session *s = NULL;
-        tool_rc rc = tpm2_session_restore(ectx, ctx.context_arg, true, &s);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
+}
 
-        tpm2_session_close(&s);
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
 
-        return tool_rc_success;
-    }
+    UNUSED(ectx);
 
-    /* its a handle, call flush */
-    ESYS_TR tr_handle = ESYS_TR_NONE;
-    tool_rc rc = tpm2_util_sys_handle_to_esys_handle(ectx, handle, &tr_handle);
-    if (rc != tool_rc_success) {
-        return rc;
+    /*
+     * 1. Free objects
+     */
+    if (ctx.is_arg_session) {
+        tpm2_session_free(&ctx.arg_session);
     }
 
-    return flush_contexts_tr(ectx, &tr_handle, 1);
+    /*
+     * 2. Close authorization sessions
+     */
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return tool_rc_success;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("flushcontext", tpm2_tool_onstart, tpm2_tool_onrun, NULL, NULL)
+TPM2_TOOL_REGISTER("flushcontext", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_getcap.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_getcap.c Changed

@@ -123,6 +123,14 @@
         .property          = TPM2_ACTIVE_SESSION_FIRST,
         .count             = TPM2_MAX_CAP_HANDLES,
     },
+#if defined(ESYS_4_0)
+    {
+        .capability_string = "vendor",
+        .capability        = TPM2_CAP_VENDOR_PROPERTY,
+        .property          = 1,
+        .count             = TPM2_MAX_CAP_BUFFER,
+    },
+#endif
 };
 /*
  * Structure to hold options for this tool.
@@ -133,6 +141,7 @@
     UINT32 property;
     UINT32 count;
     bool list;
+    bool ignore_moredata;
 } capability_opts_t;
 
 static capability_opts_t options;
@@ -154,12 +163,38 @@
     }
 
     size_t i;
+
     for (i = 0; i < CAPABILITY_MAP_COUNT; ++i) {
-        int cmp = strcmp(capability_mapi.capability_string,
-                options.capability_string);
+
+        int cmp = strncmp(capability_mapi.capability_string,
+                options.capability_string,
+                strlen(capability_mapi.capability_string));
         if (cmp == 0) {
+
+            UINT32 property = capability_mapi.property;
+
+            char *colon = strchr(options.capability_string, ':');
+            if (colon && capability_mapi.capability != TPM2_CAP_VENDOR_PROPERTY) {
+                LOG_ERR("capability string: \"%s\" does not support a property suffix,"
+                        "see --help",
+                        options.capability_string);
+                return false;
+            } else if (colon && capability_mapi.capability == TPM2_CAP_VENDOR_PROPERTY) {
+                char *value_str = &colon1;
+                if (value_str0 != '\0') {
+                    char *tail = NULL;
+                    errno = 0;
+                    property = strtoul(value_str, &tail, 0);
+                    if (errno || tail == value_str) {
+                        LOG_ERR("Could not convert vendor specific property, got: \"%s\"",
+                                value_str);
+                        return false;
+                    }
+                }
+            }
+
             options.capability = capability_mapi.capability;
-            options.property = capability_mapi.property;
+            options.property = property;
             options.count = capability_mapi.count;
             return true;
         }
@@ -235,7 +270,7 @@
  * Print string representation of the TPMA_PERMANENT attributes.
  */
 static void dump_permanent_attrs(TPMA_PERMANENT attrs) {
-    tpm2_tool_output("TPM2_PT_PERSISTENT:\n");
+    tpm2_tool_output("TPM2_PT_PERMANENT:\n");
     tpm2_tool_output("  ownerAuthSet:              %s\n",
             prop_str (attrs & TPMA_PERMANENT_OWNERAUTHSET));
     tpm2_tool_output("  endorsementAuthSet:        %s\n",
@@ -715,8 +750,8 @@
  */
 static tool_rc get_tpm_capability_all(ESYS_CONTEXT *context,
         TPMS_CAPABILITY_DATA **capability_data) {
-    return tpm2_capability_get(context, options.capability, options.property,
-            options.count, capability_data);
+    return tpm2_capability_get_ex(context, options.capability, options.property,
+            options.count, options.ignore_moredata, capability_data);
 }
 
 /*
@@ -777,7 +812,16 @@
     case TPM2_CAP_PCRS:
         pcr_print_pcr_selections(&capabilities->assignedPCR);
         break;
+#if defined(ESYS_4_0)
+    case TPM2_CAP_VENDOR_PROPERTY: {
+
+        TPM2B_MAX_CAP_BUFFER *buffer = &capabilities->vendor;
+        tpm2_util_hexdump(buffer->buffer, buffer->size);
+        tpm2_tool_output("\n");
+    } break;
+#endif
     default:
+        LOG_ERR("Capability 0x%x not supported", options.capability);
         return false;
     }
     return result;
@@ -790,6 +834,9 @@
     switch (key) {
     case 'l':
         options.list = true;
+        break;
+    case 1:
+        options.ignore_moredata = true;
     }
 
     return true;
@@ -809,8 +856,9 @@
 
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
-    const struct option topts = { { "list", no_argument, NULL, 'l' },
-
+    const struct option topts = {
+        { "list",            no_argument, NULL, 'l' },
+        { "ignore-moredata", no_argument, NULL,  1 },
     };
 
     *opts = tpm2_options_new("l", ARRAY_LEN(topts), topts, on_option, on_arg,

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_getcommandauditdigest.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_getcommandauditdigest.c Changed

@@ -31,6 +31,7 @@
     char *message_path;
     tpm2_convert_sig_fmt sig_format;
     TPMI_ALG_HASH sig_hash_algorithm;
+    TPMI_ALG_SIG_SCHEME sig_scheme;
     TPM2B_DATA qualification_data;
     TPM2B_ATTEST *audit_info;
     TPMT_SIGNATURE *signature;
@@ -39,6 +40,7 @@
 
 static tpm_getcommandauditdigest_ctx ctx = {
     .sig_hash_algorithm = TPM2_ALG_NULL,
+    .sig_scheme = TPM2_ALG_NULL,
     .qualification_data = TPM2B_EMPTY_INIT,
     .endorsement_hierarchy = {
         .ctx_path = "e"
@@ -88,6 +90,14 @@
             return false;
         }
         break;
+    case 0:
+        ctx.sig_scheme = tpm2_alg_util_from_optarg(value,
+                tpm2_alg_util_flags_sig);
+        if (ctx.sig_scheme == TPM2_ALG_ERROR) {
+            LOG_ERR("Unknown signing scheme, got: \"%s\"", value);
+            return false;
+        }
+        break;
     }
 
     return true;
@@ -103,7 +113,8 @@
         { "signature",      required_argument, NULL, 's' },
         { "message",        required_argument, NULL, 'm' },
         { "format",         required_argument, NULL, 'f' },
-        { "hash-algorithm", required_argument, NULL, 'g' }
+        { "hash-algorithm", required_argument, NULL, 'g' },
+        { "scheme",         required_argument, NULL,  0  },
     };
 
     *opts = tpm2_options_new("P:c:p:q:s:m:f:g:", ARRAY_LEN(topts), topts,
@@ -157,7 +168,7 @@
      * Setup signature scheme
      */
     rc = tpm2_alg_util_get_signature_scheme(ectx,
-            ctx.key.object.tr_handle, &ctx.sig_hash_algorithm, TPM2_ALG_NULL,
+            ctx.key.object.tr_handle, &ctx.sig_hash_algorithm, ctx.sig_scheme,
             &ctx.in_scheme);
     if (rc != tool_rc_success) {
         return rc;

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_geteccparameters.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_geteccparameters.c Changed

@@ -7,22 +7,152 @@
 #include "tpm2_alg_util.h"
 #include "tpm2_options.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_geteccparameters_ctx tpm_geteccparameters_ctx;
 struct tpm_geteccparameters_ctx {
+    /*
+     * Inputs
+     */
     TPMI_ECC_CURVE curve_id;
+
+    /*
+     * Outputs
+     */
+    TPMS_ALGORITHM_DETAIL_ECC *parameters;
     const char *ecc_parameters_path;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
 };
 
 static tpm_geteccparameters_ctx ctx = {
     .curve_id = TPM2_ECC_NONE,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
+static tool_rc geteccparameters(ESYS_CONTEXT *ectx) {
+   
+    tool_rc rc = tpm2_geteccparameters(ectx, ctx.curve_id, &ctx.parameters,
+        &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed TPM2_CC_ECC_Parameters");
+    }
+
+    return rc;
+}
+
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    is_file_op_success = files_save_ecc_details(ctx.parameters,
+        ctx.ecc_parameters_path);
+    if (!is_file_op_success) {
+        LOG_ERR("Failed to write out the ECC pub key");
+        return tool_rc_general_error;
+    }
+
+    return tool_rc_success;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        0,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
+
+    if (!ctx.ecc_parameters_path) {
+        LOG_ERR("Invalid path specified for saving the ECC parameters.");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.curve_id == TPM2_ECC_NONE) {
+        LOG_ERR("Invalid/ unspecified ECC curve");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
+
 static bool on_option(char key, char *value) {
 
     switch (key) {
     case 'o':
         ctx.ecc_parameters_path = value;
         break;
+    case 0:
+        ctx.cp_hash_path = value;
+    break;
     };
 
     return true;
@@ -45,10 +175,6 @@
         result = false;
     }
 
-    if (algorithm.publicArea.parameters.eccDetail.curveID > TPM2_ECC_NIST_P521) {
-        result = false;
-    }
-
     if (!result) {
         LOG_ERR("Invalid/unsupported ECC curve: %s", argv0);
         return false;
@@ -62,57 +188,69 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static struct option topts = {
-      { "output",  required_argument, NULL, 'o' },
+      { "output",  required_argument, 0, 'o' },
+      { "cphash",  required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("o:", ARRAY_LEN(topts), topts,
             on_option, on_args, 0);
 
-    return *opts != NULL;
-}
-
-static tool_rc check_options(void) {
-
-    if (!ctx.ecc_parameters_path) {
-        LOG_ERR("Invalid path specified for saving the ECC parameters.");
-        return tool_rc_option_error;
-    }
-
-    if (ctx.curve_id == TPM2_ECC_NONE) {
-        LOG_ERR("Invalid/ unspecified ECC curve");
-        return tool_rc_option_error;
-    }
-
-    return tool_rc_success;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
-    UNUSED(ectx);
 
-    // Check input options and arguments
+    /*
+     * 1. Process options
+     */
     tool_rc rc = check_options();
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    // ESAPI call
-    TPMS_ALGORITHM_DETAIL_ECC *parameters;
-    rc = tpm2_geteccparameters(ectx, ctx.curve_id, &parameters);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    // Process outputs
-    bool result = files_save_ecc_details(parameters, ctx.ecc_parameters_path);
-    if (!result) {
-        LOG_ERR("Failed to write out the ECC pub key");
-        return tool_rc_general_error;
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = geteccparameters(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
+}
+
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
     return tool_rc_success;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("geteccparameters", tpm2_tool_onstart, tpm2_tool_onrun, NULL, NULL)
+TPM2_TOOL_REGISTER("geteccparameters", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_getekcertificate.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_getekcertificate.c Changed

@@ -63,20 +63,20 @@
         return NULL;
     }
 
-    SHA256_CTX sha256;
-    int is_success = SHA256_Init(&sha256);
+    EVP_MD_CTX *sha256 = EVP_MD_CTX_new();
+    int is_success = EVP_DigestInit(sha256, EVP_sha256());
     if (!is_success) {
-        LOG_ERR("SHA256_Init failed");
+        LOG_ERR("EVP_DigestInit failed");
         goto err;
     }
 
     switch (ctx.out_public->publicArea.type) {
     case TPM2_ALG_RSA:
-        is_success = SHA256_Update(&sha256,
+        is_success = EVP_DigestUpdate(sha256,
                 ctx.out_public->publicArea.unique.rsa.buffer,
                 ctx.out_public->publicArea.unique.rsa.size);
         if (!is_success) {
-            LOG_ERR("SHA256_Update failed");
+            LOG_ERR("EVP_DigestUpdate failed");
             goto err;
         }
 
@@ -85,27 +85,27 @@
             goto err;
         }
         BYTE buf3 = { 0x1, 0x00, 0x01 }; // Exponent
-        is_success = SHA256_Update(&sha256, buf, sizeof(buf));
+        is_success = EVP_DigestUpdate(sha256, buf, sizeof(buf));
         if (!is_success) {
-            LOG_ERR("SHA256_Update failed");
+            LOG_ERR("EVP_DigestUpdate failed");
             goto err;
         }
         break;
 
     case TPM2_ALG_ECC:
-        is_success = SHA256_Update(&sha256,
+        is_success = EVP_DigestUpdate(sha256,
                 ctx.out_public->publicArea.unique.ecc.x.buffer,
                 ctx.out_public->publicArea.unique.ecc.x.size);
         if (!is_success) {
-            LOG_ERR("SHA256_Update failed");
+            LOG_ERR("EVP_DigestUpdate failed");
             goto err;
         }
 
-        is_success = SHA256_Update(&sha256,
+        is_success = EVP_DigestUpdate(sha256,
                 ctx.out_public->publicArea.unique.ecc.y.buffer,
                 ctx.out_public->publicArea.unique.ecc.y.size);
         if (!is_success) {
-            LOG_ERR("SHA256_Update failed");
+            LOG_ERR("EVP_DigestUpdate failed");
             goto err;
         }
         break;
@@ -115,12 +115,13 @@
         goto err;
     }
 
-    is_success = SHA256_Final(hash, &sha256);
+    is_success = EVP_DigestFinal_ex(sha256, hash, NULL);
     if (!is_success) {
-        LOG_ERR("SHA256_Final failed");
+        LOG_ERR("EVP_DigestFinal failed");
         goto err;
     }
 
+    EVP_MD_CTX_free(sha256);
     if (ctx.verbose) {
         tpm2_tool_output("public-key-hash:\n");
         tpm2_tool_output("  sha256: ");
@@ -134,6 +135,7 @@
     return hash;
 err:
     free(hash);
+    EVP_MD_CTX_free(sha256);
     return NULL;
 }
 
@@ -190,17 +192,21 @@
     return final_string;
 }
 
-static size_t writecallback(void *contents, size_t size, size_t nitems,
-    char *CERT_BUFFER) {
+static size_t writecallback(char *contents, size_t size, size_t nitems,
+    void *CERT_BUFFER) {
 
     strncpy(CERT_BUFFER, (const char *)contents, nitems * size);
     ctx.rsa_cert_buffer_size = nitems * size;
 
     return ctx.rsa_cert_buffer_size;
 }
+
 static bool retrieve_web_endorsement_certificate(char *b64h) {
 
-    size_t len = 1 + strlen(b64h) + strlen(ctx.ek_server_addr);
+    #define NULL_TERM_LEN 1                 // '\0'
+    #define PATH_JOIN_CHAR_LEN 1            // '/'
+    size_t len = strlen(ctx.ek_server_addr) + strlen(b64h) + NULL_TERM_LEN +
+        PATH_JOIN_CHAR_LEN;
     char *weblink = (char *) malloc(len);
     if (!weblink) {
         LOG_ERR("oom");
@@ -235,7 +241,14 @@
         }
     }
 
-    snprintf(weblink, len, "%s%s", ctx.ek_server_addr, b64h);
+    bool is_slash_append_required =
+        strncmp((ctx.ek_server_addr + strlen(ctx.ek_server_addr) - 1), "/", 1);
+    if (is_slash_append_required) {
+        snprintf(weblink, len, "%s%s%s", ctx.ek_server_addr, "/", b64h);
+    } else {
+        snprintf(weblink, len, "%s%s", ctx.ek_server_addr, b64h);
+    }
+
     rc = curl_easy_setopt(curl, CURLOPT_URL, weblink);
     if (rc != CURLE_OK) {
         LOG_ERR("curl_easy_setopt for CURLOPT_URL failed: %s",
@@ -276,6 +289,13 @@
         goto out_easy_cleanup;
     }
 
+    rc = curl_easy_setopt(curl, CURLOPT_FAILONERROR, true);
+    if (rc != CURLE_OK) {
+        LOG_ERR("curl_easy_setopt for CURLOPT_FAILONERROR failed: %s",
+                curl_easy_strerror(rc));
+        goto out_easy_cleanup;
+    }
+
     rc = curl_easy_perform(curl);
     if (rc != CURLE_OK) {
         LOG_ERR("curl_easy_perform() failed: %s", curl_easy_strerror(rc));
@@ -413,11 +433,17 @@
         goto nv_read_out;
     }
 
+    TPM2B_DIGEST cp_hash = { 0 };
+    TPM2B_DIGEST rp_hash = { 0 };
     rc = nv_index == RSA_EK_CERT_NV_INDEX ?
+
          tpm2_util_nv_read(ectx, nv_index, 0, 0, &object, &ctx.rsa_cert_buffer,
-         &ctx.rsa_cert_buffer_size, 0) :
+            &ctx.rsa_cert_buffer_size, &cp_hash, &rp_hash, TPM2_ALG_SHA256, 0,
+            ESYS_TR_NONE, ESYS_TR_NONE, NULL) :
+
          tpm2_util_nv_read(ectx, nv_index, 0, 0, &object, &ctx.ecc_cert_buffer,
-         &ctx.ecc_cert_buffer_size, 0);
+            &ctx.ecc_cert_buffer_size, &cp_hash, &rp_hash, TPM2_ALG_SHA256, 0,
+            ESYS_TR_NONE, ESYS_TR_NONE, NULL);
 
 nv_read_out:
     tmp_rc = tpm2_session_close(&object.session);
@@ -500,12 +526,6 @@
     /*
      * Following is everything applicable to ctx.is_cert_on_nv = false.
      */
-
-    rc = print_intel_ek_certificate_warning();
-    if (rc != tool_rc_success) {
-        return rc;
-    }
-
     if (!ctx.ek_path) {
         LOG_ERR("Must specify the EK public key path");
         return tool_rc_option_error;
@@ -598,6 +618,13 @@
     }
 
     /*
+     * Intel EK certificates on the NV-index are already in standard DER format.
+     */
+    if (ctx.is_intc_cert && ctx.is_cert_on_nv) {
+        ctx.is_cert_raw = true;
+    }
+
+    /*
      *  Convert Intel EK certificates as received in the URL safe variant of
      *  Base 64: https://tools.ietf.org/html/rfc4648#section-5 to PEM
      */

_service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_getpolicydigest.c Added

@@ -0,0 +1,287 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "files.h"
+#include "log.h"
+#include "tpm2.h"
+#include "tpm2_tool.h"
+
+#define MAX_SESSIONS 3
+typedef struct tpm_getpolicydigest_ctx tpm_getpolicydigest_ctx;
+struct tpm_getpolicydigest_ctx {
+    /*
+     * Input options
+     */
+    bool hex;
+
+    /*
+     * Outputs
+     */
+    const char *output_file;
+    TPM2B_DIGEST *policy_digest;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux Sessions
+     */
+    tpm2_session *session;
+    const char *session_path;
+    ESYS_TR session_handle;
+};
+
+static tpm_getpolicydigest_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+};
+
+static tool_rc get_policydigest(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. TPM2_CC_<command> OR Retrieve cpHash
+     */
+    tool_rc rc = tpm2_policy_getdigest(ectx, ctx.session_handle,
+        ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, &ctx.policy_digest,
+        &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed TPM2_CC_PolicyGetDigest");
+    }
+
+    return rc;
+}
+
+static tool_rc process_outputs(void) {
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    /*
+     * Either open an output file, or if stdout, do nothing as -Q
+     * was specified.
+     */
+    FILE *out = stdout;
+    if (ctx.output_file) {
+        out = fopen(ctx.output_file, "wb+");
+        if (!out) {
+            LOG_ERR("Could not open output file \"%s\", error: %s",
+                    ctx.output_file, strerror(errno));
+            rc = tool_rc_general_error;
+            goto out;
+        }
+    } else if (!output_enabled) {
+        goto out;
+    }
+
+    if (ctx.hex) {
+        tpm2_util_print_tpm2b2(out, ctx.policy_digest);
+        goto out;
+    }
+
+    is_file_op_success = files_write_bytes(out, ctx.policy_digest->buffer,
+        ctx.policy_digest->size);
+    if (!is_file_op_success) {
+        rc = tool_rc_general_error;
+    }
+
+out:
+    if (out && out != stdout) {
+        fclose(out);
+    }
+
+    return rc;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     * Note: Old-auth value is ignored when calculating cpHash.
+     */
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    tool_rc rc = tool_rc_success;
+    TPM2_HANDLE handle;
+    bool result = tpm2_util_string_to_uint32(ctx.session_path, &handle);
+    if (result) {
+        rc = tpm2_util_sys_handle_to_esys_handle(ectx, handle,
+            &ctx.session_handle);
+        if (rc != tool_rc_success) {
+            return rc;
+        }
+    } else {
+        rc = tpm2_session_restore(ectx, ctx.session_path, false, &ctx.session);
+        if (rc != tool_rc_success) {
+            return rc;
+        }
+        ctx.session_handle = tpm2_session_get_handle(ctx.session);
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(void) {
+
+    if (!ctx.session_path) {
+        LOG_ERR("Specify the session context.");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
+
+static bool on_option(char key, char *value) {
+
+    UNUSED(key);
+
+    switch (key) {
+    case 'o':
+        ctx.output_file = value;
+        break;
+    case 0:
+        ctx.hex = true;
+        break;
+    case 1:
+        ctx.cp_hash_path = value;
+        break;
+    case 'S':
+        ctx.session_path = value;
+        break;
+        /* no default */
+    }
+
+    return true;
+}
+
+static bool tpm2_tool_onstart(tpm2_options **opts) {
+
+    const struct option topts = {
+        { "output",       required_argument, 0, 'o' },
+        { "hex",          no_argument,       0,  0  },
+        { "session",      required_argument, 0, 'S' },
+        { "cphash",       required_argument, 0,  1  },
+    };
+
+    *opts = tpm2_options_new("S:o:", ARRAY_LEN(topts), topts, on_option, 0, 0);
+
+    return *opts != 0;
+}
+
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+
+    UNUSED(flags);
+
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = get_policydigest(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs();
+}
+
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+    free(ctx.policy_digest);
+
+    /*
+     * 2. Close authorization sessions
+     */
+    return tpm2_session_close(&ctx.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+}
+
+// Register this tool with tpm2_tool.c
+TPM2_TOOL_REGISTER("getpolicydigest", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_getrandom.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_getrandom.c Changed

@@ -12,63 +12,98 @@
 #include "tpm2.h"
 #include "tpm2_capability.h"
 #include "tpm2_tool.h"
+#include "tpm2_alg_util.h"
+#include "tpm2_util.h"
 
 typedef struct tpm_random_ctx tpm_random_ctx;
+#define MAX_AUX_SESSIONS 3
+#define MAX_SESSIONS 3
 struct tpm_random_ctx {
-    char *output_file;
+    /*
+     * Input options
+     */
     UINT16 num_of_bytes;
     bool force;
     bool hex;
-    tpm2_session *audit_session;
-    const char *audit_session_path;
+
+    /*
+     * Outputs
+     */
+    char *output_file;
+    TPM2B_DIGEST *random_bytes;
+
+    /*
+     * Parameter hashes
+     */
     const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
     const char *rp_hash_path;
-};
+    TPM2B_DIGEST rp_hash;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+    bool is_command_dispatch;
 
-static tpm_random_ctx ctx;
+    /*
+     * Aux Sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
+};
 
-static tool_rc get_random_and_save(ESYS_CONTEXT *ectx) {
+static tpm_random_ctx ctx = {
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
+    .aux_session_handle2 = ESYS_TR_NONE,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+};
 
-    ESYS_TR audit_session_handle = ESYS_TR_NONE;
-    TPMI_ALG_HASH param_hash_algorithm = TPM2_ALG_SHA256;
-    if (ctx.audit_session_path) {
-            tool_rc rc = tpm2_session_restore(ectx, ctx.audit_session_path,
-            false, &ctx.audit_session);
-        if (rc != tool_rc_success) {
-            LOG_ERR("Could not restore audit session");
-            return rc;
-        }
-        audit_session_handle = tpm2_session_get_handle(ctx.audit_session);
-        param_hash_algorithm = tpm2_session_get_authhash(ctx.audit_session);
-    }
+static tool_rc get_random(ESYS_CONTEXT *ectx) {
 
-    TPM2B_DIGEST *cp_hash =
-        ctx.cp_hash_path ? calloc(1, sizeof(TPM2B_DIGEST)): NULL;
-    TPM2B_DIGEST *rp_hash =
-        ctx.rp_hash_path ? calloc(1, sizeof(TPM2B_DIGEST)) : NULL;
-    TPM2B_DIGEST *random_bytes;
-    tool_rc rc = tpm2_getrandom(ectx, ctx.num_of_bytes, &random_bytes,
-    cp_hash, rp_hash, audit_session_handle, param_hash_algorithm);
+    /*
+     * 1. TPM2_CC_<command> OR Retrieve cpHash
+     */
+    tool_rc rc = tpm2_getrandom(ectx, ctx.num_of_bytes, &ctx.random_bytes,
+        &ctx.cp_hash, &ctx.rp_hash, ctx.aux_session_handle0,
+        ctx.aux_session_handle1, ctx.aux_session_handle2,
+        ctx.parameter_hash_algorithm);
     if (rc != tool_rc_success) {
-        goto out_skip_output_file;
+        LOG_ERR("Failed getrandom");
     }
 
+    return rc;
+}
+
+static tool_rc process_outputs(void) {
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+
+    bool is_file_op_success = true;
     if (ctx.cp_hash_path) {
-        bool result = files_save_digest(cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
-        if (!ctx.rp_hash_path) {
-            goto out_skip_output_file;
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
         }
     }
 
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
     /* ensure we got the expected number of bytes unless force is set */
-    if (!ctx.force && random_bytes->size != ctx.num_of_bytes) {
+    tool_rc rc = tool_rc_success;
+    if (!ctx.force && ctx.random_bytes->size != ctx.num_of_bytes) {
         LOG_ERR("Got %"PRIu16" bytes, expected: %"PRIu16"\n"
                 "Lower your requested amount or"
                 " use --force to override this behavior",
-                random_bytes->size, ctx.num_of_bytes);
+                ctx.random_bytes->size, ctx.num_of_bytes);
         rc = tool_rc_general_error;
         goto out_skip_output_file;
     }
@@ -91,20 +126,22 @@
     }
 
     if (ctx.hex) {
-        tpm2_util_print_tpm2b2(out, random_bytes);
+        tpm2_util_print_tpm2b2(out, ctx.random_bytes);
         goto out;
     }
 
-    bool result = files_write_bytes(out, random_bytes->buffer,
-    random_bytes->size);
-    if (!result) {
+    is_file_op_success = files_write_bytes(out, ctx.random_bytes->buffer,
+        ctx.random_bytes->size);
+    if (!is_file_op_success) {
         rc = tool_rc_general_error;
         goto out;
     }
 
-    if (ctx.rp_hash_path) {
-        bool result = files_save_digest(rp_hash, ctx.rp_hash_path);
-        rc = result ? tool_rc_success : tool_rc_general_error;
+    if(ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+        if (!is_file_op_success) {
+            rc = tool_rc_general_error;
+        }
     }
 
 out:
@@ -113,11 +150,120 @@
     }
 
 out_skip_output_file:
-    if (ctx.rp_hash_path || !ctx.cp_hash_path) {
-        free(random_bytes);
+    if (!ctx.cp_hash_path) {
+        free(ctx.random_bytes);
     }
-    free(cp_hash);
-    free(rp_hash);
+
+    return rc;
+}
+
+static tool_rc get_max_random(ESYS_CONTEXT *ectx, UINT32 *value) {
+
+    TPMS_CAPABILITY_DATA *cap_data = NULL;
+    tool_rc rc = tpm2_capability_get(ectx, TPM2_CAP_TPM_PROPERTIES,
+            TPM2_PT_FIXED, TPM2_MAX_TPM_PROPERTIES, &cap_data);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    UINT32 i;
+    for (i = 0; i < cap_data->data.tpmProperties.count; i++) {
+        TPMS_TAGGED_PROPERTY *p = &cap_data->data.tpmProperties.tpmPropertyi;
+        if (p->property == TPM2_PT_MAX_DIGEST) {
+            *value = p->value;
+            free(cap_data);
+            return tool_rc_success;
+        }
+    }
+
+    LOG_ERR("TPM does not have property TPM2_PT_MAX_DIGEST");
+    free(cap_data);
+
+    return tool_rc_general_error;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     * Note: Old-auth value is ignored when calculating cpHash.
+     */
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    tool_rc rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * Error if bytes requested is bigger than max hash size, which is what TPMs
+     * should bound their requests by and always have available per the spec.
+     *
+     * Per 16.1 of:
+     *  - https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-3-Commands-01.38.pdf
+     *
+     *  Allow the force flag to override this behavior.
+     */
+    if (!ctx.force) {
+        UINT32 max = 0;
+        rc = get_max_random(ectx, &max);
+        if (rc != tool_rc_success) {
+            return rc;
+        }
+
+        if (ctx.num_of_bytes > max) {
+            LOG_ERR("TPM getrandom is bounded by max hash size, which is: "
+                    "%"PRIu32"\n"
+                    "Please lower your request (preferred) and try again or"
+                    " use --force (advanced)", max);
+            return tool_rc_general_error;
+        }
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.aux_session0,
+        ctx.aux_session1,
+        ctx.aux_session2
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.cp_hash_path && !ctx.rp_hash_path) ?
+        false : true;
 
     return rc;
 }
@@ -143,7 +289,13 @@
         ctx.rp_hash_path = value;
         break;
     case 'S':
-        ctx.audit_session_path = value;
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
         break;
         /* no default */
     }
@@ -151,30 +303,6 @@
     return true;
 }
 
-static tool_rc get_max_random(ESYS_CONTEXT *ectx, UINT32 *value) {
-
-    TPMS_CAPABILITY_DATA *cap_data = NULL;
-    tool_rc rc = tpm2_capability_get(ectx, TPM2_CAP_TPM_PROPERTIES,
-            TPM2_PT_FIXED, TPM2_MAX_TPM_PROPERTIES, &cap_data);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
-
-    UINT32 i;
-    for (i = 0; i < cap_data->data.tpmProperties.count; i++) {
-        TPMS_TAGGED_PROPERTY *p = &cap_data->data.tpmProperties.tpmPropertyi;
-        if (p->property == TPM2_PT_MAX_DIGEST) {
-            *value = p->value;
-            free(cap_data);
-            return tool_rc_success;
-        }
-    }
-
-    LOG_ERR("TPM does not have property TPM2_PT_MAX_DIGEST");
-    free(cap_data);
-    return tool_rc_general_error;
-}
-
 static bool on_args(int argc, char **argv) {
 
     if (argc > 1) {
@@ -213,40 +341,61 @@
     UNUSED(flags);
 
     /*
-     * Error if bytes requested is bigger than max hash size, which is what TPMs
-     * should bound their requests by and always have available per the spec.
-     *
-     * Per 16.1 of:
-     *  - https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-3-Commands-01.38.pdf
-     *
-     *  Allow the force flag to override this behavior.
+     * 1. Process options
      */
-    if (!ctx.force) {
-        UINT32 max = 0;
-        tool_rc rc = get_max_random(ectx, &max);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
 
-        if (ctx.num_of_bytes > max) {
-            LOG_ERR("TPM getrandom is bounded by max hash size, which is: "
-                    "%"PRIu32"\n"
-                    "Please lower your request (preferred) and try again or"
-                    " use --force (advanced)", max);
-            return tool_rc_general_error;
-        }
+    /*
+     * 2. Process inputs
+     */
+    tool_rc rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = get_random(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return get_random_and_save(ectx);
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs();
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    if (ctx.audit_session_path) {
-        return tpm2_session_close(&ctx.audit_session);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tool_rc_success;
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+        }
+        if (tmp_rc != tool_rc_success) {
+            rc = tmp_rc;
+        }
     }
-    return tool_rc_success;
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("getrandom", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("getrandom", tpm2_tool_onstart, tpm2_tool_onrun,
+tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_getsessionauditdigest.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_getsessionauditdigest.c Changed

@@ -31,6 +31,7 @@
     char *message_path;
     tpm2_convert_sig_fmt sig_format;
     TPMI_ALG_HASH sig_hash_algorithm;
+    TPMI_ALG_SIG_SCHEME sig_scheme;
     TPM2B_DATA qualification_data;
     TPM2B_ATTEST *audit_info;
     TPMT_SIGNATURE *signature;
@@ -43,6 +44,7 @@
 
 static tpm_getsessionauditdigest_ctx ctx = {
     .sig_hash_algorithm = TPM2_ALG_NULL,
+    .sig_scheme = TPM2_ALG_NULL,
     .qualification_data = TPM2B_EMPTY_INIT,
     .endorsement_hierarchy = {
         .ctx_path = "e"
@@ -93,6 +95,14 @@
             return false;
         }
         break;
+    case 0:
+        ctx.sig_scheme = tpm2_alg_util_from_optarg(value,
+                tpm2_alg_util_flags_sig);
+        if (ctx.sig_scheme == TPM2_ALG_ERROR) {
+            LOG_ERR("Unknown signing scheme, got: \"%s\"", value);
+            return false;
+        }
+        break;
     case 'S':
         ctx.audit_session_path = value;
         break;
@@ -112,6 +122,7 @@
         { "message",        required_argument, NULL, 'm' },
         { "format",         required_argument, NULL, 'f' },
         { "hash-algorithm", required_argument, NULL, 'g' },
+        { "scheme",         required_argument, NULL,  0  },
         { "session",        required_argument, NULL, 'S' }
     };

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_gettime.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_gettime.c Changed

@@ -9,14 +9,18 @@
 #include "files.h"
 #include "log.h"
 #include "tpm2.h"
-#include "tpm2_tool.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_convert.h"
 #include "tpm2_hash.h"
 #include "tpm2_options.h"
+#include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_gettime_ctx tpm_gettime_ctx;
 struct tpm_gettime_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -29,47 +33,138 @@
         tpm2_loaded_object object;
     } privacy_admin;
 
-    tpm2_convert_sig_fmt sig_format;
     TPM2B_DATA qualifying_data;
 
     TPMI_ALG_HASH halg;
     TPMI_ALG_SIG_SCHEME sig_scheme;
     TPMT_SIG_SCHEME in_scheme;
 
+    /*
+     * Outputs
+     */
     const char *certify_info_path;
+    TPM2B_ATTEST *time_info;
+
     const char *output_path;
+    TPMT_SIGNATURE *signature;
+    tpm2_convert_sig_fmt sig_format;
 
-    char *cp_hash_path;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_gettime_ctx ctx = {
-        .halg = TPM2_ALG_NULL,
-        .sig_scheme = TPM2_ALG_NULL,
-        .privacy_admin = { .ctx_path = "endorsement" }
+    .halg = TPM2_ALG_NULL,
+    .sig_scheme = TPM2_ALG_NULL,
+    .privacy_admin = { .ctx_path = "endorsement" },
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tool_rc init(ESYS_CONTEXT *ectx) {
+static tool_rc gettime(ESYS_CONTEXT *ectx) {
 
-    if (!ctx.signing_key.ctx_path) {
-        LOG_ERR("Expected option \"-c\"");
-        return tool_rc_option_error;
+    return tpm2_gettime(ectx, &ctx.privacy_admin.object,
+        &ctx.signing_key.object, &ctx.qualifying_data, &ctx.in_scheme,
+        &ctx.time_info,&ctx.signature, &ctx.cp_hash,
+        ctx.parameter_hash_algorithm);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
     }
 
-    if (ctx.cp_hash_path && (ctx.output_path || ctx.certify_info_path)) {
-        LOG_ERR("Ignoring output options due to cpHash calculation");
-        return tool_rc_option_error;
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    /* save the signature */
+    if (ctx.output_path) {
+        is_file_op_success = tpm2_convert_sig_save(ctx.signature,
+            ctx.sig_format, ctx.output_path);
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    if (ctx.certify_info_path) {
+        /* save the attestation data */
+        is_file_op_success = files_save_bytes_to_file(ctx.certify_info_path,
+            ctx.time_info->attestationData, ctx.time_info->size);
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    TPMS_ATTEST attest;
+    rc = files_tpm2b_attest_to_tpms_attest(ctx.time_info, &attest);
+    if (rc == tool_rc_success) {
+        tpm2_util_print_time(&attest.attested.time.time);
     }
 
+    return rc;
+}
+
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    /* set up the privacy admin (always endorsement) hard coded in ctx init */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.privacy_admin.ctx_path,
+        ctx.privacy_admin.auth_str, &ctx.privacy_admin.object, false,
+        TPM2_HANDLE_FLAGS_E);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /* Object #2 */
     /* load the signing key */
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
-            ctx.signing_key.auth_str, &ctx.signing_key.object, false,
-            TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
+    rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
+        ctx.signing_key.auth_str, &ctx.signing_key.object, false,
+        TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
     if (rc != tool_rc_success) {
         LOG_ERR("Invalid key authorization");
         return rc;
     }
 
     /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    /*
      * Set signature scheme for key type, or validate chosen scheme is allowed for key type.
      */
     rc = tpm2_alg_util_get_signature_scheme(ectx,
@@ -80,12 +175,43 @@
         return rc;
     }
 
-    /* set up the privacy admin (always endorsement) hard coded in ctx init */
-    rc = tpm2_util_object_load_auth(ectx, ctx.privacy_admin.ctx_path,
-            ctx.privacy_admin.auth_str, &ctx.privacy_admin.object, false,
-            TPM2_HANDLE_FLAGS_E);
-    if (rc != tool_rc_success) {
-        return rc;
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.privacy_admin.object.session,
+        ctx.signing_key.object.session,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+    if (!ctx.is_command_dispatch && (ctx.output_path || ctx.certify_info_path)) {
+        LOG_ERR("Ignoring output options due to cpHash calculation");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.signing_key.ctx_path) {
+        LOG_ERR("Expected option \"-c\"");
+        return tool_rc_option_error;
     }
 
     return tool_rc_success;
@@ -150,104 +276,89 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static const struct option topts = {
-      { "auth",                 required_argument, NULL, 'p' },
-      { "endorse-auth",         required_argument, NULL, 'P' },
-      { "hash-algorithm",       required_argument, NULL, 'g' },
-      { "scheme",               required_argument, NULL, 's' },
-      { "signature",            required_argument, NULL, 'o' },
-      { "key-context",          required_argument, NULL, 'c' },
-      { "format",               required_argument, NULL, 'f' },
-      { "qualification",        required_argument, NULL, 'q' },
-      { "attestation",          required_argument, NULL,  2  },
-      { "cphash",               required_argument, NULL,  0  },
+      { "auth",           required_argument, 0, 'p' },
+      { "endorse-auth",   required_argument, 0, 'P' },
+      { "hash-algorithm", required_argument, 0, 'g' },
+      { "scheme",         required_argument, 0, 's' },
+      { "signature",      required_argument, 0, 'o' },
+      { "key-context",    required_argument, 0, 'c' },
+      { "format",         required_argument, 0, 'f' },
+      { "qualification",  required_argument, 0, 'q' },
+      { "attestation",    required_argument, 0,  2  },
+      { "cphash",         required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("p:g:o:c:f:s:P:q:", ARRAY_LEN(topts), topts,
-            on_option, NULL, 0);
+        on_option, 0, 0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    tool_rc rc = init(ectx);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    TPM2B_ATTEST *time_info = NULL;
-    TPMT_SIGNATURE *signature = NULL;
-
-    if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_gettime(ectx, &ctx.privacy_admin.object,
-        &ctx.signing_key.object, &ctx.qualifying_data, &ctx.in_scheme,
-        &time_info, &signature, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
-
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
         return rc;
     }
 
-    rc = tpm2_gettime(ectx,
-            &ctx.privacy_admin.object,
-            &ctx.signing_key.object,
-            &ctx.qualifying_data,
-            &ctx.in_scheme,
-            &time_info,
-            &signature,
-            NULL);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = gettime(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    /* save the signature */
-    if (ctx.output_path) {
-        bool result = tpm2_convert_sig_save(signature, ctx.sig_format, ctx.output_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-            goto out;
-        }
-    }
-
-    if (ctx.certify_info_path) {
-        /* save the attestation data */
-        bool result = files_save_bytes_to_file(ctx.certify_info_path,
-            time_info->attestationData, time_info->size);
-        if (!result) {
-            rc = tool_rc_general_error;
-            goto out;
-        }
-    }
-
-    TPMS_ATTEST attest;
-    rc = files_tpm2b_attest_to_tpms_attest(time_info, &attest);
-    if (rc == tool_rc_success) {
-        tpm2_util_print_time(&attest.attested.time.time);
-    }
-
-out:
-    Esys_Free(time_info);
-    Esys_Free(signature);
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    tool_rc rc = tpm2_session_close(&ctx.privacy_admin.object.session);
-    rc |=tpm2_session_close(&ctx.signing_key.object.session);
+    /*
+     * 1. Free objects
+     */
+    Esys_Free(ctx.time_info);
+    Esys_Free(ctx.signature);
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.privacy_admin.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
+    }
+
+    tmp_rc = tpm2_session_close(&ctx.signing_key.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
+    }
+
+    /*
+     * 3. Close auxiliary sessions
+     */
 
     return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("gettime", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("gettime", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_hierarchycontrol.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_hierarchycontrol.c Changed

@@ -8,7 +8,11 @@
 #include "files.h"
 
 typedef struct hierarchycontrol_ctx hierarchycontrol_ctx;
+#define MAX_SESSIONS 3
 struct hierarchycontrol_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -18,40 +22,40 @@
     TPMI_RH_ENABLES enable;
     TPMI_YES_NO state;
 
-    char *cp_hash_path;
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static hierarchycontrol_ctx ctx = {
     .auth_hierarchy.ctx_path = "p",
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
 static tool_rc hierarchycontrol(ESYS_CONTEXT *ectx) {
 
-    if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_hierarchycontrol(ectx, &ctx.auth_hierarchy.object,
-        ctx.enable, ctx.state, &cp_hash);
-        if (rc == tool_rc_success) {
-            bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-            if (!result) {
-                LOG_ERR("Failed to save cp hash");
-                rc = tool_rc_general_error;
-            }
-        }
-        return rc;
-    }
-
     LOG_INFO ("Using hierarchy %s to \'%s\' TPMA_STARTUP_CLEAR bit (%s)",
-        ctx.auth_hierarchy.object.tr_handle == ESYS_TR_RH_OWNER ? "TPM2_RH_OWNER" :
-        ctx.auth_hierarchy.object.tr_handle == ESYS_TR_RH_ENDORSEMENT ? "TPM2_RH_ENDORSEMENT" :
-        ctx.auth_hierarchy.object.tr_handle == ESYS_TR_RH_PLATFORM ? "TPM2_RH_PLATFORM" : "TPM2_RH_PLATFORM_NV",
+        ctx.auth_hierarchy.object.tr_handle == ESYS_TR_RH_OWNER ?
+            "TPM2_RH_OWNER" :
+        ctx.auth_hierarchy.object.tr_handle == ESYS_TR_RH_ENDORSEMENT ?
+            "TPM2_RH_ENDORSEMENT" :
+        ctx.auth_hierarchy.object.tr_handle == ESYS_TR_RH_PLATFORM ?
+            "TPM2_RH_PLATFORM" : "TPM2_RH_PLATFORM_NV",
         ctx.enable == TPM2_RH_PLATFORM ? "phEnable" :
         ctx.enable == TPM2_RH_OWNER ? "shEnable" :
         ctx.enable == TPM2_RH_ENDORSEMENT ? "ehEnable" : "phEnableNV",
         ctx.state ? "SET" : "CLEAR");
 
     tool_rc rc = tpm2_hierarchycontrol(ectx, &ctx.auth_hierarchy.object,
-        ctx.enable, ctx.state, NULL);
+        ctx.enable, ctx.state, &ctx.cp_hash, ctx.parameter_hash_algorithm);
 
     if (rc != tool_rc_success) {
         LOG_ERR("Failed hierarchycontrol operation.");
@@ -60,76 +64,87 @@
     return rc;
 }
 
-static bool on_arg(int argc, char **argv) {
 
-    switch (argc) {
-    case 2:
-        break;
-    default:
-        return false;
-    }
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
-    if (!strcmp(argv0, "phEnable")) {
-        ctx.enable = TPM2_RH_PLATFORM;
-    } else if (!strcmp(argv0, "shEnable")) {
-        ctx.enable = TPM2_RH_OWNER;
-    } else if (!strcmp(argv0, "ehEnable")) {
-        ctx.enable = TPM2_RH_ENDORSEMENT;
-    } else if (!strcmp(argv0, "phEnableNV")) {
-        ctx.enable = TPM2_RH_PLATFORM_NV;
-    } else {
-        LOG_ERR("Incorrect property, got: \"%s\", expected "
-                "phEnable|shEnable|ehEnable|phEnableNV", argv0);
-        return false;
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
     }
 
-    if (!strcmp(argv1, "set")) {
-        ctx.state = TPM2_YES;
-    } else if (!strcmp(argv1, "clear")) {
-        ctx.state = TPM2_NO;
-    } else {
-        LOG_ERR("Incorrect operation, got: \"%s\", expected set|clear.",
-                argv1);
-        return false;
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
     }
 
-    return true;
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    return rc;
 }
 
-static bool on_option(char key, char *value) {
 
-    switch (key) {
-    case 'C':
-        ctx.auth_hierarchy.ctx_path = value;
-        break;
-    case 'P':
-        ctx.auth_hierarchy.auth_str = value;
-        break;
-    case 0:
-        ctx.cp_hash_path = value;
-        break;
-    }
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
-    return true;
-}
+    /*
+     * 1. Object and auth initializations
+     */
 
-static bool tpm2_tool_onstart(tpm2_options **opts) {
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
 
-    const struct option topts = {
-        { "hierarchy",      required_argument, NULL, 'C' },
-        { "hierarchy-auth", required_argument, NULL, 'P' },
-        { "cphash",         required_argument, NULL,  0  },
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    /*
+     * auth_hierarchy already loaded in check_options
+     */
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        0,
+        0
     };
 
-    *opts = tpm2_options_new("C:P:", ARRAY_LEN(topts), topts, on_option, on_arg,
-            0);
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
 
-    return *opts != NULL;
-}
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
 
-    UNUSED(flags);
+    return tool_rc_success;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
 
     tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
             ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
@@ -161,7 +176,9 @@
             LOG_ERR("Unknown permanent handle, got: \"0x%x\"", ctx.enable);
             return tool_rc_unsupported;
         }
-    } else {
+    }
+
+    if (ctx.state != TPM2_YES) {
         switch (ctx.enable) {
         case TPM2_RH_PLATFORM:
             if (ctx.auth_hierarchy.object.tr_handle != ESYS_TR_RH_PLATFORM) {
@@ -205,14 +222,136 @@
         }
     }
 
-    return hierarchycontrol(ectx);
+    return tool_rc_success;
+}
+
+static bool on_arg(int argc, char **argv) {
+
+    switch (argc) {
+    case 2:
+        break;
+    default:
+        return false;
+    }
+
+    bool is_phenable = strcmp(argv0, "phEnable") == 0;
+    bool is_shenable = strcmp(argv0, "shEnable") == 0;
+    bool is_ehenable = strcmp(argv0, "ehEnable") == 0;
+    bool is_phenablenv = strcmp(argv0, "phEnableNV") == 0;
+    if (is_phenable) {
+        ctx.enable = TPM2_RH_PLATFORM;
+    } else if (is_shenable) {
+        ctx.enable = TPM2_RH_OWNER;
+    } else if (is_ehenable) {
+        ctx.enable = TPM2_RH_ENDORSEMENT;
+    } else if (is_phenablenv) {
+        ctx.enable = TPM2_RH_PLATFORM_NV;
+    } else {
+        LOG_ERR("Incorrect property, got: \"%s\", expected "
+                "phEnable|shEnable|ehEnable|phEnableNV", argv0);
+        return false;
+    }
+
+    bool is_set = strcmp(argv1, "set") == 0;
+    bool is_clear = strcmp(argv1, "clear") == 0;
+    if (is_set) {
+        ctx.state = TPM2_YES;
+    } else if (is_clear) {
+        ctx.state = TPM2_NO;
+    } else {
+        LOG_ERR("Incorrect operation, got: \"%s\", expected set|clear.",
+            argv1);
+        return false;
+    }
+
+    return true;
+}
+
+static bool on_option(char key, char *value) {
+
+    switch (key) {
+    case 'C':
+        ctx.auth_hierarchy.ctx_path = value;
+        break;
+    case 'P':
+        ctx.auth_hierarchy.auth_str = value;
+        break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
+    }
+
+    return true;
+}
+
+static bool tpm2_tool_onstart(tpm2_options **opts) {
+
+    const struct option topts = {
+        { "hierarchy",      required_argument, 0, 'C' },
+        { "hierarchy-auth", required_argument, 0, 'P' },
+        { "cphash",         required_argument, 0,  0  },
+    };
+
+    *opts = tpm2_options_new("C:P:", ARRAY_LEN(topts), topts, on_option, on_arg,
+        0);
+
+    return *opts != 0;
+}
+
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+
+    UNUSED(flags);
+
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = hierarchycontrol(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("hierarchycontrol", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("hierarchycontrol", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_hmac.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_hmac.c Changed

@@ -13,8 +13,12 @@
 #include "tpm2_alg_util.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_hmac_ctx tpm_hmac_ctx;
 struct tpm_hmac_ctx {
+    /*
+     * Inputs
+     */
     struct {
         char *ctx_path;
         char *auth_str;
@@ -22,61 +26,65 @@
     } hmac_key;
 
     FILE *input;
-    char *hmac_output_file_path;
-    char *ticket_path;
+    unsigned long input_file_size;
+
     TPMI_ALG_HASH halg;
     bool hex;
-    char *cp_hash_path;
+    bool is_not_sequence;
+
+    /*
+     * Outputs
+     */
+    char *hmac_output_file_path;
+    TPM2B_DIGEST *hmac_out;
+    char *ticket_path;
+    TPMT_TK_HASHCHECK *validation;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
-static tpm_hmac_ctx ctx;
+static tpm_hmac_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+};
 
-static tool_rc tpm_hmac_file(ESYS_CONTEXT *ectx, TPM2B_DIGEST **result,
-        TPMT_TK_HASHCHECK **validation) {
+static tool_rc hmac(ESYS_CONTEXT *ectx) {
 
     unsigned long file_size = 0;
     FILE *input = ctx.input;
-
-    tool_rc rc;
     /* Suppress error reporting with NULL path */
-    bool res = files_get_file_size(input, &file_size, NULL);
-
+    bool is_file_readable = files_get_file_size(input, &file_size, 0);
     /*
-     * If we can get the file size and its less than 1024, just do it in one hash invocation.
-     * We can't use the one-shot command if we require ticket, as it doesn't provide it in
-     * the response from the TPM.
+     * If we can get the file size and its less than 1024, just do it in one
+     * hash invocation.
+     *
+     * We can't use the one-shot command if we require ticket, as it doesn't
+     * provide it in the response from the TPM.
      */
-    if (!ctx.ticket_path && res && file_size <= TPM2_MAX_DIGEST_BUFFER) {
-
+    tool_rc rc = tool_rc_success;
+    bool is_file_op_success = false;
+    if (!ctx.ticket_path && is_file_readable &&
+        file_size <= TPM2_MAX_DIGEST_BUFFER) {
         TPM2B_MAX_BUFFER buffer = { .size = file_size };
 
-        res = files_read_bytes(ctx.input, buffer.buffer, buffer.size);
-        if (!res) {
+        is_file_readable = files_read_bytes(ctx.input, buffer.buffer,
+            buffer.size);
+        if (!is_file_readable) {
             LOG_ERR("Error reading input file!");
             return tool_rc_general_error;
         }
 
-        if (ctx.cp_hash_path) {
-            LOG_WARN("Exiting without performing HMAC when calculating cpHash");
-            TPM2B_DIGEST cp_hash = { .size = 0 };
-            tool_rc rc = tpm2_hmac(ectx, &ctx.hmac_key.object, ctx.halg,
-            &buffer, result, &cp_hash);
-            if (rc != tool_rc_success) {
-                return rc;
-            }
-
-            bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-            if (!result) {
-                rc = tool_rc_general_error;
-            }
-            return rc;
-        }
         /*
          * hash algorithm specified in the key's scheme is used as the
          * hash algorithm for the HMAC
          */
-        return tpm2_hmac(ectx, &ctx.hmac_key.object, ctx.halg, &buffer, result,
-        NULL);
+        return tpm2_hmac(ectx, &ctx.hmac_key.object, ctx.halg, &buffer,
+            &ctx.hmac_out, &ctx.cp_hash, ctx.parameter_hash_algorithm);
     }
 
     if (ctx.cp_hash_path) {
@@ -84,14 +92,14 @@
         return tool_rc_general_error;
     }
 
-    ESYS_TR sequence_handle;
     /*
      * Size is either unknown because the FILE * is a fifo, or it's too big
      * to do in a single hash call. Based on the size figure out the chunks
      * to loop over, if possible. This way we can call Complete with data.
      */
+    ESYS_TR sequence_handle;
     rc = tpm2_hmac_start(ectx, &ctx.hmac_key.object, ctx.halg,
-            &sequence_handle);
+        &sequence_handle);
     if (rc != tool_rc_success) {
         return rc;
     }
@@ -100,15 +108,12 @@
      * loop when 1 block is left, else we go till feof.
      */
     size_t left = file_size;
-    bool use_left = !!res;
-
+    bool use_left = is_file_readable;
     TPM2B_MAX_BUFFER data;
-
     bool done = false;
     while (!done) {
-
         size_t bytes_read = fread(data.buffer, 1,
-                BUFFER_SIZE(typeof(data), buffer), input);
+            BUFFER_SIZE(typeof(data), buffer), input);
         if (ferror(input)) {
             LOG_ERR("Error reading from input file");
             return tool_rc_general_error;
@@ -136,8 +141,8 @@
 
     if (use_left) {
         data.size = left;
-        bool res = files_read_bytes(input, data.buffer, left);
-        if (!res) {
+        is_file_op_success = files_read_bytes(input, data.buffer, left);
+        if (!is_file_op_success) {
             LOG_ERR("Error reading from input file.");
             return tool_rc_general_error;
         }
@@ -145,43 +150,50 @@
         data.size = 0;
     }
 
-    rc = tpm2_hmac_sequencecomplete(ectx, sequence_handle, &ctx.hmac_key.object,
-            &data, result, validation);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
-
-    return tool_rc_success;
+    return tpm2_hmac_sequencecomplete(ectx, sequence_handle,
+        &ctx.hmac_key.object, &data, &ctx.hmac_out, &ctx.validation);
 }
 
-static tool_rc do_hmac_and_output(ESYS_CONTEXT *ectx) {
-
-    TPM2B_DIGEST *hmac_out = NULL;
-    TPMT_TK_HASHCHECK *validation = NULL;
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
-    FILE *out = stdout;
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-    tool_rc rc = tpm_hmac_file(ectx, &hmac_out, &validation);
-    if (rc != tool_rc_success || ctx.cp_hash_path) {
-        goto out;
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
     }
 
-    assert(hmac_out);
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
 
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    FILE *out = stdout;
+    assert(ctx.hmac_out);
     if (ctx.ticket_path) {
-        bool res = files_save_validation(validation, ctx.ticket_path);
-        if (!res) {
+        is_file_op_success = files_save_validation(ctx.validation,
+            ctx.ticket_path);
+        if (!is_file_op_success) {
             rc = tool_rc_general_error;
             goto out;
         }
     }
 
-    rc = tool_rc_general_error;
     if (ctx.hmac_output_file_path) {
         out = fopen(ctx.hmac_output_file_path, "wb+");
         if (!out) {
             LOG_ERR("Could not open output file \"%s\", error: %s",
                     ctx.hmac_output_file_path, strerror(errno));
+            rc = tool_rc_general_error;
             goto out;
         }
     } else if (!output_enabled) {
@@ -190,27 +202,117 @@
     }
 
     if (ctx.hex) {
-        tpm2_util_print_tpm2b2(out, hmac_out);
+        tpm2_util_print_tpm2b2(out, ctx.hmac_out);
     } else {
-
-        bool res = files_write_bytes(out, hmac_out->buffer, hmac_out->size);
-        if (!res) {
+        is_file_op_success = files_write_bytes(out, ctx.hmac_out->buffer,
+            ctx.hmac_out->size);
+        if (!is_file_op_success) {
+            rc = tool_rc_general_error;
             goto out;
         }
     }
 
-    rc = tool_rc_success;
-
 out:
     if (out && out != stdout) {
         fclose(out);
     }
 
-    free(hmac_out);
-    free(validation);
     return rc;
 }
 
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.hmac_key.ctx_path,
+        ctx.hmac_key.auth_str, &ctx.hmac_key.object, false,
+        TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid key handle authorization");
+        return rc;
+    }
+
+    /* Object #2 */
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * if no halg was specified, read the public portion of the key and use it's
+     * scheme
+     */
+    if (!ctx.halg) {
+        TPM2B_PUBLIC *pub = 0;
+        rc = tpm2_readpublic(ectx, ctx.hmac_key.object.tr_handle, &pub, 0, 0);
+        if (rc != tool_rc_success) {
+            return rc;
+        }
+
+        /*
+         * if we're attempting to figure out a hashing scheme, and the scheme is NULL
+         * we default to sha256.
+         */
+        ctx.halg = pub->publicArea.parameters.keyedHashDetail.scheme.details.hmac.hashAlg;
+        if (ctx.halg == TPM2_ALG_NULL) {
+            ctx.halg = TPM2_ALG_SHA256;
+        }
+        free(pub);
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.hmac_key.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    if (!ctx.hmac_key.ctx_path) {
+        LOG_ERR("Must specify options C.");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
+
 static bool on_option(char key, char *value) {
 
     switch (key) {
@@ -264,27 +366,21 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
-        { "key-context",    required_argument, NULL, 'c' },
-        { "auth",           required_argument, NULL, 'p' },
-        { "output",         required_argument, NULL, 'o' },
-        { "hash-algorithm", required_argument, NULL, 'g' },
-        { "ticket",         required_argument, NULL, 't' },
-        { "hex",            no_argument,       NULL,  0  },
-        { "cphash",         required_argument, NULL,  1  },
+        { "key-context",    required_argument, 0, 'c' },
+        { "auth",           required_argument, 0, 'p' },
+        { "output",         required_argument, 0, 'o' },
+        { "hash-algorithm", required_argument, 0, 'g' },
+        { "ticket",         required_argument, 0, 't' },
+        { "hex",            no_argument,       0,  0  },
+        { "cphash",         required_argument, 0,  1  },
     };
 
     ctx.input = stdin;
 
     *opts = tpm2_options_new("c:p:o:g:t:", ARRAY_LEN(topts), topts, on_option,
-            on_args, 0);
-
-    return *opts != NULL;
-}
+        on_args, 0);
 
-static tool_rc readpub(ESYS_CONTEXT *ectx, ESYS_TR handle,
-        TPM2B_PUBLIC **public) {
-
-    return tpm2_readpublic(ectx, handle, public, NULL, NULL);
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
@@ -292,57 +388,60 @@
     UNUSED(flags);
 
     /*
-     * Option C must be specified.
+     * 1. Process options
      */
-    if (!ctx.hmac_key.ctx_path) {
-        LOG_ERR("Must specify options C.");
-        return tool_rc_option_error;
+    tool_rc rc = check_options(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.hmac_key.ctx_path,
-            ctx.hmac_key.auth_str, &ctx.hmac_key.object, false,
-            TPM2_HANDLE_ALL_W_NV);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid key handle authorization");
         return rc;
     }
 
     /*
-     * if no halg was specified, read the public portion of the key and use it's
-     * scheme
+     * 3. TPM2_CC_<command> call
      */
-    if (!ctx.halg) {
-        TPM2B_PUBLIC *pub = NULL;
-        rc = readpub(ectx, ctx.hmac_key.object.tr_handle, &pub);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-
-        /*
-         * if we're attempting to figure out a hashing scheme, and the scheme is NULL
-         * we default to sha256.
-         */
-        ctx.halg =
-                pub->publicArea.parameters.keyedHashDetail.scheme.details.hmac.hashAlg;
-        if (ctx.halg == TPM2_ALG_NULL) {
-            ctx.halg = TPM2_ALG_SHA256;
-        }
-
-        free(pub);
+    rc = hmac(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return do_hmac_and_output(ectx);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
+    /*
+     * 1. Free objects
+     */
     if (ctx.input && ctx.input != stdin) {
         fclose(ctx.input);
     }
+    free(ctx.hmac_out);
+    free(ctx.validation);
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.hmac_key.object.session);
 
-    return tpm2_session_close(&ctx.hmac_key.object.session);
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("hmac", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("hmac", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_import.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_import.c Changed

@@ -23,14 +23,12 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include <tss2/tss2_mu.h>
-
 #include <openssl/rand.h>
+#include <tss2/tss2_mu.h>
 
 #include "files.h"
 #include "log.h"
 #include "tpm2.h"
-#include "tpm2_tool.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_attr_util.h"
 #include "tpm2_auth_util.h"
@@ -38,9 +36,17 @@
 #include "tpm2_identity_util.h"
 #include "tpm2_openssl.h"
 #include "tpm2_options.h"
+#include "tpm2_policy.h"
+#include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_import_ctx tpm_import_ctx;
 struct tpm_import_ctx {
+    /*
+     * Inputs
+     */
+
+    /* common */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -48,650 +54,666 @@
     } parent;
 
     char *input_key_file;
-    char *public_key_file;
-    char *private_key_file;
+    char *policy;
+    TPMT_SYM_DEF_OBJECT sym_alg;
+    TPM2B_PRIVATE duplicate;
+    TPM2B_DATA enc_sensitive_key;
+    TPM2B_ENCRYPTED_SECRET encrypted_seed;
+    /* SSL */
     char *parent_key_public_file;
     char *name_alg;
-    char *attrs; /* The attributes to use */
+    char *attrs;
     char *key_auth_str;
-    char *auth_key_file; /* an optional auth string for the input key file for OSSL */
+    char *passin;
+    char *object_alg;
+    /* TPM */
     char *input_seed_file;
     char *input_enc_key_file;
-    char *policy;
-    bool import_tpm; /* Any param that is exclusively used by import tpm object sets this flag */
-    TPMI_ALG_PUBLIC key_type;
-    char *cp_hash_path;
+    bool import_tpm;
+
+    /*
+     * Outputs
+     */
+    /* common */
+    char *public_key_file; // TPM input, SSL output
+    TPM2B_PUBLIC public;
+    char *private_key_file;
+    TPM2B_PRIVATE *imported_private;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_import_ctx ctx = {
-    .key_type = TPM2_ALG_ERROR,
-    .input_key_file = NULL,
+    .sym_alg.algorithm = TPM2_ALG_NULL,
+    .enc_sensitive_key = TPM2B_EMPTY_INIT,
+    .public = TPM2B_EMPTY_INIT,
+    .encrypted_seed = TPM2B_EMPTY_INIT,
+    .duplicate = TPM2B_EMPTY_INIT,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tool_rc readpublic(ESYS_CONTEXT *ectx, ESYS_TR handle,
-        TPM2B_PUBLIC **public) {
+static tool_rc import(ESYS_CONTEXT *ectx) {
 
-    return tpm2_readpublic(ectx, handle, public, NULL, NULL);
+    return tpm2_import(ectx, &ctx.parent.object, &ctx.enc_sensitive_key,
+        &ctx.public, &ctx.duplicate, &ctx.encrypted_seed, &ctx.sym_alg,
+        &ctx.imported_private, &ctx.cp_hash, ctx.parameter_hash_algorithm);
 }
 
-static bool create_name(TPM2B_PUBLIC *public, TPM2B_NAME *pubname) {
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
+    UNUSED(ectx);
     /*
-     * A TPM2B_NAME is the name of the algorithm, followed by the hash.
-     * Calculate the name by:
-     * 1. Marshaling the name algorithm
-     * 2. Marshaling the TPMT_PUBLIC past the name algorithm from step 1.
-     * 3. Hash the TPMT_PUBLIC portion in marshaled data.
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
      */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-    TPMI_ALG_HASH name_alg = public->publicArea.nameAlg;
-
-    // Step 1 - set beginning of name to hash alg
-    size_t hash_offset = 0;
-    Tss2_MU_UINT16_Marshal(name_alg, pubname->name, pubname->size,
-            &hash_offset);
-
-    // Step 2 - marshal TPMTP
-    TPMT_PUBLIC marshaled_tpmt;
-    size_t tpmt_marshalled_size = 0;
-    Tss2_MU_TPMT_PUBLIC_Marshal(&public->publicArea,
-            (uint8_t *) &marshaled_tpmt, sizeof(public->publicArea),
-            &tpmt_marshalled_size);
-
-    // Step 3 - Hash the data into name just past the alg type.
-    digester d = tpm2_openssl_halg_to_digester(name_alg);
-    if (!d) {
-        return false;
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
     }
 
-    d((const unsigned char *) &marshaled_tpmt, tpmt_marshalled_size,
-            pubname->name + 2);
-
-    //Set the name size, UINT16 followed by HASH
-    UINT16 hash_size = tpm2_alg_util_get_hash_size(name_alg);
-    pubname->size = hash_size + 2;
-
-    return true;
-}
-
-static void create_import_key_private_data(TPM2B_PRIVATE *private,
-        TPMI_ALG_HASH parent_name_alg,
-        TPM2B_MAX_BUFFER *encrypted_duplicate_sensitive,
-        TPM2B_DIGEST *outer_hmac) {
-
-    //UINT16 hash_size = tpm2_alg_util_get_hash_size(ctx.name_alg);
-    UINT16 parent_hash_size = tpm2_alg_util_get_hash_size(parent_name_alg);
-
-private->size = sizeof(uint16_t) + parent_hash_size
-            + encrypted_duplicate_sensitive->size;
-    size_t hmac_size_offset = 0;
-    Tss2_MU_UINT16_Marshal(parent_hash_size, private->buffer, sizeof(uint16_t),
-            &hmac_size_offset);
-    memcpy(private->buffer + hmac_size_offset, outer_hmac->buffer,
-            parent_hash_size);
-    memcpy(private->buffer + hmac_size_offset + parent_hash_size,
-            encrypted_duplicate_sensitive->buffer,
-            encrypted_duplicate_sensitive->size);
-}
-
-static tool_rc key_import(ESYS_CONTEXT *ectx, TPM2B_PUBLIC *parent_pub,
-        TPM2B_SENSITIVE *privkey, TPM2B_PUBLIC *pubkey,
-        TPM2B_ENCRYPTED_SECRET *encrypted_seed,
-        TPM2B_PRIVATE **imported_private) {
-
-    TPMI_ALG_HASH name_alg = pubkey->publicArea.nameAlg;
-
-    TPM2B_DIGEST *seed = &privkey->sensitiveArea.seedValue;
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
 
     /*
-     * Create the protection encryption key that gets encrypted with the parents public key.
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
      */
-    TPM2B_DATA enc_sensitive_key = {
-        .size = parent_pub->publicArea.parameters.rsaDetail.symmetric.keyBits.sym / 8
-    };
-    memset(enc_sensitive_key.buffer, 0xFF, enc_sensitive_key.size);
+    assert(ctx.imported_private);
+    bool result = files_save_private(ctx.imported_private, ctx.private_key_file);
+    Esys_Free(ctx.imported_private);
+    if (!result) {
+        LOG_ERR("Failed to save private key into file \"%s\"",
+                ctx.private_key_file);
+        return tool_rc_general_error;
+    }
 
     /*
-     * Calculate the object name.
+     * Public information generated for an SSL imported key
      */
-    TPM2B_NAME pubname = TPM2B_TYPE_INIT(TPM2B_NAME, name);
-    bool res = create_name(pubkey, &pubname);
-    if (!res) {
-        return false;
-    }
-
-    TPM2B_MAX_BUFFER hmac_key;
-    TPM2B_MAX_BUFFER enc_key;
-    tpm2_identity_util_calc_outer_integrity_hmac_key_and_dupsensitive_enc_key(
-            parent_pub, &pubname, seed, &hmac_key, &enc_key);
-
-    TPM2B_MAX_BUFFER encrypted_inner_integrity = TPM2B_EMPTY_INIT;
-    tpm2_identity_util_calculate_inner_integrity(name_alg, privkey, &pubname,
-            &enc_sensitive_key,
-            &parent_pub->publicArea.parameters.rsaDetail.symmetric,
-            &encrypted_inner_integrity);
-
-    TPM2B_DIGEST outer_hmac = TPM2B_EMPTY_INIT;
-    TPM2B_MAX_BUFFER encrypted_duplicate_sensitive = TPM2B_EMPTY_INIT;
-    tpm2_identity_util_calculate_outer_integrity(parent_pub->publicArea.nameAlg,
-            &pubname, &encrypted_inner_integrity, &hmac_key, &enc_key,
-            &parent_pub->publicArea.parameters.rsaDetail.symmetric,
-            &encrypted_duplicate_sensitive, &outer_hmac);
-
-    TPM2B_PRIVATE private = TPM2B_EMPTY_INIT;
-    create_import_key_private_data(&private, parent_pub->publicArea.nameAlg,
-            &encrypted_duplicate_sensitive, &outer_hmac);
-
-    TPMT_SYM_DEF_OBJECT *sym_alg =
-            &parent_pub->publicArea.parameters.rsaDetail.symmetric;
-
-    if (!ctx.cp_hash_path) {
-        return tpm2_import(ectx, &ctx.parent.object, &enc_sensitive_key, pubkey,
-            &private, encrypted_seed, sym_alg, imported_private, NULL);
-    }
+    if (!ctx.import_tpm) {
+        is_file_op_success = files_save_public(&ctx.public,
+            ctx.public_key_file);
+        if (!is_file_op_success) {
+            LOG_ERR("Failed to save TPM2B_PUBLIC for the input SSL key");
+            return tool_rc_general_error;
+        }
 
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    tool_rc rc = tpm2_import(ectx, &ctx.parent.object, &enc_sensitive_key, pubkey,
-            &private, encrypted_seed, sym_alg, imported_private, &cp_hash);
-    if (rc != tool_rc_success) {
-        return rc;
+        tpm2_util_public_to_yaml(&ctx.public, 0);
     }
 
-    bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
-    }
-    return rc;
+    return tool_rc_success;
 }
 
-static bool on_option(char key, char *value) {
+static bool create_import_key_private_data(TPMI_ALG_HASH parent_name_alg,
+    TPM2B_MAX_BUFFER *encrypted_duplicate_sensitive, TPM2B_DIGEST *outer_hmac) {
 
-    switch (key) {
-    case 'P':
-        ctx.parent.auth_str = value;
-        break;
-    case 'p':
-        ctx.key_auth_str = value;
-        break;
-    case 'G':
-        ctx.key_type = tpm2_alg_util_from_optarg(value,
-                tpm2_alg_util_flags_asymmetric | tpm2_alg_util_flags_symmetric);
-        if (ctx.key_type == TPM2_ALG_ERROR) {
-            LOG_ERR("Unsupported key type");
-            return false;
-        }
-        return true;
-    case 'i':
-        ctx.input_key_file = value;
-        break;
-    case 'C':
-        ctx.parent.ctx_path = value;
-        break;
-    case 'U':
-        ctx.parent_key_public_file = value;
-        break;
-    case 'k':
-        ctx.import_tpm = true;
-        ctx.input_enc_key_file = value;
-        break;
-    case 'u':
-        ctx.public_key_file = value;
-        break;
-    case 'r':
-        ctx.private_key_file = value;
-        break;
-    case 'a':
-        ctx.attrs = value;
-        break;
-    case 'g':
-        ctx.name_alg = value;
-        break;
-    case 's':
-        ctx.import_tpm = true;
-        ctx.input_seed_file = value;
-        break;
-    case 'L':
-        ctx.policy = value;
-        break;
-    case 0:
-        ctx.auth_key_file = value;
-        break;
-    case 1:
-        ctx.cp_hash_path = value;
-        break;
-    default:
-        LOG_ERR("Invalid option");
+    UINT16 parent_hash_size = tpm2_alg_util_get_hash_size(parent_name_alg);
+    ctx.duplicate.size = sizeof(parent_hash_size) + parent_hash_size +
+        encrypted_duplicate_sensitive->size;
+
+    size_t hmac_size_offset = 0;
+    TSS2_RC rval = Tss2_MU_UINT16_Marshal(parent_hash_size,
+        ctx.duplicate.buffer, sizeof(parent_hash_size), &hmac_size_offset);
+    if (rval != TPM2_RC_SUCCESS) {
+        LOG_ERR("Error serializing parent hash size");
         return false;
     }
 
-    return true;
-}
+    memcpy(ctx.duplicate.buffer + hmac_size_offset, outer_hmac->buffer,
+        parent_hash_size);
+    memcpy(ctx.duplicate.buffer + hmac_size_offset + parent_hash_size,
+        encrypted_duplicate_sensitive->buffer,
+        encrypted_duplicate_sensitive->size);
 
-static bool tpm2_tool_onstart(tpm2_options **opts) {
-
-    const struct option topts = {
-      { "parent-auth",        required_argument, NULL, 'P'},
-      { "key-auth",           required_argument, NULL, 'p'},
-      { "key-algorithm",      required_argument, NULL, 'G'},
-      { "input",              required_argument, NULL, 'i'},
-      { "parent-context",     required_argument, NULL, 'C'},
-      { "parent-public",      required_argument, NULL, 'U'},
-      { "private",            required_argument, NULL, 'r'},
-      { "public",             required_argument, NULL, 'u'},
-      { "attributes",  required_argument, NULL, 'a'},
-      { "hash-algorithm",     required_argument, NULL, 'g'},
-      { "seed",               required_argument, NULL, 's'},
-      { "policy",             required_argument, NULL, 'L'},
-      { "encryption-key",     required_argument, NULL, 'k'},
-      { "passin",             required_argument, NULL,  0 },
-      { "cphash",             required_argument, NULL,  1 },
-    };
-
-    *opts = tpm2_options_new("P:p:G:i:C:U:u:r:a:g:s:L:k:", ARRAY_LEN(topts),
-            topts, on_option, NULL, 0);
-
-    return *opts != NULL;
+    return true;
 }
 
-/**
- * Check all options and report as many errors as possible via LOG_ERR.
- * @return
- *  tool_rc indicating error.
- */
-static tool_rc check_options(void) {
+static void setup_default_attrs(TPMA_OBJECT *attrs, bool has_policy,
+    bool has_auth) {
 
-    tool_rc rc = tool_rc_success;
+    /* Handle Default Setup */
+    *attrs = DEFAULT_CREATE_ATTRS;
 
-    /* Check the tpm import specific options */
-    if (ctx.import_tpm) {
-        if (!ctx.input_seed_file) {
-            LOG_ERR("Expected SymSeed to be specified via \"-s\","
-                    " missing option.");
-            rc = tool_rc_option_error;
-        }
-
-        /* If a key file is specified we choose aes else null
-         for symmetricAlgdefinition */
-        if (!ctx.input_enc_key_file) {
-            ctx.key_type = TPM2_ALG_NULL;
-        } else {
-            ctx.key_type = TPM2_ALG_AES;
-        }
-
-    } else { /* Openssl specific option(s) */
-
-        if (!ctx.key_type) {
-            LOG_ERR("Expected key type to be specified via \"-G\","
-                    " missing option.");
-            rc = tool_rc_option_error;
-        }
-
-        if (ctx.cp_hash_path) {
-            LOG_WARN("CAUTION CpHash calculation includes parameters that"
-                     "have a derived/random seed!");
-        }
-    }
-
-    /* Common options */
-    if (!ctx.input_key_file) {
-        LOG_ERR("Expected to be imported key data to be specified via \"-i\","
-                " missing option.");
-        rc = tool_rc_option_error;
-    }
-
-    if (!ctx.public_key_file) {
-        LOG_ERR("Expected output public file missing, specify \"-u\","
-                " missing option.");
-        rc = tool_rc_option_error;
-    }
+    /* imported objects arn't created inside of the TPM so this gets turned down */
+    *attrs &= ~TPMA_OBJECT_SENSITIVEDATAORIGIN;
+    *attrs &= ~TPMA_OBJECT_FIXEDTPM;
+    *attrs &= ~TPMA_OBJECT_FIXEDPARENT;
 
-    if (!ctx.private_key_file) {
-        LOG_ERR("Expected output private file missing, specify \"-r\","
-                " missing option.");
-        rc = tool_rc_option_error;
+    /* The default for a keyedhash object with no scheme is just for sealing */
+    if (!strcmp("keyedhash", ctx.object_alg)) {
+        *attrs &= ~TPMA_OBJECT_SIGN_ENCRYPT;
+        *attrs &= ~TPMA_OBJECT_DECRYPT;
+    } else if (!strncmp("hmac", ctx.object_alg, 4)) {
+        *attrs &= ~TPMA_OBJECT_DECRYPT;
     }
 
-    if (!ctx.parent.ctx_path) {
-        LOG_ERR("Expected parent key to be specified via \"-C\","
-                " missing option.");
-        rc = tool_rc_option_error;
+    /*
+     * IMPORTANT: if the object we're creating has a policy and NO authvalue, turn off userwith auth
+     * so empty passwords don't work on the object.
+     */
+    if (has_policy && !has_auth) {
+        *attrs &= ~TPMA_OBJECT_USERWITHAUTH;
     }
-
-    return rc;
 }
 
-static tool_rc openssl_import(ESYS_CONTEXT *ectx) {
-
-    bool free_ppub = false;
-    tool_rc rc = tool_rc_general_error;
+static tool_rc process_input_ossl_import(ESYS_CONTEXT *ectx) {
 
     /*
      * Load the parent public file, or read it from the TPM if not specified.
      * We need this information for encrypting the protection seed.
      */
-    tool_rc tmp_rc;
+    bool free_ppub = false;
     TPM2B_PUBLIC ppub = TPM2B_EMPTY_INIT;
-    TPM2B_PUBLIC *parent_pub = NULL;
-
-    bool result;
-    tmp_rc = tool_rc_general_error;
+    TPM2B_PUBLIC *parent_pub = 0;
+    bool is_file_op_success = true;
+    tool_rc rc = tool_rc_success;
     if (ctx.parent_key_public_file) {
-        result = files_load_public(ctx.parent_key_public_file, &ppub);
+        is_file_op_success = files_load_public(ctx.parent_key_public_file,
+            &ppub);
         parent_pub = &ppub;
     } else {
-        tmp_rc = readpublic(ectx, ctx.parent.object.tr_handle, &parent_pub);
+        rc = tpm2_readpublic(ectx, ctx.parent.object.tr_handle, &parent_pub,
+            0, 0);
         free_ppub = true;
-        result = tmp_rc == tool_rc_success;
     }
-    if (!result) {
+
+    if (!is_file_op_success || rc != tool_rc_success) {
         LOG_ERR("Failed loading parent key public.");
-        return tmp_rc;
+        goto out;
     }
 
-    TPMA_OBJECT attrs = TPMA_OBJECT_DECRYPT | TPMA_OBJECT_SIGN_ENCRYPT;
-
-    TPM2B_PUBLIC public = {
-        .size = 0,
-        .publicArea = {
-            .nameAlg = TPM2_ALG_SHA256,
-        },
-    };
+    /*
+     * Following is the reference from Table 41 of TPM Specifications Part 3 and
+     * is used to construct a duplication wrapper on an ssl key
+     *
+     * 1. encryptionKey - Generate(ossl-RAND)
+     * 2. objectPublic  - Derive-from-private(ossl) and add attrs
+     * 3. duplicate - Generate(ossl)
+     *                  - InnerWrapper
+     *                      - innerIntegrity ≔ HnameAlg (sensitive || name) (37)
+     *                          - encSensitive ≔ CFBpSymAlg (symKey, 0, innerIntegrity || sensitive) (38)
+     *                              - symKey = `encryptionKey` parameter in TPM2_Duplicate() or a value from the RNG in step 1
+     *                  - OuterWrapper
+     *                      - dupSensitive ≔ CFBnpSymAlg (symKey, 0, encSensitive) (41)
+     *                          - symKey ≔ KDFa (npNameAlg, seed, “STORAGE”, Name, 0 , bits) (40)
+     *                              - seed is from the sensitive structure in (37) (38)
+     *                      - outerHMAC ≔ HMACnpNameAlg (HMACkey, dupSensitive || Name) (43)
+     *                          - HMACkey ≔ KDFa (npNameAlg, seed, “INTEGRITY”, 0, 0, bits) (42)
+     *                              - seed is from the sensitive structure in (37) (38)
+     * 4. inSymSeed = seed in (37) (38) from private->sensitive or RNG. -> ctx.encrypted_seed
+     * 5. symmetricAlg
+     */
 
-    if (ctx.policy) {
-        public.publicArea.authPolicy.size = sizeof(public.publicArea.authPolicy.buffer);
-        result = files_load_bytes_from_path(ctx.policy,
-            public.publicArea.authPolicy.buffer,
-                &public.publicArea.authPolicy.size);
-        if (!result) {
-            return tool_rc_general_error;
-        }
-    } else {
-        attrs |= TPMA_OBJECT_USERWITHAUTH;
+    /* encryptionKey */
+    /*
+     * Create the protection encryption key that gets encrypted with the parents
+     * public key.
+     */
+    ctx.enc_sensitive_key.size =
+        parent_pub->publicArea.parameters.rsaDetail.symmetric.keyBits.sym / 8;
+    if(ctx.enc_sensitive_key.size < 16) {
+        LOG_ERR("Calculated wrapping keysize is less than 16 bytes, got: %u",
+            ctx.enc_sensitive_key.size);
+        rc = tool_rc_general_error;
+        goto out;
     }
 
-    TPM2B_SENSITIVE private = TPM2B_EMPTY_INIT;
-
-    if (ctx.key_auth_str) {
-        tpm2_session *tmp;
-        tmp_rc = tpm2_auth_util_from_optarg(NULL, ctx.key_auth_str, &tmp, true);
-        if (tmp_rc != tool_rc_success) {
-            LOG_ERR("Invalid key authorization");
-            return tmp_rc;
-        }
-
-        const TPM2B_AUTH *auth = tpm2_session_get_auth_value(tmp);
-        private.sensitiveArea.authValue = *auth;
-
-        tpm2_session_close(&tmp);
+    int ossl_rc = RAND_bytes(ctx.enc_sensitive_key.buffer,
+        ctx.enc_sensitive_key.size);
+    if (ossl_rc != 1) {
+        LOG_ERR("RAND_bytes failed: %s", ERR_error_string(ERR_get_error(), 0));
+        rc = tool_rc_general_error;
+        goto out;
     }
 
+    /* objectPublic */
     /*
-     * Set the object attributes if specified, overwriting the defaults, but hooking the errata
-     * fixups.
+     * start with the tools default set and turn off the ones that don't make sense
+     * If the user specified their own values, tpm2_alg_util_public_init will use that,
+     * so this is just the default case.
+     * */
+    TPMA_OBJECT attrs = 0;
+    if (!ctx.attrs) {
+        setup_default_attrs(&attrs, !!ctx.policy, !!ctx.key_auth_str);
+    }
+    /*
+     * Backwards Compat: the tool sets name-alg by default to the parent name alg if not specified
+     * but the tpm2_alg_util_public_init defaults to sha256. Specify the alg if not specified.
      */
-    if (ctx.attrs) {
-        TPMA_OBJECT *obj_attrs = &public.publicArea.objectAttributes;
-        result = tpm2_attr_util_obj_from_optarg(ctx.attrs, obj_attrs);
-        if (!result) {
-            LOG_ERR("Invalid object attribute, got\"%s\"", ctx.attrs);
-            return tool_rc_general_error;
+    if (!ctx.name_alg) {
+        ctx.name_alg = (char *)tpm2_alg_util_algtostr(
+            parent_pub->publicArea.nameAlg, tpm2_alg_util_flags_hash);
+        if (!ctx.name_alg) {
+            LOG_ERR("Invalid parent name algorithm, got 0x%x",
+                    parent_pub->publicArea.nameAlg);
+            rc = tool_rc_general_error;
+            goto out;
         }
-
-        tpm2_errata_fixup(SPEC_116_ERRATA_2_7,
-                &public.publicArea.objectAttributes);
-    } else {
-        public.publicArea.objectAttributes = attrs;
     }
 
-    if (ctx.name_alg) {
-        TPMI_ALG_HASH alg = tpm2_alg_util_from_optarg(ctx.name_alg,
-                tpm2_alg_util_flags_hash);
-        if (alg == TPM2_ALG_ERROR) {
-            LOG_ERR("Invalid name hashing algorithm, got\"%s\"", ctx.name_alg);
-            return tool_rc_general_error;
-        }
-        public.publicArea.nameAlg = alg;
-    } else {
-        /*
-         * use the parent name algorithm if not specified
-         */
-    public.publicArea.nameAlg = parent_pub->publicArea.nameAlg;
+    TPM2B_PUBLIC template = { 0 };
+    rc = tpm2_alg_util_public_init(ctx.object_alg, ctx.name_alg,
+        ctx.attrs, ctx.policy, attrs, &template);
+    if (rc != tool_rc_success) {
+        goto out;
     }
 
+    TPM2B_SENSITIVE private_sensitive = TPM2B_EMPTY_INIT;
     /*
-     * The TPM Requires that the name algorithm for the child be less than the name
-     * algorithm of the parent when the parent's scheme is NULL.
-     *
-     * This check can be seen in the simulator at:
-     *   - File: CryptUtil.c
-     *   - Func: CryptSecretDecrypt()
-     *   - Line: 2019
-     *   - Decription: Limits the size of the hash algorithm to less then the parent's name-alg when scheme is NULL.
+     * This call also generates a seed, places it in TPM2B_SENSITIVE and returns
+     * it in ctx.encrypted_seed
      */
-    UINT16 hash_size = tpm2_alg_util_get_hash_size(public.publicArea.nameAlg);
-    UINT16 parent_hash_size = tpm2_alg_util_get_hash_size(
-            parent_pub->publicArea.nameAlg);
-    if (hash_size > parent_hash_size) {
-        LOG_WARN("Hash selected is larger then parent hash size, coercing to "
-                 "parent hash algorithm: %s",
-                tpm2_alg_util_algtostr(parent_pub->publicArea.nameAlg,
-                        tpm2_alg_util_flags_hash));
-    public.publicArea.nameAlg = parent_pub->publicArea.nameAlg;
+    /* inSymSeed */
+    bool result = tpm2_openssl_import_keys(parent_pub, &ctx.encrypted_seed,
+        ctx.key_auth_str, ctx.input_key_file, ctx.passin, &template,
+        &private_sensitive, &ctx.public);
+    if (!result) {
+        rc = tool_rc_general_error;
+        goto out;
     }
 
+    /* duplicate */
     /*
-     * Generate and encrypt seed
+     * Calculate the object name.
      */
-    TPM2B_DIGEST *seed = &private.sensitiveArea.seedValue;
-    TPM2B_ENCRYPTED_SECRET encrypted_seed = TPM2B_EMPTY_INIT;
-    unsigned char label10 = { 'D', 'U', 'P', 'L', 'I', 'C', 'A', 'T', 'E', 0 };
-    bool res;
-    res = tpm2_identity_util_share_secret_with_public_key(seed, parent_pub,
-            label, 10, &encrypted_seed);
-    if (!res) {
-        LOG_ERR("Failed Seed Encryption\n");
+    TPM2B_NAME pubname = TPM2B_TYPE_INIT(TPM2B_NAME, name);
+    result = tpm2_identity_create_name(&ctx.public, &pubname);
+    if (!result) {
+        rc = tool_rc_general_error;
         goto out;
     }
 
+    TPM2B_MAX_BUFFER hmac_key;
+    TPM2B_MAX_BUFFER enc_key;
     /*
-     * Populate all the private and public data fields we can based on the key type and the PEM files read in.
+     * Here seed is pointing to the plaintext or unencrypted ctx.encrypted_seed
      */
-    tpm2_openssl_load_rc status = tpm2_openssl_load_private(ctx.input_key_file,
-            ctx.auth_key_file, ctx.key_type, &public, &private);
-    if (status == lprc_error) {
+    TPM2B_DIGEST *seed = &private_sensitive.sensitiveArea.seedValue;
+    result = tpm2_identity_util_calc_outer_integrity_hmac_key_and_dupsensitive_enc_key(
+        parent_pub, &pubname, seed, &hmac_key, &enc_key);
+    if (!result) {
+        rc = tool_rc_general_error;
         goto out;
     }
 
-    if (!tpm2_openssl_did_load_public(status)) {
-        LOG_ERR("Did not find public key information in file: \"%s\"",
-                ctx.input_key_file);
+    TPM2B_MAX_BUFFER encrypted_inner_integrity = TPM2B_EMPTY_INIT;
+    TPMI_ALG_HASH name_alg = ctx.public.publicArea.nameAlg;
+    result = tpm2_identity_util_calculate_inner_integrity(name_alg, &private_sensitive,
+        &pubname, &ctx.enc_sensitive_key,
+        &parent_pub->publicArea.parameters.rsaDetail.symmetric,
+        &encrypted_inner_integrity);
+    if (!result) {
+        rc = tool_rc_general_error;
         goto out;
     }
 
-    TPM2B_PRIVATE *imported_private = NULL;
-    tmp_rc = key_import(ectx, parent_pub, &private, &public, &encrypted_seed,
-            &imported_private);
-    if (tmp_rc != tool_rc_success || ctx.cp_hash_path) {
-        rc = tmp_rc;
-        goto keyout;
-    }
-
-    /*
-     * Save the public and imported_private structure to disk
-     */
-    res = files_save_public(&public, ctx.public_key_file);
-    if (!res) {
-        goto keyout;
-    }
+    TPM2B_DIGEST outer_hmac = TPM2B_EMPTY_INIT;
+    TPM2B_MAX_BUFFER encrypted_duplicate_sensitive = TPM2B_EMPTY_INIT;
+    tpm2_identity_util_calculate_outer_integrity(parent_pub->publicArea.nameAlg,
+        &pubname, &encrypted_inner_integrity, &hmac_key, &enc_key,
+        &parent_pub->publicArea.parameters.rsaDetail.symmetric,
+        &encrypted_duplicate_sensitive, &outer_hmac);
 
-    res = files_save_private(imported_private, ctx.private_key_file);
-    if (!res) {
-        goto keyout;
+    result = create_import_key_private_data(parent_pub->publicArea.nameAlg,
+        &encrypted_duplicate_sensitive, &outer_hmac);
+    if (!result) {
+        rc = tool_rc_general_error;
+        goto out;
     }
 
-    /*
-     * Output the stats on the created object on Success.
-     */
-    tpm2_util_public_to_yaml(&public, NULL);
-
-    rc = tool_rc_success;
+    /* symmetricAlg */
+    ctx.sym_alg = parent_pub->publicArea.parameters.rsaDetail.symmetric;
 
-keyout:
-    free(imported_private);
 out:
     if (free_ppub) {
-        free(parent_pub);
+        Esys_Free(parent_pub);
     }
 
     return rc;
 }
 
-static bool set_key_algorithm(TPMI_ALG_PUBLIC alg, TPMT_SYM_DEF_OBJECT * obj) {
-    bool result = true;
-    switch (alg) {
-    case TPM2_ALG_AES:
-        obj->algorithm = TPM2_ALG_AES;
-        obj->keyBits.aes = 128;
-        obj->mode.aes = TPM2_ALG_CFB;
-        break;
-    case TPM2_ALG_NULL:
-        obj->algorithm = TPM2_ALG_NULL;
-        break;
-    default:
-        LOG_ERR("The algorithm type input(0x%x) is not supported!", alg);
-        result = false;
-        break;
-    }
-    return result;
-}
+static tool_rc process_input_tpm_import(void) {
 
-static tool_rc tpm_import(ESYS_CONTEXT *ectx) {
-
-    TPM2B_DATA enc_key = TPM2B_EMPTY_INIT;
-    TPM2B_PUBLIC public = TPM2B_EMPTY_INIT;
-    TPM2B_PRIVATE duplicate;
-    TPM2B_ENCRYPTED_SECRET encrypted_seed;
-    TPM2B_PRIVATE *imported_private = NULL;
-    TPMT_SYM_DEF_OBJECT sym_alg;
-
-    tool_rc rc;
-    bool result = set_key_algorithm(ctx.key_type, &sym_alg);
-    if (!result) {
-        return tool_rc_general_error;
-    }
+    /*
+     * Following is the reference from Table 41 of TPM Specifications Part 3 and
+     * is used to construct a duplication wrapper on a tpm key
+     *
+     * 1. encryptionKey - Load(tpm-duplicate) -> `k` -> ctx.enc_sensitive_key
+     * 2. objectPublic  - Load(tpm-duplicate) -> `u` -> ctx.public
+     * 3. duplicate     - Load(tpm-duplicate) -> `i` -> ctx.duplicate
+     * 4. inSymSeed     - Load(tpm-duplicate) -> `s` -> ctx.encrypted_seed
+     * 5. symmetricAlg  - Read from parent objectPublic -> ctx.sym_alg
+     */
 
-    /* Symmetric key */
+    /* encryptionKey */
     if (ctx.input_enc_key_file) {
-        enc_key.size = 16;
-        result = files_load_bytes_from_path(ctx.input_enc_key_file,
-                enc_key.buffer, &enc_key.size);
+        ctx.enc_sensitive_key.size = 16;
+        bool result = files_load_bytes_from_path(ctx.input_enc_key_file,
+            ctx.enc_sensitive_key.buffer, &ctx.enc_sensitive_key.size);
         if (!result) {
             LOG_ERR("Failed to load symmetric encryption key\"%s\"",
-                    ctx.input_enc_key_file);
+                ctx.input_enc_key_file);
             return tool_rc_general_error;
         }
-        if (enc_key.size != 16) {
+        if (ctx.enc_sensitive_key.size != 16) {
             LOG_ERR("Invalid AES key size, got %u bytes, expected 16",
-                    enc_key.size);
+                    ctx.enc_sensitive_key.size);
             return tool_rc_general_error;
         }
+
+        /* symmetricAlg */
+        ctx.sym_alg.algorithm = TPM2_ALG_AES;
+        ctx.sym_alg.keyBits.aes = 128;
+        ctx.sym_alg.mode.aes = TPM2_ALG_CFB;
     }
 
-    /* Private key */
-    result = files_load_private(ctx.input_key_file, &duplicate);
+    /* duplicate or the to-be-imported-wrapped-key */
+    bool result = files_load_private(ctx.input_key_file, &ctx.duplicate);
     if (!result) {
         LOG_ERR("Failed to load duplicate \"%s\"", ctx.input_key_file);
         return tool_rc_general_error;
     }
 
-    /* Encrypted seed */
-    result = files_load_encrypted_seed(ctx.input_seed_file, &encrypted_seed);
+    /* inSymSeed */
+    result = files_load_encrypted_seed(ctx.input_seed_file,
+        &ctx.encrypted_seed);
     if (!result) {
         LOG_ERR("Failed to load encrypted seed \"%s\"", ctx.input_seed_file);
         return tool_rc_general_error;
     }
 
-    /* Public key */
-    result = files_load_public(ctx.public_key_file, &public);
+    /* objectPublic */
+    result = files_load_public(ctx.public_key_file, &ctx.public);
     if (!result) {
         LOG_ERR(":( Failed to load public key \"%s\"", ctx.public_key_file);
         return tool_rc_general_error;
     }
 
     if (ctx.policy) {
-        public.publicArea.authPolicy.size =
-            sizeof(public.publicArea.authPolicy.buffer);
-        result = files_load_bytes_from_path(ctx.policy,
-        public.publicArea.authPolicy.buffer,
-        &public.publicArea.authPolicy.size);
-        if (!result) {
-            LOG_ERR("Failed to copy over the auth policy to the public data");
-            return tool_rc_general_error;
-        }
-    }
-
-    if (!ctx.cp_hash_path) {
-        rc = tpm2_import(ectx, &ctx.parent.object, &enc_key, &public, &duplicate,
-            &encrypted_seed, &sym_alg, &imported_private, NULL);
+        tool_rc rc = tpm2_policy_set_digest(ctx.policy,
+                &ctx.public.publicArea.authPolicy);
         if (rc != tool_rc_success) {
             return rc;
         }
+    }
 
-        assert(imported_private);
+    return tool_rc_success;
+}
 
-        result = files_save_private(imported_private, ctx.private_key_file);
-        free(imported_private);
-        if (!result) {
-            LOG_ERR("Failed to save private key into file \"%s\"",
-                    ctx.private_key_file);
-            return tool_rc_general_error;
-        }
-        return tool_rc_success;
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.parent.ctx_path,
+        ctx.parent.auth_str, &ctx.parent.object, false, TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid parent key authorization");
+        return rc;
     }
 
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = tpm2_import(ectx, &ctx.parent.object, &enc_key, &public, &duplicate,
-            &encrypted_seed, &sym_alg, &imported_private, &cp_hash);
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * tpm_import:  Import key that was generated with tpm2_duplicate.
+     *              Load tss-public & tss-private.
+     * ossl_import: Import key generated with ossl.
+     *              Generate tss-public & tss-duplicate.
+     */
+    rc = ctx.import_tpm ?
+        process_input_tpm_import() : process_input_ossl_import(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.parent.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    tool_rc rc = tool_rc_success;
+    /* Check the tpm import specific options */
+    if (ctx.import_tpm) {
+        if (!ctx.input_seed_file) {
+            LOG_ERR("Expected SymSeed to be specified via \"-s\","
+                    " missing option.");
+            rc = tool_rc_option_error;
+        }
+
+        if (ctx.key_auth_str) {
+            LOG_ERR("Cannot specify key password when importing a TPM key.\n"
+                    "use tpm2_changeauth after import");
+            rc = tool_rc_option_error;
+        }
     }
+
+    /* Openssl specific option(s) */
+    if (!ctx.import_tpm) {
+        if (!ctx.object_alg) {
+            LOG_ERR("Expected object type to be specified via \"-G\","
+                    " missing option.");
+            rc = tool_rc_option_error;
+        }
+
+        if (ctx.cp_hash_path) {
+            LOG_WARN("CAUTION CpHash calculation includes parameters that"
+                     "have a derived/random seed!");
+        }
+    }
+
+    /* Common options */
+    if (!ctx.input_key_file) {
+        LOG_ERR("Expected to be imported key data to be specified via \"-i\","
+                " missing option.");
+        rc = tool_rc_option_error;
+    }
+
+    if (!ctx.public_key_file) {
+        LOG_ERR("Expected output public file missing, specify \"-u\","
+                " missing option.");
+        rc = tool_rc_option_error;
+    }
+
+    if (!ctx.private_key_file) {
+        LOG_ERR("Expected output private file missing, specify \"-r\","
+                " missing option.");
+        rc = tool_rc_option_error;
+    }
+
+    if (!ctx.parent.ctx_path) {
+        LOG_ERR("Expected parent key to be specified via \"-C\","
+                " missing option.");
+        rc = tool_rc_option_error;
+    }
+
     return rc;
+}
+
+static bool on_option(char key, char *value) {
 
+    switch (key) {
+    case 'P':
+        ctx.parent.auth_str = value;
+        break;
+    case 'p':
+        ctx.key_auth_str = value;
+        break;
+    case 'G':
+        ctx.object_alg = value;
+        return true;
+    case 'i':
+        ctx.input_key_file = value;
+        break;
+    case 'C':
+        ctx.parent.ctx_path = value;
+        break;
+    case 'U':
+        ctx.parent_key_public_file = value;
+        break;
+    case 'k':
+        ctx.import_tpm = true;
+        ctx.input_enc_key_file = value;
+        break;
+    case 'u':
+        ctx.public_key_file = value;
+        break;
+    case 'r':
+        ctx.private_key_file = value;
+        break;
+    case 'a':
+        ctx.attrs = value;
+        break;
+    case 'g':
+        ctx.name_alg = value;
+        break;
+    case 's':
+        ctx.import_tpm = true;
+        ctx.input_seed_file = value;
+        break;
+    case 'L':
+        ctx.policy = value;
+        break;
+    case 0:
+        ctx.passin = value;
+        break;
+    case 1:
+        ctx.cp_hash_path = value;
+        break;
+    default:
+        LOG_ERR("Invalid option");
+        return false;
+    }
+
+    return true;
+}
+
+static bool tpm2_tool_onstart(tpm2_options **opts) {
+
+    const struct option topts = {
+      { "parent-auth",        required_argument, 0, 'P'},
+      { "key-auth",           required_argument, 0, 'p'},
+      { "key-algorithm",      required_argument, 0, 'G'},
+      { "input",              required_argument, 0, 'i'},
+      { "parent-context",     required_argument, 0, 'C'},
+      { "parent-public",      required_argument, 0, 'U'},
+      { "private",            required_argument, 0, 'r'},
+      { "public",             required_argument, 0, 'u'},
+      { "attributes",         required_argument, 0, 'a'},
+      { "hash-algorithm",     required_argument, 0, 'g'},
+      { "seed",               required_argument, 0, 's'},
+      { "policy",             required_argument, 0, 'L'},
+      { "encryption-key",     required_argument, 0, 'k'},
+      { "passin",             required_argument, 0,  0 },
+      { "cphash",             required_argument, 0,  1 },
+    };
+
+    *opts = tpm2_options_new("P:p:G:i:C:U:u:r:a:g:s:L:k:", ARRAY_LEN(topts),
+        topts, on_option, 0, 0);
+
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+
     UNUSED(flags);
 
-    tool_rc rc = check_options();
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    rc = tpm2_util_object_load_auth(ectx, ctx.parent.ctx_path,
-            ctx.parent.auth_str, &ctx.parent.object, false,
-            TPM2_HANDLE_ALL_W_NV);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = import(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid parent key authorization");
         return rc;
     }
 
-    return ctx.import_tpm ? tpm_import(ectx) : openssl_import(ectx);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    if (!ctx.import_tpm) {
-        return tool_rc_success;
-    }
+    /*
+     * 1. Free objects
+     */
 
-    return tpm2_session_close(&ctx.parent.object.session);
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.parent.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("import", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("import", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_load.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_load.c Changed

@@ -8,8 +8,13 @@
 #include "tpm2_options.h"
 #include "tpm2_tool.h"
 
-typedef struct tpm_load_ctx tpm_load_ctx;
-struct tpm_load_ctx {
+#define MAX_SESSIONS 3
+
+typedef struct tpm_tool_ctx tpm_load_ctx;
+struct tpm_tool_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -24,76 +29,219 @@
         ESYS_TR handle;
     } object;
 
+    bool is_tss_pem;
+
+    /*
+     * Outputs
+     */
     const char *namepath;
     const char *contextpath;
-    char *cp_hash_path;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
-static tpm_load_ctx ctx;
+static tpm_load_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+};
 
-static bool on_option(char key, char *value) {
+static tool_rc load(ESYS_CONTEXT *ectx) {
 
-    switch (key) {
-    case 'P':
-        ctx.parent.auth_str = value;
-        break;
-    case 'u':
-        ctx.object.pubpath = value;
-        break;
-    case 'r':
-        ctx.object.privpath = value;
-        break;
-    case 'n':
-        ctx.namepath = value;
-        break;
-    case 'C':
-        ctx.parent.ctx_path = value;
-        break;
-    case 'c':
-        ctx.contextpath = value;
-        break;
-    case 0:
-        ctx.cp_hash_path = value;
-        break;
+    /*
+     * If a tssprivkey was specified, load the private and public from the
+     * parsed TSSPEM file.
+     */
+    TPM2B_PRIVATE *to_load_priv =
+        ctx.is_tss_pem ? &tpm2_util_object_tsspem_priv : &ctx.object.private;
+
+    TPM2B_PUBLIC *to_load_pub =
+        ctx.is_tss_pem ? &tpm2_util_object_tsspem_pub : &ctx.object.public;
+
+    return tpm2_load(ectx, &ctx.parent.object, to_load_priv, to_load_pub,
+        &ctx.object.handle, &ctx.cp_hash, ctx.parameter_hash_algorithm);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
     }
 
-    return true;
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    TPM2B_NAME *name;
+    rc = tpm2_tr_get_name(ectx, ctx.object.handle, &name);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    if (ctx.namepath) {
+        bool result = files_save_bytes_to_file(ctx.namepath, name->name,
+                name->size);
+        free(name);
+        if (!result) {
+            return tool_rc_general_error;
+        }
+    } else {
+        tpm2_tool_output("name: ");
+        tpm2_util_print_tpm2b(name);
+        tpm2_tool_output("\n");
+        free(name);
+    }
+
+    return files_save_tpm_context_to_path(ectx, ctx.object.handle,
+            ctx.contextpath);
 }
 
-static bool tpm2_tool_onstart(tpm2_options **opts) {
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
-    const struct option topts = {
-      { "auth",           required_argument, NULL, 'P' },
-      { "public",         required_argument, NULL, 'u' },
-      { "private",        required_argument, NULL, 'r' },
-      { "name",           required_argument, NULL, 'n' },
-      { "key-context",    required_argument, NULL, 'c' },
-      { "parent-context", required_argument, NULL, 'C' },
-      { "cphash",         required_argument, NULL,  0  },
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /*
+     * If a TSS PEM file has been specified, we try to load the tssprivkey
+     * specified with -r, --private option and parse the parent information
+     * from the TSS PEM file.
+     */
+    const char *objectstr =
+        ctx.is_tss_pem ? ctx.object.privpath : ctx.parent.ctx_path;
+    /*
+     * Note: The authvalue of the parent object when loading the TSS PEM file
+     *       is assumed to be NULL per the tssprivkey format.
+     */
+    const char *auth =
+        ctx.is_tss_pem ? 0 : ctx.parent.auth_str;
+    /*
+     * Either parent information is explicitly specified OR is parsed from the
+     * tssprivkey, the parent object is always loaded.
+     */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, objectstr, auth,
+        &ctx.parent.object, false, TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    bool is_not_tss_pem = (ctx.is_tss_pem == false);
+    if (is_not_tss_pem) {
+        bool is_file_op_success;
+        is_file_op_success = files_load_public(ctx.object.pubpath,
+            &ctx.object.public);
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    
+        is_file_op_success = files_load_private(ctx.object.privpath,
+            &ctx.object.private);
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    /*
+     * If a valid TSS PEM/ tssprivkey has been loaded in 1.b above, then:
+     * 1. The TPM2B_PUBLIC and TPM2B_PRIVATE shoud have been parsed,
+     * 2. The structures must have the key data.
+     */
+    if (ctx.is_tss_pem) {
+        if (!tpm2_util_object_tsspem_priv.size ||
+            !tpm2_util_object_tsspem_pub.size) {
+                LOG_ERR("Invalid public and private in TSS PEM");
+                return tool_rc_general_error;
+            }
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.parent.object.session,
+        0,
+        0
     };
 
-    *opts = tpm2_options_new("P:u:r:n:C:c:", ARRAY_LEN(topts), topts, on_option,
-            NULL, 0);
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
 
-    return *opts != NULL;
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
 }
 
-static tool_rc check_opts(void) {
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
 
     tool_rc rc = tool_rc_success;
-    if (!ctx.parent.ctx_path) {
-        LOG_ERR("Expected parent object via -C");
+    if (!ctx.object.privpath) {
+        LOG_ERR("Expected private object portion via -r");
         rc = tool_rc_option_error;
     }
 
-    if (!ctx.object.pubpath) {
-        LOG_ERR("Expected public object portion via -u");
-        rc = tool_rc_option_error;
-    }
+    /*
+     * Check for TSS PEM file input:
+     *  1. It is specified with the -r,--private option alone.
+     *  2. The parent and public objects are implicit and read directly from
+     *     the TSS PEM.
+     */
+    ctx.is_tss_pem =
+        (!ctx.parent.ctx_path && !ctx.object.pubpath && ctx.object.privpath);
+
+    if (!ctx.is_tss_pem) {
+        if (!ctx.parent.ctx_path) {
+            LOG_ERR("Expected parent object via -C or a PEM file with -r");
+            rc = tool_rc_option_error;
+        }
 
-    if (!ctx.object.privpath) {
-        LOG_ERR("Expected public object portion via -r");
-        rc = tool_rc_option_error;
+        if (!ctx.object.pubpath) {
+            LOG_ERR("Expected public object portion via -u or a PEM file with -r");
+            rc = tool_rc_option_error;
+        }
     }
 
     if (!ctx.contextpath && !ctx.cp_hash_path) {
@@ -109,92 +257,107 @@
     return rc;
 }
 
-static tool_rc init(ESYS_CONTEXT *ectx) {
-
-    bool res = files_load_public(ctx.object.pubpath, &ctx.object.public);
-    if (!res) {
-        return tool_rc_general_error;
-    }
+static bool on_option(char key, char *value) {
 
-    res = files_load_private(ctx.object.privpath, &ctx.object.private);
-    if (!res) {
-        return tool_rc_general_error;
+    switch (key) {
+    case 'P':
+        ctx.parent.auth_str = value;
+        break;
+    case 'u':
+        ctx.object.pubpath = value;
+        break;
+    case 'r':
+        ctx.object.privpath = value;
+        break;
+    case 'n':
+        ctx.namepath = value;
+        break;
+    case 'C':
+        ctx.parent.ctx_path = value;
+        break;
+    case 'c':
+        ctx.contextpath = value;
+        break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
     }
 
-    return tpm2_util_object_load_auth(ectx, ctx.parent.ctx_path,
-            ctx.parent.auth_str, &ctx.parent.object, false,
-            TPM2_HANDLE_ALL_W_NV);
+    return true;
 }
 
-static tool_rc finish(ESYS_CONTEXT *ectx) {
+static bool tpm2_tool_onstart(tpm2_options **opts) {
 
-    TPM2B_NAME *name;
-    tool_rc rc = tpm2_tr_get_name(ectx, ctx.object.handle, &name);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
+    const struct option topts = {
+      { "auth",           required_argument, 0, 'P' },
+      { "public",         required_argument, 0, 'u' },
+      { "private",        required_argument, 0, 'r' },
+      { "name",           required_argument, 0, 'n' },
+      { "key-context",    required_argument, 0, 'c' },
+      { "parent-context", required_argument, 0, 'C' },
+      { "cphash",         required_argument, 0,  0  },
+    };
 
-    if (ctx.namepath) {
-        bool result = files_save_bytes_to_file(ctx.namepath, name->name,
-                name->size);
-        free(name);
-        if (!result) {
-            return tool_rc_general_error;
-        }
-    } else {
-        tpm2_tool_output("name: ");
-        tpm2_util_print_tpm2b(name);
-        tpm2_tool_output("\n");
-        free(name);
-    }
+    *opts = tpm2_options_new("P:u:r:n:C:c:", ARRAY_LEN(topts), topts, on_option,
+        0, 0);
 
-    return files_save_tpm_context_to_path(ectx, ctx.object.handle,
-            ctx.contextpath);
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    tool_rc rc = check_opts();
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    rc = init(ectx);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    if (!ctx.cp_hash_path) {
-        rc = tpm2_load(ectx, &ctx.parent.object, &ctx.object.private,
-            &ctx.object.public, &ctx.object.handle, NULL);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-
-        return finish(ectx);
-    }
-
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = tpm2_load(ectx, &ctx.parent.object, &ctx.object.private,
-            &ctx.object.public, &ctx.object.handle, &cp_hash);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = load(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
-    }
-
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    return tpm2_session_close(&ctx.parent.object.session);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.parent.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("load", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("load", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_loadexternal.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_loadexternal.c Changed

@@ -14,16 +14,16 @@
 #include "tpm2_auth_util.h"
 #include "tpm2_hierarchy.h"
 #include "tpm2_openssl.h"
+#include "tpm2_policy.h"
 #include "tpm2_tool.h"
+#include "object.h"
 
-#define BASE_DEFAULT_ATTRS \
-    (TPMA_OBJECT_DECRYPT | TPMA_OBJECT_SIGN_ENCRYPT)
-
-#define DEFAULT_NAME_ALG TPM2_ALG_SHA256
-
+#define MAX_SESSIONS 3
 typedef struct tpm_loadexternal_ctx tpm_loadexternal_ctx;
 struct tpm_loadexternal_ctx {
-    char *context_file_path;
+    /*
+     * Inputs
+     */
     TPMI_RH_HIERARCHY hierarchy_value;
     ESYS_TR handle;
     char *public_key_path; /* path to the public portion of an object */
@@ -35,6 +35,26 @@
     char *key_type; /* type of key attempting to load, defaults to an auto attempt */
     char *name_path; /* An optional path to output the loaded objects name information to */
     char *passin; /* an optional auth string for the input key file for OSSL */
+    TPM2B_SENSITIVE priv; /* Set the AUTH value for sensitive portion */
+    TPM2B_PUBLIC pub; /* Load the users specified public object if specified via -u*/
+    /*
+     * TSS Privkey related
+     */
+    bool is_tsspem;
+
+    /*
+     * Outputs
+     */
+    char *context_file_path;
+    TPM2B_NAME *name;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_loadexternal_ctx ctx = {
@@ -43,26 +63,302 @@
      * portion of an object in other hierarchies.
      */
     .hierarchy_value = TPM2_RH_NULL,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tool_rc load_external(ESYS_CONTEXT *ectx, TPM2B_PUBLIC *pub,
-        TPM2B_SENSITIVE *priv, bool has_priv, TPM2B_NAME **name) {
+static tool_rc load_external(ESYS_CONTEXT *ectx) {
+
+    bool is_priv_specified = (ctx.private_key_path != 0 && !ctx.is_tsspem);
+    return tpm2_loadexternal(ectx, is_priv_specified ? &ctx.priv : 0, &ctx.pub,
+        ctx.hierarchy_value, &ctx.handle, &ctx.cp_hash,
+        ctx.parameter_hash_algorithm);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
 
-    uint32_t hierarchy;
-    TSS2_RC rval = fix_esys_hierarchy(ctx.hierarchy_value, &hierarchy);
-    if (rval != TSS2_RC_SUCCESS) {
-        LOG_ERR("Unknown hierarchy");
-        return tool_rc_from_tpm(rval);
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_loadexternal(ectx,
-            has_priv ? priv : NULL, pub,
-            hierarchy, &ctx.handle);
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    rc = tpm2_tr_get_name(ectx, ctx.handle, &ctx.name);
     if (rc != tool_rc_success) {
         return rc;
     }
+    assert(ctx.name);
+
+    rc = files_save_tpm_context_to_path(ectx, ctx.handle,
+            ctx.context_file_path);
+    if (rc != tool_rc_success) {
+        goto out;
+    }
+
+    tpm2_tool_output("name: ");
+    tpm2_util_hexdump(ctx.name->name, ctx.name->size);
+    tpm2_tool_output("\n");
+
+    if (ctx.name_path) {
+        bool result = files_save_bytes_to_file(ctx.name_path, ctx.name->name,
+            ctx.name->size);
+        if (!result) {
+            rc = tool_rc_general_error;
+            goto out;
+        }
+    }
+
+out:
+    free(ctx.name);
+
+    return rc;
+}
+
+#define BASE_DEFAULT_ATTRS \
+    (TPMA_OBJECT_DECRYPT | TPMA_OBJECT_SIGN_ENCRYPT | TPMA_OBJECT_USERWITHAUTH)
+
+static void setup_default_attrs(TPMA_OBJECT *attrs, bool has_policy,
+    bool has_auth) {
+
+    /* Handle Default Setup */
+    *attrs = BASE_DEFAULT_ATTRS;
+
+    if (has_policy && !has_auth) {
+        *attrs &= ~TPMA_OBJECT_USERWITHAUTH;
+    }
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    TPMA_OBJECT def_attrs = 0;
+    if (!ctx.attrs) {
+        setup_default_attrs(&def_attrs, !!ctx.policy, !!ctx.auth);
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (ctx.is_tsspem) {
+        /* Fetch and set public */
+        TPM2B_PRIVATE priv = { 0 };
+        rc = tpm2_util_object_fetch_priv_pub_from_tpk(ctx.private_key_path,
+            &ctx.pub, &priv);
+        if (rc != tool_rc_success) {
+            /*
+             * We only load a TSS format for the public portion, so if
+             * someone hands us a public file, we'll assume the TSS format when
+             * no -G is specified.
+             *
+             * If they specify a private they need to tell us the type we expect.
+             * This helps reduce auto-guess complexity, as well as future proofing
+             * us for being able to load XOR. Ie we don't want to guess XOR or HMAC
+             * in leui of AES or vice versa.
+             */
+            LOG_ERR("Expected key type via -G option when specifying private"
+                    " portion of object that is not in tssprivkey format");
+            return rc;
+        }
+
+        goto priv_path;
+    }
+
+    /*
+     * Input values are public assumed to be in the TSS format unless:
+     * 1. A private (TPM2B_PRIVATE) key is specified. Since a TPM2B_PRIVATE is
+     *    nonsense to load externally.
+     * 2. The key_type is specified indicated you want to load an external
+     *    public raw key of some type
+     * 3. The third option is no public, which means the public could be coming
+     *    from a private PEM file
+     */
+    if (!ctx.key_type && ctx.public_key_path) {
+        /* Load TSS */
+        bool result = files_load_public(ctx.public_key_path, &ctx.pub);
+        if (!result) {
+            return tool_rc_general_error;
+        }
+
+        /* overwrite certain things here */
+        if (ctx.name_alg) {
+            ctx.pub.publicArea.nameAlg = tpm2_alg_util_from_optarg(ctx.name_alg,
+                tpm2_alg_util_flags_hash);
+            if (ctx.pub.publicArea.nameAlg == TPM2_ALG_ERROR) {
+                LOG_ERR("Invalid name hashing algorithm, got\"%s\"",
+                    ctx.name_alg);
+                return tool_rc_unsupported;
+            }
+        }
+
+        if (ctx.attrs) {
+            bool res = tpm2_attr_util_obj_from_optarg(ctx.attrs,
+                    &ctx.pub.publicArea.objectAttributes);
+            if (!res) {
+                return tool_rc_unsupported;
+            }
+        }
+
+        if (ctx.policy) {
+            rc = tpm2_policy_set_digest(ctx.policy,
+                    &ctx.pub.publicArea.authPolicy);
+            if (rc != tool_rc_success) {
+                return rc;
+            }
+        }
+
+
+    } else if (ctx.public_key_path || ctx.key_type) {
+        /* Load RAW public */
+        TPM2B_PUBLIC template = { 0 };
+        rc = tpm2_alg_util_public_init(ctx.key_type, ctx.name_alg,
+            ctx.attrs, ctx.policy, def_attrs, &template);
+        if (rc != tool_rc_success) {
+            return rc;
+        }
+
+        ctx.pub = template;
+
+        if (ctx.public_key_path) {
+            /* Get the public from a RAW source, ie PEM */
+            bool result = tpm2_openssl_load_public(ctx.public_key_path,
+                template.publicArea.type, &ctx.pub);
+            if (!result) {
+                return tool_rc_general_error;
+            }
+        }
+    } else {
+        LOG_ERR("Unkown internal state");
+        return tool_rc_general_error;
+    }
+
+priv_path:
+    /*
+     * Okay, we have the public portion in some form, at a minimum a template
+     * and at a maximum a fully specified public, load the private portion.
+     */
+    if (ctx.private_key_path && !ctx.is_tsspem) {
+        /*
+         * when nameAlg is not TPM2_ALG_NULL, seed value is needed to pass
+         * consistency checks by TPM
+         */
+        TPM2B_DIGEST *seed = &ctx.priv.sensitiveArea.seedValue;
+        seed->size = tpm2_alg_util_get_hash_size(ctx.pub.publicArea.nameAlg);
+        if (seed->size != 0) {
+            RAND_bytes(seed->buffer, seed->size);
+        }
+
+        tpm2_openssl_load_rc load_status = tpm2_openssl_load_private(
+            ctx.private_key_path, ctx.passin, ctx.auth, &ctx.pub, &ctx.pub,
+            &ctx.priv);
+        if (load_status == lprc_error) {
+            return tool_rc_general_error;
+        }
+
+        /*
+         * If we cannot load the public from the private and a path
+         * is not specified for public, this is an error.
+         *
+         * If we loaded the public from the private and a public was
+         * specified, this is warning. re-init public and load the
+         * specified one.
+         */
+        bool is_ossl_pub_load = tpm2_openssl_did_load_public(load_status);
+        if (!is_ossl_pub_load && !ctx.public_key_path) {
+            LOG_ERR("Only loaded a private key, expected public key in either"
+                    " private PEM or -r option");
+            return tool_rc_general_error;
+        }
+
+        if (is_ossl_pub_load && ctx.public_key_path) {
+            /*
+             * Okay... we got two publics, use the user specified one and
+             * issue a warning
+             */
+            LOG_WARN("Loaded a public key from the private portion"
+                    " and a public portion was specified via -u. Defaulting"
+                    " to specified public");
+
+            /*
+             * This effectively turns off cryptographic binding between
+             * public and private portions of the object.
+             */
+            ctx.pub.publicArea.nameAlg = TPM2_ALG_NULL;
+        }
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        0,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    if (!ctx.public_key_path && !ctx.private_key_path) {
+        LOG_ERR("Expected either -r or -u options");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.context_file_path && !ctx.cp_hash_path) {
+        LOG_ERR("Expected -c option");
+        return tool_rc_option_error;
+    }
 
-    return tpm2_tr_get_name(ectx, ctx.handle, name);
+    ctx.is_tsspem = (!ctx.key_type && ctx.private_key_path);
+
+    return tool_rc_success;
 }
 
 static bool on_option(char key, char *value) {
@@ -107,6 +403,9 @@
     case 0:
         ctx.passin = value;
         break;
+    case 1:
+        ctx.cp_hash_path = value;
+        break;
     }
 
     return true;
@@ -115,247 +414,79 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
-      { "hierarchy",      required_argument, NULL, 'C'},
-      { "public",         required_argument, NULL, 'u'},
-      { "private",        required_argument, NULL, 'r'},
-      { "key-context",    required_argument, NULL, 'c'},
-      { "attributes",     required_argument, NULL, 'a'},
-      { "policy",         required_argument, NULL, 'L'},
-      { "auth",           required_argument, NULL, 'p'},
-      { "hash-algorithm", required_argument, NULL, 'g'},
-      { "key-algorithm",  required_argument, NULL, 'G'},
-      { "name",           required_argument, NULL, 'n'},
-      { "passin",         required_argument, NULL,  0 },
+      { "hierarchy",      required_argument, 0, 'C'},
+      { "public",         required_argument, 0, 'u'},
+      { "private",        required_argument, 0, 'r'},
+      { "key-context",    required_argument, 0, 'c'},
+      { "attributes",     required_argument, 0, 'a'},
+      { "policy",         required_argument, 0, 'L'},
+      { "auth",           required_argument, 0, 'p'},
+      { "hash-algorithm", required_argument, 0, 'g'},
+      { "key-algorithm",  required_argument, 0, 'G'},
+      { "name",           required_argument, 0, 'n'},
+      { "passin",         required_argument, 0,  0 },
+      { "cphash",         required_argument, 0,  1 },
     };
 
     *opts = tpm2_options_new("C:u:r:c:a:p:L:g:G:n:", ARRAY_LEN(topts), topts,
-            on_option, NULL, 0);
+        on_option, 0, 0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    if (!ctx.public_key_path && !ctx.private_key_path) {
-        LOG_ERR("Expected either -r or -u options");
-        return tool_rc_option_error;
-    }
-
-    if (!ctx.context_file_path) {
-        LOG_ERR("Expected -c option");
-        return tool_rc_option_error;
-    }
-
     /*
-     * We only load a TSS format for the public portion, so if
-     * someone hands us a public file, we'll assume the TSS format when
-     * no -G is specified.
-     *
-     * If they specify a private they need to tell us the type we expect.
-     * This helps reduce auto-guess complexity, as well as future proofing
-     * us for being able to load XOR. Ie we don't want to guess XOR or HMAC
-     * in leui of AES or vice versa.
+     * 1. Process options
      */
-    if (!ctx.key_type && ctx.private_key_path) {
-        LOG_ERR("Expected key type via -G option when specifying private"
-                " portion of object");
-        return tool_rc_option_error;
-    }
-
-    TPMI_ALG_PUBLIC alg = TPM2_ALG_NULL;
-
-    if (ctx.key_type) {
-        alg = tpm2_alg_util_from_optarg(ctx.key_type,
-                tpm2_alg_util_flags_asymmetric | tpm2_alg_util_flags_symmetric);
-        if (alg == TPM2_ALG_ERROR) {
-            LOG_ERR("Unsupported key type, got: \"%s\"", ctx.key_type);
-            return tool_rc_general_error;
-        }
+    tool_rc rc = check_options(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     /*
-     * Modifying this init to anything NOT 0 requires
-     * the memset/reinit on the case of specified -u
-     * and found public data in private.
-     */
-    TPM2B_PUBLIC pub = {
-        . size = 0,
-        .publicArea = {
-            .authPolicy = { .size = 0 },
-        },
-    };
-
-    /*
-     * set up the public attributes with a default.
-     * This can be cleared by load_public() if a TSS
-     * object is provided.
+     * 2. Process inputs
      */
-    if (ctx.attrs) {
-        bool result = tpm2_attr_util_obj_from_optarg(ctx.attrs,
-                &pub.publicArea.objectAttributes);
-        if (!result) {
-            return tool_rc_general_error;
-        }
-    } else {
-        /*
-         * Default to the BASE attributes, but add in USER_WITH_AUTH if -p is specified
-         * or NO -L. Where -L is a specified policy and -p is a specified password.
-         * Truth Table:
-         * -L -p | Result
-         * --------------
-         *  0  0 | 1 (set USER_WITH_AUTH)
-         *  0  1 | 0 (don't set USER_WITH_AUTH) <-- we want this case.
-         *  1  0 | 1
-         *  1  1 | 1
-         *
-         * This is an if/then truth table, we want to execute setting USER_WITH_AUTH on
-         * it's negation.
-         */
-        pub.publicArea.objectAttributes = BASE_DEFAULT_ATTRS;
-        if (!(ctx.policy && !ctx.auth)) {
-            pub.publicArea.objectAttributes |= TPMA_OBJECT_USERWITHAUTH;
-        }
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     /*
-     * Set the policy for public, again this can be overridden if the
-     * object is a TSS object
+     * 3. TPM2_CC_<command> call
      */
-    if (ctx.policy) {
-        pub.publicArea.authPolicy.size =
-                sizeof(pub.publicArea.authPolicy.buffer);
-        bool res = files_load_bytes_from_path(ctx.policy,
-                pub.publicArea.authPolicy.buffer,
-                &pub.publicArea.authPolicy.size);
-        if (!res) {
-            return tool_rc_general_error;
-        }
+    rc = load_external(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     /*
-     * Set the name alg, again this gets wipped on a TSS object
+     * 4. Process outputs
      */
-    pub.publicArea.nameAlg =
-        ctx.name_alg ?
-                    tpm2_alg_util_from_optarg(ctx.name_alg,
-                            tpm2_alg_util_flags_hash
-                                    | tpm2_alg_util_flags_misc) :
-                    DEFAULT_NAME_ALG;
-    if (pub.publicArea.nameAlg == TPM2_ALG_ERROR) {
-        LOG_ERR("Invalid name hashing algorithm, got: \"%s\"", ctx.name_alg);
-        return tool_rc_general_error;
-    }
+    return process_output(ectx);
+}
+
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
 
     /*
-     * Set the AUTH value for sensitive portion
+     * 1. Free objects
      */
-    TPM2B_SENSITIVE priv = {
-        .size = 0,
-        .sensitiveArea = {
-            .authValue = { .size = 0 }
-        },
-    };
+
     /*
-     * when nameAlg is not TPM2_ALG_NULL, seed value is needed to pass
-     * consistency checks by TPM
+     * 2. Close authorization sessions
      */
-    TPM2B_DIGEST *seed = &priv.sensitiveArea.seedValue;
-    seed->size = tpm2_alg_util_get_hash_size(pub.publicArea.nameAlg);
-    if (seed->size != 0) {
-        RAND_bytes(seed->buffer, seed->size);
-    }
-
-    tpm2_session *tmp;
-    tool_rc tmp_rc = tpm2_auth_util_from_optarg(NULL, ctx.auth, &tmp, true);
-    if (tmp_rc != tool_rc_success) {
-        LOG_ERR("Invalid key authorization");
-        return tmp_rc;
-    }
-
-    const TPM2B_AUTH *auth = tpm2_session_get_auth_value(tmp);
-    priv.sensitiveArea.authValue = *auth;
-
-    tpm2_session_close(&tmp);
-
-    tpm2_openssl_load_rc load_status = lprc_error;
-    if (ctx.private_key_path) {
-        load_status = tpm2_openssl_load_private(ctx.private_key_path,
-                ctx.passin, alg, &pub, &priv);
-        if (load_status == lprc_error) {
-            return tool_rc_general_error;
-        }
-    }
 
     /*
-     * If we cannot load the public from the private and a path
-     * is not specified for public, this is an error.
-     *
-     * If we loaded the public from the private and a public was
-     * specified, this is warning. re-init public and load the
-     * specified one.
+     * 3. Close auxiliary sessions
      */
-    if (!tpm2_openssl_did_load_public(load_status) && !ctx.public_key_path) {
-        LOG_ERR("Only loaded a private key, expected public key in either"
-                " private PEM or -r option");
-        return tool_rc_general_error;
-
-    } else if (tpm2_openssl_did_load_public(load_status)
-            && ctx.public_key_path) {
-        LOG_WARN("Loaded a public key from the private portion"
-                " and a public portion was specified via -u. Defaulting"
-                " to specified public");
 
-        memset(&pub.publicArea.parameters, 0,
-                sizeof(pub.publicArea.parameters));
-        pub.publicArea.type = TPM2_ALG_NULL;
-    }
-
-    if (ctx.public_key_path) {
-        bool result = tpm2_openssl_load_public(ctx.public_key_path, alg, &pub);
-        if (!result) {
-            return tool_rc_general_error;
-        }
-    }
-
-    tool_rc rc = tool_rc_general_error;
-    TPM2B_NAME *name = NULL;
-    tmp_rc = load_external(ectx, &pub, &priv, ctx.private_key_path != NULL,
-            &name);
-    if (tmp_rc != tool_rc_success) {
-        rc = tmp_rc;
-        goto out;
-    }
-
-    assert(name);
-
-    tmp_rc = files_save_tpm_context_to_path(ectx, ctx.handle,
-            ctx.context_file_path);
-    if (tmp_rc != tool_rc_success) {
-        rc = tmp_rc;
-        goto out;
-    }
-
-    tpm2_tool_output("name: ");
-    tpm2_util_hexdump(name->name, name->size);
-    tpm2_tool_output("\n");
-
-    if (ctx.name_path) {
-        bool result = files_save_bytes_to_file(ctx.name_path, name->name,
-                name->size);
-        if (!result) {
-            goto out;
-        }
-    }
-
-    rc = tool_rc_success;
-
-out:
-    free(name);
-
-    return rc;
+    return tool_rc_success;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("loadexternal", tpm2_tool_onstart, tpm2_tool_onrun, NULL, NULL)
+TPM2_TOOL_REGISTER("loadexternal", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_makecredential.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_makecredential.c Changed

@@ -175,8 +175,8 @@
     TPM2B_ENCRYPTED_SECRET *secret;
     ESYS_TR tr_handle = ESYS_TR_NONE;
 
-    tool_rc rc = tpm2_loadexternal(ectx,
-            NULL, &ctx.public, TPM2_RH_NULL, &tr_handle);
+    tool_rc rc = tpm2_loadexternal(ectx, 0, &ctx.public, TPM2_RH_NULL,
+        &tr_handle, 0, TPM2_ALG_ERROR);
     if (rc != tool_rc_success) {
         return rc;
     }
@@ -188,7 +188,7 @@
         return rc;
     }
 
-    rc = tpm2_flush_context(ectx, tr_handle);
+    rc = tpm2_flush_context(ectx, tr_handle, NULL, TPM2_ALG_NULL);
     if (rc != tool_rc_success) {
         free(cred_blob);
         free(secret);
@@ -310,11 +310,14 @@
     ctx.public.publicArea.nameAlg = TPM2_ALG_SHA256;
 }
 
-static tool_rc process_input(void) {
+static tool_rc process_input(tpm2_option_flags flags) {
 
     TPMI_ALG_PUBLIC alg = TPM2_ALG_NULL;
     if (ctx.key_type) {
-        LOG_WARN("Because **-G** is specified, assuming input encryption public key is in PEM format.");
+        if (!flags.quiet) {
+            LOG_WARN("Because **-G** is specified, assuming input encryption "
+                     "public key is in PEM format.");
+        }
         alg = tpm2_alg_util_from_optarg(ctx.key_type,
             tpm2_alg_util_flags_asymmetric);
         if (alg == TPM2_ALG_ERROR ||
@@ -325,8 +328,9 @@
     }
 
     if (ctx.public_key_path) {
-        bool result = tpm2_openssl_load_public(ctx.public_key_path, alg,
-            &ctx.public);
+        bool result = alg != TPM2_ALG_NULL ?
+            tpm2_openssl_load_public(ctx.public_key_path, alg,
+            &ctx.public) : files_load_public(ctx.public_key_path, &ctx.public);
         if (!result) {
             return tool_rc_general_error;
         }
@@ -361,6 +365,16 @@
         return tool_rc_general_error;
     }
 
+    /*
+     * If input was read from stdin, check if a larger data set was specified
+     * and error out.
+     */
+    if (ctx.credential.size > TPM2_SHA512_DIGEST_SIZE) {
+        LOG_ERR("Size is larger than buffer, got %d expected less than or equal"
+        "to %d", ctx.credential.size, TPM2_SHA512_DIGEST_SIZE);
+        return tool_rc_general_error;
+    }
+
     return tool_rc_success;
 }
 
@@ -368,7 +382,7 @@
 
     UNUSED(flags);
 
-    tool_rc rc = process_input();
+    tool_rc rc = process_input(flags);
     if (rc != tool_rc_success) {
         return rc;
     }

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_nvcertify.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_nvcertify.c Changed

@@ -9,9 +9,13 @@
 #include "tpm2_nv_util.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 1
 typedef struct tpm_nvcertify_ctx tpm_nvcertify_ctx;
 struct tpm_nvcertify_ctx {
-    //Input
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -25,28 +29,109 @@
     } nvindex_authobj;
 
     TPM2_HANDLE nv_index;
-
+    TPM2B_NAME precalc_nvname;
+    TPM2B_NAME precalc_signername;
     TPMI_ALG_HASH halg;
+    bool is_sigscheme_halg_specified;
     TPMI_ALG_SIG_SCHEME sig_scheme;
-
+    bool is_sigscheme_specified;
     UINT16 size;
     UINT16 offset;
-
     const char *policy_qualifier_arg;
+    TPMT_SIG_SCHEME in_scheme;
+    TPM2B_DATA policy_qualifier;
 
-    //Output
+    /*
+     * Outputs
+     */
     char *certify_info_path;
+    TPM2B_ATTEST *certify_info;
     char *signature_path;
+    TPMT_SIGNATURE *signature;
     tpm2_convert_sig_fmt sig_format;
 
-    char *cp_hash_path;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_tcti_none;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
 };
 
 static tpm_nvcertify_ctx ctx = {
     .halg = TPM2_ALG_NULL,
     .sig_scheme = TPM2_ALG_NULL,
+    .policy_qualifier = TPM2B_EMPTY_INIT,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .aux_session_handle0 = ESYS_TR_NONE,
 };
 
+static tool_rc nv_certify(ESYS_CONTEXT *ectx) {
+
+    return tpm2_nvcertify(ectx, &ctx.signing_key.object,
+        &ctx.nvindex_authobj.object, ctx.nv_index, &ctx.precalc_nvname,
+        &ctx.precalc_signername, ctx.offset, ctx.size, &ctx.in_scheme,
+        &ctx.certify_info, &ctx.signature, &ctx.policy_qualifier, &ctx.cp_hash,
+        &ctx.rp_hash, ctx.parameter_hash_algorithm, ctx.aux_session_handle0);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+   UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    bool result = tpm2_convert_sig_save(ctx.signature, ctx.sig_format,
+        ctx.signature_path);
+    if (!result) {
+        LOG_ERR("Failed saving signature data.");
+        return tool_rc_general_error;
+    }
+
+    result = files_save_bytes_to_file(ctx.certify_info_path,
+        (UINT8 *) &ctx.certify_info->attestationData, ctx.certify_info->size);
+    if (!result) {
+        LOG_ERR("Failed saving attestation data.");
+        return tool_rc_general_error;
+    }
+
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+        rc = is_file_op_success ? tool_rc_success : tool_rc_general_error;
+    }
+
+    return rc;
+}
+
 static bool set_digest_algorithm(char *value) {
 
     ctx.halg = tpm2_alg_util_from_optarg(value, tpm2_alg_util_flags_hash);
@@ -77,6 +162,253 @@
     return true;
 }
 
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /*
+     * Load signing key and auth
+     */
+    tool_rc rc = tool_rc_success;
+    /*
+     * if tcti is none, the signer name is read when recording the options.
+     */
+    if (!ctx.is_tcti_none) {
+        rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
+                ctx.signing_key.auth_str, &ctx.signing_key.object, false,
+                TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
+        if (rc != tool_rc_success) {
+            LOG_ERR("Invalid signing key/ authorization.");
+            return rc;
+        }
+    }
+
+    /*
+     * Load NV index authorization object and auth
+     */
+    if (ctx.is_tcti_none) {
+        /*
+         * Cannot use tpm2_util_object_load like in nvdefine as it makes a call
+         * to tpm2_util_sys_handle_to_esys_handle which then tries to read the
+         * ESYS_TR object off of the TPM expecting it to be there.
+         * Note: this if it is a permanent handle ESYS_TR is fixed and so the
+         * TPM is not probed even with tpm2_util_sys_handle_to_esys_handle.
+         */
+        rc = tpm2_util_handle_from_optarg(ctx.nvindex_authobj.ctx_path,
+            &ctx.nvindex_authobj.object.handle,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P) ?
+            tool_rc_success : tool_rc_option_error;
+
+        ctx.nvindex_authobj.object.tr_handle = (rc == tool_rc_success) ?
+          tpm2_tpmi_hierarchy_to_esys_tr(ctx.nvindex_authobj.object.handle) : 0;
+    } else {
+        rc = tpm2_util_object_load_auth(ectx, ctx.nvindex_authobj.ctx_path,
+            ctx.nvindex_authobj.auth_str, &ctx.nvindex_authobj.object, false,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    }
+
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid object specified for NV index authorization.");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations dependent on loaded objects
+     */
+
+    /*
+     * Set appropriate signature scheme for key type
+     */
+    if (!ctx.is_tcti_none) {
+        rc = tpm2_alg_util_get_signature_scheme(ectx,
+            ctx.signing_key.object.tr_handle, &ctx.halg, ctx.sig_scheme, &ctx.in_scheme);
+        if (rc != tool_rc_success) {
+            LOG_ERR("bad signature scheme for key type!");
+            return rc;
+        }
+    } else {
+        ctx.in_scheme.scheme = ctx.sig_scheme;
+        ctx.in_scheme.details.any.hashAlg = ctx.halg;
+    }
+
+    /*
+     * Qualifier data is optional. If not specified default to 0
+     */
+    if (ctx.policy_qualifier_arg) {
+
+        ctx.policy_qualifier.size = sizeof(ctx.policy_qualifier.buffer);
+        bool result = tpm2_util_bin_from_hex_or_file(ctx.policy_qualifier_arg,
+                &ctx.policy_qualifier.size,
+                ctx.policy_qualifier.buffer);
+        if (!result) {
+            return tool_rc_general_error;
+        }
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+    */
+
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.signing_key.object.session,
+        ctx.nvindex_authobj.object.session,
+        ctx.aux_session0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+
+    ctx.is_tcti_none = flags.tcti_none ? true : false;
+    if (ctx.is_tcti_none && !ctx.cp_hash_path) {
+        LOG_ERR("If tcti is none, then cpHash path must be specified");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * is_tcti_none       N
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.is_tcti_none ||
+        (ctx.cp_hash_path && !ctx.rp_hash_path)) ? false : true;
+
+    if (!ctx.signing_key.ctx_path && !ctx.is_tcti_none) {
+        LOG_ERR("Must specify the signing key '-C'.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.signature_path && !ctx.is_tcti_none) {
+        LOG_ERR("Must specify the file path to save signature '-o'");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.certify_info_path && !ctx.is_tcti_none) {
+        LOG_ERR("Must specify file path to save attestation '--attestation'");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.is_tcti_none && !ctx.is_sigscheme_specified) {
+        LOG_ERR("Must specify the signing scheme");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.is_tcti_none && !ctx.is_sigscheme_halg_specified) {
+        LOG_ERR("Must specify the digest alg for the signing scheme");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * Peculiar to this and some other tools, the object (nvindex) name must
+     * be specified when only calculating the cpHash.
+     *
+     * This breaks the compatibility with the 4.X tools where in a real tcti
+     * is invoked to get a sapi handle to retrieve the params. Also this would
+     * imply that a real NV index ought to be defined even in the case of simply
+     * calculating the cpHash.
+     *
+     * To solve this conundrum, we can only mandate the requirement for the NV
+     * index name in case tcti is specified as none. If tcti is not specified as
+     * none we fall back to the old behavior of reading from a define NV index
+     * 
+     * Also, tcti is setup to a fake_tcti when tcti is specified "none" as the
+     * tool option affords TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI.
+     * 
+     * If NVindex name is not specified and tcti is not none, it is expected
+     * that the NV index is actually define. This behavior complies with the
+     * backwards compatibility with 4.X
+     */
+    bool is_nv_name_specified = ctx.precalc_nvname.size;
+    if (ctx.is_tcti_none && !is_nv_name_specified) {
+        LOG_ERR("Must specify the NVIndex name.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.is_tcti_none && is_nv_name_specified) {
+        LOG_ERR("Do not specify NV index name, it is directly read from NV");
+        return tool_rc_option_error;
+    }
+
+    bool is_signer_name_specified = ctx.precalc_signername.size;
+    if (ctx.is_tcti_none && !is_signer_name_specified) {
+        LOG_ERR("Must specify the signing key name.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.is_tcti_none && is_signer_name_specified) {
+        LOG_ERR("Do not specify signing key name, it is read from key handle");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * Ensure that NV index is large enough for certifying data size at offset.
+     */
+    tool_rc rc = tool_rc_success;
+    TPM2B_NV_PUBLIC *nv_public = 0;
+    if (!ctx.is_tcti_none) {
+        rc = tpm2_util_nv_read_public(ectx, ctx.nv_index, 0, &nv_public, 0, 0, 0,
+        ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE);
+        if (rc != tool_rc_success) {
+            LOG_ERR("Failed to access NVRAM public area at index 0x%X",
+                    ctx.nv_index);
+            goto is_input_options_args_valid_out;
+        }
+
+        if (ctx.offset + ctx.size > nv_public->nvPublic.dataSize) {
+            LOG_ERR("Size to read at offset is bigger than nv index size");
+            rc = tool_rc_option_error;
+            goto is_input_options_args_valid_out;
+        }
+    }
+
+is_input_options_args_valid_out:
+    free(nv_public);
+    return rc;
+}
+
+static bool on_arg(int argc, char **argv) {
+    /*
+     * If the user doesn't specify an authorization hierarchy use the index
+     */
+    if (!ctx.nvindex_authobj.ctx_path) {
+        ctx.nvindex_authobj.ctx_path = argv0;
+    }
+    return on_arg_nv_index(argc, argv, &ctx.nv_index);
+}
+
 static bool on_option(char key, char *value) {
 
     bool result = true;
@@ -97,9 +429,11 @@
         break;
     case 'g':
         result = set_digest_algorithm(value);
+        ctx.is_sigscheme_halg_specified = true;
         goto on_option_out;
     case 's':
         result = set_signing_scheme(value);
+        ctx.is_sigscheme_specified = true;
         goto on_option_out;
     case 'f':
         result = set_signature_format(value);
@@ -142,22 +476,42 @@
     case 3:
         ctx.cp_hash_path = value;
         break;
+    case 4:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
+    case 'n':
+        ctx.precalc_nvname.size = BUFFER_SIZE(TPM2B_NAME, name);
+        int q = tpm2_util_hex_to_byte_structure(value, &ctx.precalc_nvname.size,
+        ctx.precalc_nvname.name);
+        if (q) {
+            LOG_ERR("FAILED: %d", q);
+            return false;
+        }
+        break;
+    case 5:
+        ctx.precalc_signername.size = BUFFER_SIZE(TPM2B_NAME, name);
+        int r = tpm2_util_hex_to_byte_structure(value,
+            &ctx.precalc_signername.size, ctx.precalc_signername.name);
+        if (r) {
+            LOG_ERR("FAILED: %d", r);
+            return false;
+        }
+        break;
     }
 
 on_option_out:
     return result;
 }
 
-static bool on_arg(int argc, char **argv) {
-    /*
-     * If the user doesn't specify an authorization hierarchy use the index
-     */
-    if (!ctx.nvindex_authobj.ctx_path) {
-        ctx.nvindex_authobj.ctx_path = argv0;
-    }
-    return on_arg_nv_index(argc, argv, &ctx.nv_index);
-}
-
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static const struct option topts = {
@@ -174,194 +528,86 @@
         { "offset",             required_argument, NULL,  1  },
         { "attestation",        required_argument, NULL,  2  },
         { "cphash",             required_argument, NULL,  3  },
+        { "rphash",             required_argument, NULL,  4  },
+        { "session",            required_argument, NULL, 'S' },
+        { "name",               required_argument, NULL, 'n' },
+        { "signer-name",        required_argument, NULL,  5  },
     };
 
-    *opts = tpm2_options_new("C:P:c:p:g:s:f:o:q:", ARRAY_LEN(topts), topts,
-        on_option, on_arg, 0);
+    *opts = tpm2_options_new("C:P:c:p:g:s:f:o:q:S:n:", ARRAY_LEN(topts), topts,
+        on_option, on_arg, TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI);
 
     return *opts != NULL;
 }
 
-static bool is_input_options_args_valid(ESYS_CONTEXT *ectx) {
-
-    if (!ctx.signing_key.ctx_path) {
-        LOG_ERR("Must specify the signing key '-C'.");
-        return false;
-    }
-
-    if (!ctx.signature_path) {
-        LOG_ERR("Must specify the file path to save signature '-o'");
-        return false;
-    }
-
-    if (!ctx.certify_info_path) {
-        LOG_ERR("Must specify file path to save attestation '--attestation'");
-        return false;
-    }
-
-    /*
-     * Ensure that NV index is large enough for certifying data size at offset.
-     */
-    bool result = true;
-    TPM2B_NV_PUBLIC *nv_public = NULL;
-    tool_rc rc = tpm2_util_nv_read_public(ectx, ctx.nv_index, &nv_public);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to access NVRAM public area at index 0x%X",
-                ctx.nv_index);
-        result = false;
-        goto is_input_options_args_valid_out;
-    }
-
-    if (ctx.offset + ctx.size > nv_public->nvPublic.dataSize) {
-        LOG_ERR("Size to read at offset is bigger than nv index size");
-        result = false;
-        goto is_input_options_args_valid_out;
-    }
-
-is_input_options_args_valid_out:
-    free(nv_public);
-    return result;
-}
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
-static tool_rc process_nvcertify_input(ESYS_CONTEXT *ectx,
-    TPMT_SIG_SCHEME *in_scheme, TPM2B_DATA *policy_qualifier) {
+    /* opts is unused, avoid compiler warning */
+    UNUSED(flags);
 
     /*
-     * Load signing key and auth
+     * 1. Process options
      */
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
-            ctx.signing_key.auth_str, &ctx.signing_key.object, false,
-            TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
+    tool_rc rc = check_options(ectx, flags);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid signing key/ authorization.");
         return rc;
     }
 
     /*
-     * Load NV index authorization object and auth
+     * 2. Process inputs
      */
-    rc = tpm2_util_object_load_auth(ectx, ctx.nvindex_authobj.ctx_path,
-            ctx.nvindex_authobj.auth_str, &ctx.nvindex_authobj.object,
-            false, TPM2_HANDLE_ALL_W_NV);
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid object specified for NV index authorization.");
         return rc;
     }
 
     /*
-     * Set appropriate signature scheme for key type
+     * 3. TPM2_CC_<command> call
      */
-    rc = tpm2_alg_util_get_signature_scheme(ectx,
-        ctx.signing_key.object.tr_handle, &ctx.halg, ctx.sig_scheme, in_scheme);
+    rc = nv_certify(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("bad signature scheme for key type!");
         return rc;
     }
 
     /*
-     * Qualifier data is optional. If not specified default to 0
+     * 4. Process outputs
      */
-    if (ctx.policy_qualifier_arg) {
-
-        policy_qualifier->size = sizeof(policy_qualifier->buffer);
-        bool result = tpm2_util_bin_from_hex_or_file(ctx.policy_qualifier_arg,
-                &policy_qualifier->size,
-                policy_qualifier->buffer);
-        if (!result) {
-            return tool_rc_general_error;
-        }
-    }
-
-    return tool_rc_success;
-}
-
-static tool_rc process_nvcertify_output(TPMT_SIGNATURE *signature,
-    TPM2B_ATTEST *certify_info) {
-
-    bool result = tpm2_convert_sig_save(signature, ctx.sig_format,
-        ctx.signature_path);
-    if (!result) {
-        LOG_ERR("Failed saving signature data.");
-        return tool_rc_general_error;
-    }
-
-    result = files_save_bytes_to_file(ctx.certify_info_path,
-        certify_info->attestationData, certify_info->size);
-    if (!result) {
-        LOG_ERR("Failed saving attestation data.");
-        return tool_rc_general_error;
-    }
-
-    return tool_rc_success;
-}
-
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
-
-    /* opts is unused, avoid compiler warning */
-    UNUSED(flags);
-
-    bool result = is_input_options_args_valid(ectx);
-    if (!result) {
-        return tool_rc_option_error;
-    }
-
-    //Input
-    TPMT_SIG_SCHEME in_scheme;
-    TPM2B_DATA policy_qualifier = TPM2B_EMPTY_INIT;
-    tool_rc rc = process_nvcertify_input(ectx, &in_scheme, &policy_qualifier);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
-
-    //ESAPI call
-    TPMT_SIGNATURE *signature = NULL;
-    TPM2B_ATTEST *certify_info = NULL;
-    if (!ctx.cp_hash_path) {
-        rc = tpm2_nvcertify(ectx, &ctx.signing_key.object,
-            &ctx.nvindex_authobj.object, ctx.nv_index, ctx.offset, ctx.size,
-            &in_scheme, &certify_info, &signature, &policy_qualifier, NULL);
-        if (rc != tool_rc_success) {
-            goto tpm2_tool_onrun_out;
-        }
-        //Output
-        rc = process_nvcertify_output(signature, certify_info);
-        goto tpm2_tool_onrun_out;
-    }
-
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = tpm2_nvcertify(ectx, &ctx.signing_key.object,
-            &ctx.nvindex_authobj.object, ctx.nv_index, ctx.offset, ctx.size,
-            &in_scheme, &certify_info, &signature, &policy_qualifier, &cp_hash);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
-
-    result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
-    }
-
-tpm2_tool_onrun_out:
-    Esys_Free(signature);
-    Esys_Free(certify_info);
-    return rc;
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
+    /*
+     * 1. Free objects
+     */
+    Esys_Free(ctx.signature);
+    Esys_Free(ctx.certify_info);
 
+    /*
+     * 2. Close authorization sessions
+     */
     tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.signing_key.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
+    }
 
-    if (!ctx.cp_hash_path) {
-
-        tool_rc tmp_rc = tpm2_session_close(&ctx.signing_key.object.session);
-        if (tmp_rc != tool_rc_success) {
-            rc = tmp_rc;
-        }
+    tmp_rc = tpm2_session_close(&ctx.nvindex_authobj.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
+    }
 
-        tmp_rc = tpm2_session_close(&ctx.nvindex_authobj.object.session);
-        if (tmp_rc != tool_rc_success) {
-            rc = tmp_rc;
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
         }
     }
 
@@ -369,4 +615,5 @@
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("nvcertify", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("nvcertify", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_nvdefine.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_nvdefine.c Changed

@@ -1,10 +1,12 @@
 /* SPDX-License-Identifier: BSD-3-Clause */
+#include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
 
 #include "files.h"
 #include "log.h"
 #include "tpm2.h"
+#include "tpm2_alg_util.h"
 #include "tpm2_attr_util.h"
 #include "tpm2_auth_util.h"
 #include "tpm2_nv_util.h"
@@ -12,7 +14,12 @@
 #include "tpm2_tool.h"
 
 typedef struct tpm_nvdefine_ctx tpm_nvdefine_ctx;
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2
 struct tpm_nvdefine_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -25,10 +32,34 @@
     TPMA_NV nv_attribute;
     TPM2B_AUTH nv_auth;
 
+    TPMI_ALG_HASH halg;
     char *policy_file;
     char *index_auth_str;
 
-    char *cp_hash_path;
+    TPM2B_NV_PUBLIC public_info;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    bool is_tcti_none;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
 };
 
 static tpm_nvdefine_ctx ctx = {
@@ -36,129 +67,63 @@
         .ctx_path = "o",
     },
     .nv_auth = TPM2B_EMPTY_INIT,
+    .halg = TPM2_ALG_SHA256,
+    .public_info = TPM2B_EMPTY_INIT,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
 static tool_rc nv_space_define(ESYS_CONTEXT *ectx) {
 
-    TPM2B_NV_PUBLIC public_info = TPM2B_EMPTY_INIT;
-
-    public_info.nvPublic.nvIndex = ctx.nv_index;
-    public_info.nvPublic.nameAlg = TPM2_ALG_SHA256;
-
-    // Now set the attributes.
-    public_info.nvPublic.attributes = ctx.nv_attribute;
-
-    if (!ctx.size) {
-        LOG_WARN("Defining an index with size 0");
-    }
-
-    if (ctx.policy_file) {
-        public_info.nvPublic.authPolicy.size = BUFFER_SIZE(TPM2B_DIGEST,
-                buffer);
-        if (!files_load_bytes_from_path(ctx.policy_file,
-                public_info.nvPublic.authPolicy.buffer,
-                &public_info.nvPublic.authPolicy.size)) {
-            return tool_rc_general_error;
-        }
-    }
-
-    public_info.nvPublic.dataSize = ctx.size;
-
-    tool_rc rc = tool_rc_success;
-    if (!ctx.cp_hash_path) {
-        rc = tpm2_nv_definespace(ectx, &ctx.auth_hierarchy.object,
-                &ctx.nv_auth, &public_info, NULL);
-        if (rc != tool_rc_success) {
+    tool_rc rc = tpm2_nv_definespace(ectx, &ctx.auth_hierarchy.object,
+        &ctx.nv_auth, &ctx.public_info, &ctx.cp_hash, &ctx.rp_hash,
+        ctx.parameter_hash_algorithm, ctx.aux_session_handle0,
+        ctx.aux_session_handle1);
+    if (rc != tool_rc_success) {
+        if (ctx.is_command_dispatch) {
             LOG_ERR("Failed to create NV index 0x%x.", ctx.nv_index);
-            return rc;
         }
-        tpm2_tool_output("nv-index: 0x%x\n", ctx.nv_index);
-        goto nvdefine_out;
-    }
-
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = tpm2_nv_definespace(ectx, &ctx.auth_hierarchy.object,
-        &ctx.nv_auth, &public_info, &cp_hash);;
-    if (rc != tool_rc_success) {
         return rc;
     }
 
-    bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
+    if (ctx.is_command_dispatch) {
+        tpm2_tool_output("nv-index: 0x%x\n", ctx.nv_index);
     }
 
-nvdefine_out:
     return rc;
 }
 
-static bool on_option(char key, char *value) {
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
-    bool result;
+    UNUSED(ectx);
 
-    switch (key) {
-    case 'C':
-        ctx.auth_hierarchy.ctx_path = value;
-        break;
-    case 'P':
-        ctx.auth_hierarchy.auth_str = value;
-        break;
-    case 's':
-        ctx.size_set = true;
-        result = tpm2_util_string_to_uint16(value, &ctx.size);
-        if (!result) {
-            LOG_ERR("Could not convert size to number, got: \"%s\"", value);
-            return false;
-        }
-        break;
-    case 'a':
-        result = tpm2_util_string_to_uint32(value, &ctx.nv_attribute);
-        if (!result) {
-            result = tpm2_attr_util_nv_strtoattr(value, &ctx.nv_attribute);
-            if (!result) {
-                LOG_ERR(
-                        "Could not convert NV attribute to number or keyword, got: \"%s\"",
-                        value);
-                return false;
-            }
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
         }
-        break;
-    case 'p':
-        ctx.index_auth_str = value;
-        break;
-    case 'L':
-        ctx.policy_file = value;
-        break;
-    case 0:
-        ctx.cp_hash_path = value;
-        break;
     }
 
-    return true;
-}
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
+    }
 
-static bool on_arg(int argc, char **argv) {
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+    }
 
-    return on_arg_nv_index(argc, argv, &ctx.nv_index);
+    return is_file_op_success ? tool_rc_success : tool_rc_general_error;
 }
 
-static bool tpm2_tool_onstart(tpm2_options **opts) {
-
-    const struct option topts = {
-        { "hierarchy",      required_argument, NULL, 'C' },
-        { "size",           required_argument, NULL, 's' },
-        { "attributes",     required_argument, NULL, 'a' },
-        { "hierarchy-auth", required_argument, NULL, 'P' },
-        { "index-auth",     required_argument, NULL, 'p' },
-        { "policy",         required_argument, NULL, 'L' },
-        { "cphash",         required_argument, NULL,  0  },
-    };
-
-    *opts = tpm2_options_new("C:s:a:P:p:L:", ARRAY_LEN(topts), topts, on_option,
-            on_arg, 0);
-
-    return *opts != NULL;
-}
 
 static void handle_default_attributes(void) {
 
@@ -172,7 +137,7 @@
     if (h == ESYS_TR_RH_OWNER) {
         ctx.nv_attribute |= TPMA_NV_OWNERWRITE | TPMA_NV_OWNERREAD;
     } else if (h == ESYS_TR_RH_PLATFORM) {
-        ctx.nv_attribute |= TPMA_NV_PPWRITE | TPMA_NV_PPREAD;
+        ctx.nv_attribute |= TPMA_NV_PPWRITE | TPMA_NV_PPREAD | TPMA_NV_PLATFORMCREATE;
     } /* else it's an nv index for auth */
 
     /* if it has a policy file, set policy read and write vs auth read and write */
@@ -183,60 +148,19 @@
     }
 }
 
-static void get_max_nv_index_size(ESYS_CONTEXT *ectx, UINT16 *size) {
-
-    *size = 0;
-
-    /* get the max NV index for the TPM */
-    TPMS_CAPABILITY_DATA *capabilities = NULL;
-    tool_rc tmp_rc = tpm2_getcap(ectx, TPM2_CAP_TPM_PROPERTIES, TPM2_PT_FIXED,
-            TPM2_MAX_TPM_PROPERTIES, NULL, &capabilities);
-    if (tmp_rc != tool_rc_success) {
-        *size = TPM2_MAX_NV_BUFFER_SIZE;
-        LOG_ERR("Could not get fixed TPM properties");
-        return;
-    }
-
-    TPMS_TAGGED_PROPERTY *properties = capabilities->data.tpmProperties.tpmProperty;
-    UINT32 count = capabilities->data.tpmProperties.count;
-
-    if (!count) {
-        *size = TPM2_MAX_NV_BUFFER_SIZE;
-        LOG_ERR("Could not get maximum NV index size");
-        goto out;
-    }
-
-    UINT32 i;
-    for (i=0; i < count; i++) {
-        if (propertiesi.property == TPM2_PT_NV_INDEX_MAX) {
-            *size = propertiesi.value;
-            break;
-        }
-    }
-
-    if (*size == 0) {
-        *size = TPM2_MAX_NV_BUFFER_SIZE;
-        LOG_ERR("Could not find max NV indices in capabilities");
-    }
-
-out:
-    free(capabilities);
-
-    return;
-}
-
 static tool_rc handle_no_index_specified(ESYS_CONTEXT *ectx, TPM2_NV_INDEX *chosen) {
 
-    tool_rc rc = tool_rc_general_error;
-
-    TPM2_NV_INDEX max = 0;
+    if (ctx.is_tcti_none) {
+        *chosen = TPM2_HR_NV_INDEX;
+        return tool_rc_success;
+    }
 
     /* get the max NV index for the TPM */
     TPMS_CAPABILITY_DATA *capabilities = NULL;
-    tool_rc tmp_rc = tpm2_getcap(ectx, TPM2_CAP_TPM_PROPERTIES, TPM2_PT_FIXED,
+    tool_rc rc = tpm2_getcap(ectx, TPM2_CAP_TPM_PROPERTIES, TPM2_PT_FIXED,
             TPM2_MAX_TPM_PROPERTIES, NULL, &capabilities);
-    if (tmp_rc != tool_rc_success) {
-        return tmp_rc;
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
     TPMS_TAGGED_PROPERTY *properties = capabilities->data.tpmProperties.tpmProperty;
@@ -244,9 +168,11 @@
 
     if (!count) {
         LOG_ERR("Could not get maximum NV index, try specifying an NV index");
+        rc = tool_rc_general_error;
         goto out;
     }
 
+    TPM2_NV_INDEX max = 0;
     UINT32 i;
     for (i=0; i < count; i++) {
         if (propertiesi.property == TPM2_PT_NV_INDEX_MAX) {
@@ -256,17 +182,17 @@
 
     if (!max) {
         LOG_ERR("Could not find max NV indices in capabilities");
+        rc = tool_rc_general_error;
         goto out;
     }
-
     /* done getting max NV index */
     free(capabilities);
     capabilities = NULL;
 
     /* now find what NV indexes are in use */
-    tmp_rc = tpm2_getcap(ectx, TPM2_CAP_HANDLES, tpm2_util_hton_32(TPM2_HT_NV_INDEX),
+    rc = tpm2_getcap(ectx, TPM2_CAP_HANDLES, tpm2_util_hton_32(TPM2_HT_NV_INDEX),
             TPM2_PT_NV_INDEX_MAX, NULL, &capabilities);
-    if (tmp_rc != tool_rc_success) {
+    if (rc != tool_rc_success) {
         goto out;
     }
 
@@ -278,10 +204,8 @@
     bool found = false;
     TPM2_NV_INDEX choose;
     for (choose = TPM2_HR_NV_INDEX; choose < max; choose++) {
-
-        bool in_use = false;
-
         /* take the index to guess and check against everything in use */
+        bool in_use = false;
         for (i = 0; i < capabilities->data.handles.count; i++) {
             TPMI_RH_NV_INDEX index = capabilities->data.handles.handlei;
             if (index == choose) {
@@ -295,18 +219,16 @@
             found = true;
             break;
         }
-
     }
 
     if (!found) {
         LOG_ERR("No free NV index found");
+        rc = tool_rc_general_error;
         goto out;
     }
 
     *chosen = choose;
 
-    rc = tool_rc_success;
-
 out:
     free(capabilities);
 
@@ -315,10 +237,18 @@
 
 static tool_rc validate_size(ESYS_CONTEXT *ectx) {
 
+    #define TYPICAL_NVINDEX_MAX 2048
+    if (ctx.is_tcti_none && !ctx.size_set) {
+        ctx.size = TYPICAL_NVINDEX_MAX;
+        return tool_rc_success;
+    }
+
+    UINT16 hash_size = tpm2_alg_util_get_hash_size(ctx.halg);
+
     switch ((ctx.nv_attribute & TPMA_NV_TPM2_NT_MASK) >> TPMA_NV_TPM2_NT_SHIFT) {
         case TPM2_NT_ORDINARY:
             if (!ctx.size_set) {
-                get_max_nv_index_size(ectx, &ctx.size);
+                ctx.size = tpm2_nv_util_max_allowed_nv_size(ectx, true);
             }
             break;
         case TPM2_NT_COUNTER:
@@ -335,11 +265,11 @@
             break;
         case TPM2_NT_EXTEND:
             if (!ctx.size_set) {
-                // Currently the NV define doesn't allow changing name algorithm, so this OK
-                ctx.size = TPM2_SHA256_DIGEST_SIZE;
-            } else if (ctx.size != TPM2_SHA256_DIGEST_SIZE) {
+                ctx.size = hash_size;
+            } else if (ctx.size != hash_size) {
                 LOG_ERR("Size is invalid for an NV index type: \"extend\","
-                        " it must match the name hash algorithm size of 32");
+                        " it must match the name hash algorithm size of %"
+                        PRIu16, hash_size);
                 return tool_rc_general_error;
             }
             break;
@@ -348,20 +278,17 @@
     return tool_rc_success;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
-
-    UNUSED(flags);
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Invalid authorization");
-        return rc;
-    }
+    /*
+     * 1. Object and auth initializations
+     */
 
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
     tpm2_session *tmp;
-    rc = tpm2_auth_util_from_optarg(NULL, ctx.index_auth_str, &tmp, true);
+    tool_rc rc = tpm2_auth_util_from_optarg(NULL, ctx.index_auth_str, &tmp, true);
     if (rc != tool_rc_success) {
         LOG_ERR("Invalid index authorization");
         return rc;
@@ -372,6 +299,35 @@
 
     tpm2_session_close(&tmp);
 
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    rc = (!ctx.is_tcti_none) ?
+        tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P) :
+
+        tpm2_util_object_load(ectx, ctx.auth_hierarchy.ctx_path,
+            &ctx.auth_hierarchy.object,
+            TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid handle or authorization.");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations dependent on loaded objects
+     */
     handle_default_attributes();
 
     if (!ctx.nv_index) {
@@ -386,16 +342,228 @@
         return rc;
     }
 
-    return nv_space_define(ectx);
+    ctx.public_info.nvPublic.nvIndex = ctx.nv_index;
+    ctx.public_info.nvPublic.nameAlg = ctx.halg;
+    ctx.public_info.nvPublic.attributes = ctx.nv_attribute;
+    ctx.public_info.nvPublic.dataSize = ctx.size;
+
+    if (ctx.policy_file) {
+        ctx.public_info.nvPublic.authPolicy.size = BUFFER_SIZE(TPM2B_DIGEST,
+            buffer);
+
+        bool is_policy_load = files_load_bytes_from_path(ctx.policy_file,
+            ctx.public_info.nvPublic.authPolicy.buffer,
+            &ctx.public_info.nvPublic.authPolicy.size);
+        if (!is_policy_load) {
+            return tool_rc_general_error;
+        }
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /* 4.a Determine pHash length and alg */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * is_tcti_none       N
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.is_tcti_none ||
+        (ctx.cp_hash_path && !ctx.rp_hash_path)) ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(tpm2_option_flags flags) {
+
+    if (!ctx.size && ctx.size_set) {
+        LOG_WARN("Defining an index with size 0");
+    }
+
+    ctx.is_tcti_none = flags.tcti_none ? true : false;
+    if (ctx.is_tcti_none && !ctx.cp_hash_path) {
+        LOG_ERR("If tcti is none, then cpHash path must be specified");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * TODO: Add error checking for NV ranges reserved for specific hierarchies
+     */
+
+    return tool_rc_success;
+}
+
+static bool on_option(char key, char *value) {
+
+    bool result;
+
+    switch (key) {
+    case 'C':
+        ctx.auth_hierarchy.ctx_path = value;
+        break;
+    case 'P':
+        ctx.auth_hierarchy.auth_str = value;
+        break;
+    case 's':
+        ctx.size_set = true;
+        result = tpm2_util_string_to_uint16(value, &ctx.size);
+        if (!result) {
+            LOG_ERR("Could not convert size to number, got: \"%s\"", value);
+            return false;
+        }
+        break;
+    case 'a':
+        result = tpm2_util_string_to_uint32(value, &ctx.nv_attribute);
+        if (!result) {
+            result = tpm2_attr_util_nv_strtoattr(value, &ctx.nv_attribute);
+            if (!result) {
+                LOG_ERR(
+                        "Could not convert NV attribute to number or keyword, got: \"%s\"",
+                        value);
+                return false;
+            }
+        }
+        break;
+    case 'p':
+        ctx.index_auth_str = value;
+        break;
+    case 'L':
+        ctx.policy_file = value;
+        break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            return false;
+        }
+        break;
+    case 'g':
+        ctx.halg = tpm2_alg_util_from_optarg(value,
+                tpm2_alg_util_flags_hash);
+        if (ctx.halg == TPM2_ALG_ERROR) {
+            LOG_ERR("Invalid choice for name digest hash algorithm");
+            return false;
+        }
+        break;
+    }
+
+    return true;
+}
+
+static bool on_arg(int argc, char **argv) {
+
+    return on_arg_nv_index(argc, argv, &ctx.nv_index);
+}
+
+static bool tpm2_tool_onstart(tpm2_options **opts) {
+
+    const struct option topts = {
+        { "hierarchy",      required_argument, NULL, 'C' },
+        { "size",           required_argument, NULL, 's' },
+        { "attributes",     required_argument, NULL, 'a' },
+        { "hierarchy-auth", required_argument, NULL, 'P' },
+        { "hash-algorithm", required_argument, NULL, 'g' },
+        { "index-auth",     required_argument, NULL, 'p' },
+        { "policy",         required_argument, NULL, 'L' },
+        { "cphash",         required_argument, NULL,  0  },
+        { "rphash",         required_argument, NULL,  1  },
+        { "session",        required_argument, NULL, 'S' },
+    };
+
+    *opts = tpm2_options_new("S:C:s:a:P:p:L:g:", ARRAY_LEN(topts), topts,
+        on_option, on_arg, TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI);
+
+    return *opts != NULL;
+}
+
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+
+    UNUSED(flags);
+
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(flags);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = nv_space_define(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    if (!ctx.cp_hash_path) {
-        return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
-    return tool_rc_success;
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("nvdefine", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("nvdefine", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_nvextend.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_nvextend.c Changed

@@ -8,8 +8,14 @@
 #include "tpm2_nv_util.h"
 #include "tpm2_options.h"
 
+
 typedef struct tpm_nvextend_ctx tpm_nvextend_ctx;
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2
 struct tpm_nvextend_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -18,20 +24,197 @@
 
     const char *input_path;
     TPM2_HANDLE nv_index;
+    TPM2B_NAME precalc_nvname;
+    TPM2B_MAX_NV_BUFFER data;
+
+    /*
+     * Outputs
+     */
 
-    char *cp_hash_path;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    bool is_tcti_none;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
 };
 
-static tpm_nvextend_ctx ctx;
+static tpm_nvextend_ctx ctx = {
+    .data.size = sizeof(ctx.data.buffer),
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+};
 
-static bool on_arg(int argc, char **argv) {
-    /* If the user doesn't specify an authorization hierarchy use the index
-     * passed to -x/--index for the authorization index.
+static tool_rc nvextend(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. TPM2_CC_<command> OR Retrieve cpHash
      */
-    if (!ctx.auth_hierarchy.ctx_path) {
-        ctx.auth_hierarchy.ctx_path = argv0;
+    return tpm2_nvextend(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
+        &ctx.data, &ctx.cp_hash, &ctx.rp_hash, ctx.parameter_hash_algorithm,
+        &ctx.precalc_nvname, ctx.aux_session_handle0,
+        ctx.aux_session_handle1);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
     }
-    return on_arg_nv_index(argc, argv, &ctx.nv_index);
+
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+    }
+
+    return is_file_op_success ? tool_rc_success : tool_rc_general_error;
+}
+
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tool_rc_success;
+    if (ctx.is_tcti_none) {
+        /*
+         * Cannot use tpm2_util_object_load like in nvdefine as it makes a call
+         * to tpm2_util_sys_handle_to_esys_handle which then tries to read the
+         * ESYS_TR object off of the TPM expecting it to be there.
+         * Note: this if it is a permanent handle ESYS_TR is fixed and so the
+         * TPM is not probed even with tpm2_util_sys_handle_to_esys_handle.
+         */
+        rc = tpm2_util_handle_from_optarg(ctx.auth_hierarchy.ctx_path,
+            &ctx.auth_hierarchy.object.handle,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P) ?
+        tool_rc_success : tool_rc_option_error;
+
+         ctx.auth_hierarchy.object.tr_handle = (rc == tool_rc_success) ?
+            tpm2_tpmi_hierarchy_to_esys_tr(ctx.auth_hierarchy.object.handle) : 0;
+    } else {
+        rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    }
+
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid handle authorization");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations dependent on loaded objects
+     */
+    ctx.input_path = strcmp(ctx.input_path, "-") ? ctx.input_path : NULL;
+
+    bool result = files_load_bytes_from_buffer_or_file_or_stdin(NULL,
+            ctx.input_path, &ctx.data.size, ctx.data.buffer);
+    if (!result) {
+        return tool_rc_general_error;
+    }
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /* 4.a Determine pHash length and alg */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * is_tcti_none       N
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.is_tcti_none ||
+        (ctx.cp_hash_path && !ctx.rp_hash_path)) ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(tpm2_option_flags flags) {
+
+    ctx.is_tcti_none = flags.tcti_none ? true : false;
+    if (ctx.is_tcti_none && !ctx.cp_hash_path) {
+        LOG_ERR("If tcti is none, then cpHash path must be specified");
+        return tool_rc_option_error;
+    }
+
+    bool is_nv_name_specified = ctx.precalc_nvname.size;
+    if (ctx.is_tcti_none && !is_nv_name_specified) {
+        LOG_ERR("Must specify the NVIndex name.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.is_tcti_none && is_nv_name_specified) {
+        LOG_ERR("Do not specify NVIndex name, it is directly read from NV");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.input_path) {
+        LOG_ERR("Must specify source of data to write to NV index");
+        return tool_rc_general_error;
+    }
+
+    return tool_rc_success;
 }
 
 static bool on_option(char key, char *value) {
@@ -50,11 +233,42 @@
     case 0:
         ctx.cp_hash_path = value;
         break;
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            return false;
+        }
+        break;
+    case 'n':
+        ctx.precalc_nvname.size = BUFFER_SIZE(TPM2B_NAME, name);
+        int q = tpm2_util_hex_to_byte_structure(value, &ctx.precalc_nvname.size,
+        ctx.precalc_nvname.name);
+        if (q) {
+            LOG_ERR("FAILED: %d", q);
+            return false;
+        }
+        break;
     }
 
     return true;
 }
 
+static bool on_arg(int argc, char **argv) {
+    /*
+     * If the user doesn't specify an authorization hierarchy use the index.
+     */
+    if (!ctx.auth_hierarchy.ctx_path) {
+        ctx.auth_hierarchy.ctx_path = argv0;
+    }
+
+    return on_arg_nv_index(argc, argv, &ctx.nv_index);
+}
+
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
@@ -62,10 +276,13 @@
         { "auth",      required_argument, NULL, 'P' },
         { "input",     required_argument, NULL, 'i' },
         { "cphash",    required_argument, NULL,  0  },
+        { "rphash",    required_argument, NULL,  1  },
+        { "session",   required_argument, NULL, 'S' },
+        { "name",      required_argument, NULL, 'n' },
     };
 
-    *opts = tpm2_options_new("C:P:i:", ARRAY_LEN(topts), topts, on_option,
-            on_arg, 0);
+    *opts = tpm2_options_new("S:C:P:i:n:", ARRAY_LEN(topts), topts, on_option,
+            on_arg, TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI);
 
     return *opts != NULL;
 }
@@ -74,54 +291,67 @@
 
     UNUSED(flags);
 
-    ctx.input_path = strcmp(ctx.input_path, "-") ? ctx.input_path : NULL;
-
-    TPM2B_MAX_NV_BUFFER data = { .size = sizeof(data.buffer) };
-
-    bool result = files_load_bytes_from_buffer_or_file_or_stdin(NULL,
-            ctx.input_path, &data.size, data.buffer);
-    if (!result) {
-        return tool_rc_general_error;
-    }
-
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(flags);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid handle authorization");
         return rc;
     }
 
-    if (!ctx.cp_hash_path) {
-        return tpm2_nvextend(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
-            &data, NULL);
-    }
-
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = tpm2_nvextend(ectx, &ctx.auth_hierarchy.object, ctx.nv_index, &data,
-        &cp_hash);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = nvextend(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
-
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
 
     UNUSED(ectx);
+    /*
+     * 1. Free objects
+     */
 
-    if (!ctx.cp_hash_path) {
-        return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
 
-    return tool_rc_success;
+    /*
+     * 3. Close auxiliary sessions
+     */
+    uint8_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+        }
+        if (tmp_rc != tool_rc_success) {
+            rc = tmp_rc;
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("nvextend", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("nvextend", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_nvincrement.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_nvincrement.c Changed

@@ -6,8 +6,13 @@
 #include "tpm2_nv_util.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2
 typedef struct tpm_nvincrement_ctx tpm_nvincrement_ctx;
 struct tpm_nvincrement_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -15,14 +20,221 @@
     } auth_hierarchy;
 
     TPM2_HANDLE nv_index;
+    TPM2B_NAME precalc_nvname;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    bool is_tcti_none;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
+};
 
-    char *cp_hash_path;
+static tpm_nvincrement_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
 };
-static tpm_nvincrement_ctx ctx;
+
+static tool_rc nv_increment(ESYS_CONTEXT *ectx) {
+
+    tool_rc rc = tpm2_nv_increment(ectx, &ctx.auth_hierarchy.object,
+        ctx.nv_index, &ctx.precalc_nvname, &ctx.cp_hash, &ctx.rp_hash,
+        ctx.parameter_hash_algorithm, ctx.aux_session_handle0,
+        ctx.aux_session_handle1);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to increment NV counter at index 0x%X", ctx.nv_index);
+    }
+
+    return rc;
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+        rc = is_file_op_success ? tool_rc_success : tool_rc_general_error;
+    }
+
+    return rc;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    /*
+     * When tcti is none AND only calculating cpHash only load the object
+     * strings to calculate the names.
+     */
+    tool_rc rc = tool_rc_success;
+    if (ctx.is_tcti_none) {
+        /*
+         * Cannot use tpm2_util_object_load like in nvdefine as it makes a call
+         * to tpm2_util_sys_handle_to_esys_handle which then tries to read the
+         * ESYS_TR object off of the TPM expecting it to be there.
+         * Note: this if it is a permanent handle ESYS_TR is fixed and so the
+         * TPM is not probed even with tpm2_util_sys_handle_to_esys_handle.
+         */
+        rc = tpm2_util_handle_from_optarg(ctx.auth_hierarchy.ctx_path,
+            &ctx.auth_hierarchy.object.handle,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P) ?
+            tool_rc_success : tool_rc_option_error;
+
+        ctx.auth_hierarchy.object.tr_handle = (rc == tool_rc_success) ?
+           tpm2_tpmi_hierarchy_to_esys_tr(ctx.auth_hierarchy.object.handle) : 0;
+    } else {
+        rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    }
+
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid handle or authorization.");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+
+    UNUSED(ectx);
+
+    ctx.is_tcti_none = flags.tcti_none ? true : false;
+    if (ctx.is_tcti_none && !ctx.cp_hash_path) {
+        LOG_ERR("If tcti is none, then cpHash path must be specified");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * Peculiar to this and some other tools, the object (nvindex) name must
+     * be specified when only calculating the cpHash.
+     *
+     * This breaks the compatibility with the 4.X tools where in a real tcti
+     * is invoked to get a sapi handle to retrieve the params. Also this would
+     * imply that a real NV index ought to be defined even in the case of simply
+     * calculating the cpHash.
+     *
+     * To solve this conundrum, we can only mandate the requirement for the NV
+     * index name in case tcti is specified as none. If tcti is not specified as
+     * none we fall back to the old behavior of reading from a define NV index
+     * 
+     * Also, tcti is setup to a fake_tcti when tcti is specified "none" as the
+     * tool option affords TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI.
+     * 
+     * If NVindex name is not specified and tcti is not none, it is expected
+     * that the NV index is actually define. This behavior complies with the
+     * backwards compatibility with 4.X
+     */
+    bool is_nv_name_specified = ctx.precalc_nvname.size;
+    if (ctx.is_tcti_none && !is_nv_name_specified) {
+        LOG_ERR("Must specify the NVIndex name.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.is_tcti_none && is_nv_name_specified) {
+        LOG_ERR("Do not specify NVIndex name, it is directly read from NV");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * is_tcti_none       N
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.is_tcti_none ||
+        (ctx.cp_hash_path && !ctx.rp_hash_path)) ? false : true;
+
+    return tool_rc_success;
+}
 
 static bool on_arg(int argc, char **argv) {
-    /* If the user doesn't specify an authorization hierarchy use the index
-     * passed to -x/--index for the authorization index.
+    /*
+     * If the user doesn't specify an authorization hierarchy use the index
      */
     if (!ctx.auth_hierarchy.ctx_path) {
         ctx.auth_hierarchy.ctx_path = argv0;
@@ -42,6 +254,27 @@
     case 0:
         ctx.cp_hash_path = value;
         break;
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
+    case 'n':
+        ctx.precalc_nvname.size = BUFFER_SIZE(TPM2B_NAME, name);
+        int q = tpm2_util_hex_to_byte_structure(value, &ctx.precalc_nvname.size,
+        ctx.precalc_nvname.name);
+        if (q) {
+            LOG_ERR("FAILED: %d", q);
+            return false;
+        }
+        break;
     }
 
     return true;
@@ -53,56 +286,81 @@
         { "hierarchy", required_argument, NULL, 'C' },
         { "auth",      required_argument, NULL, 'P' },
         { "cphash",    required_argument, NULL,  0  },
+        { "rphash",    required_argument, NULL,  1  },
+        { "name",      required_argument, NULL, 'n' },
+        { "session",   required_argument, NULL, 'S' },
     };
 
-    *opts = tpm2_options_new("C:P:", ARRAY_LEN(topts), topts, on_option, on_arg,
-            0);
+    *opts = tpm2_options_new("C:P:S:n:", ARRAY_LEN(topts), topts, on_option,
+        on_arg, TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI);
 
     return *opts != NULL;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
-    UNUSED(flags);
-
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx, flags);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid handle authorization");
         return rc;
     }
 
-    if (!ctx.cp_hash_path) {
-        rc = tpm2_nv_increment(ectx, &ctx.auth_hierarchy.object, ctx.nv_index, NULL);
-        if (rc != tool_rc_success) {
-            LOG_ERR("Failed to increment NV counter at index 0x%X", ctx.nv_index);
-        }
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
         return rc;
     }
 
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = tpm2_nv_increment(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
-        &cp_hash);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = nv_increment(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
-    }
-
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    if (!ctx.cp_hash_path) {
-        return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
-    return tool_rc_success;
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("nvincrement", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("nvincrement", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_nvread.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_nvread.c Changed

@@ -7,8 +7,13 @@
 #include "tpm2_nv_util.h"
 #include "tpm2_options.h"
 
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2
 typedef struct tpm_nvread_ctx tpm_nvread_ctx;
 struct tpm_nvread_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -16,54 +21,262 @@
     } auth_hierarchy;
 
     TPM2_HANDLE nv_index;
-
+    TPM2B_NAME precalc_nvname;
     UINT32 size_to_read;
     UINT32 offset;
+    bool is_yaml;
+
+    /*
+     * Outputs
+     */
     char *output_file;
+    UINT8* data_buffer;
+    UINT16 bytes_written;
+    TPM2B_NV_PUBLIC *nv_public;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    bool is_tcti_none;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
+};
 
-    char *cp_hash_path;
+static tpm_nvread_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
 };
 
-static tpm_nvread_ctx ctx;
+static tool_rc nv_read(ESYS_CONTEXT *ectx) {
+
+    return tpm2_util_nv_read(ectx, ctx.nv_index, ctx.size_to_read,
+        ctx.offset, &ctx.auth_hierarchy.object, &ctx.data_buffer,
+        &ctx.bytes_written, &ctx.cp_hash, &ctx.rp_hash,
+        ctx.parameter_hash_algorithm, &ctx.precalc_nvname,
+        ctx.aux_session_handle0, ctx.aux_session_handle1, &ctx.nv_public);
+}
 
-static tool_rc nv_read(ESYS_CONTEXT *ectx, tpm2_option_flags flags,
-    TPM2B_DIGEST *cp_hash) {
+static tool_rc process_output(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
-    UINT8* data_buffer = NULL;
-    UINT16 bytes_written = 0;
-    tool_rc rc = tpm2_util_nv_read(ectx, ctx.nv_index, ctx.size_to_read,
-            ctx.offset, &ctx.auth_hierarchy.object, &data_buffer, &bytes_written,
-            cp_hash);
-    if (rc != tool_rc_success || cp_hash != NULL) {
-        goto out;
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
     }
 
-    /* dump data_buffer to output file, if specified */
-    if (ctx.output_file) {
-        if (!files_save_bytes_to_file(ctx.output_file, data_buffer,
-                bytes_written)) {
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    /* dump ctx.data_buffer to output file, if specified */
+    tool_rc rc = tool_rc_success;
+    if (ctx.is_yaml) {
+        tpm2_util_tpm2_nv_to_yaml(ctx.nv_public, ctx.data_buffer, ctx.bytes_written, 0);
+    } else if (ctx.output_file) {
+        if (!files_save_bytes_to_file(ctx.output_file, ctx.data_buffer,
+                ctx.bytes_written)) {
             rc = tool_rc_general_error;
             goto out;
         }
         /* else use stdout if quiet is not specified */
     } else if (!flags.quiet) {
-        if (!files_write_bytes(stdout, data_buffer, bytes_written)) {
+        if (!files_write_bytes(stdout, ctx.data_buffer, ctx.bytes_written)) {
             rc = tool_rc_general_error;
             goto out;
         }
     }
 
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+        rc = is_file_op_success ? tool_rc_success : tool_rc_general_error;
+    }
+
 out:
-    if (data_buffer) {
-        free(data_buffer);
+    return rc;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    /*
+     * When tcti is none AND only calculating cpHash only load the object
+     * strings to calculate the names.
+     */
+    tool_rc rc = tool_rc_success;
+    if (ctx.is_tcti_none) {
+        /*
+         * Cannot use tpm2_util_object_load like in nvdefine as it makes a call
+         * to tpm2_util_sys_handle_to_esys_handle which then tries to read the
+         * ESYS_TR object off of the TPM expecting it to be there.
+         * Note: this if it is a permanent handle ESYS_TR is fixed and so the
+         * TPM is not probed even with tpm2_util_sys_handle_to_esys_handle.
+         */
+        rc = tpm2_util_handle_from_optarg(ctx.auth_hierarchy.ctx_path,
+            &ctx.auth_hierarchy.object.handle,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P) ?
+            tool_rc_success : tool_rc_option_error;
+
+        ctx.auth_hierarchy.object.tr_handle = (rc == tool_rc_success) ?
+           tpm2_tpmi_hierarchy_to_esys_tr(ctx.auth_hierarchy.object.handle) : 0;
+    } else {
+        rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    }
+
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid handle authorization.");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
     return rc;
 }
 
+static tool_rc check_options(tpm2_option_flags flags) {
+
+    ctx.is_tcti_none = flags.tcti_none ? true : false;
+    if (ctx.is_tcti_none && !ctx.cp_hash_path) {
+        LOG_ERR("If tcti is none, then cpHash path must be specified");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * Peculiar to this and some other tools, the object (nvindex) name must
+     * be specified when only calculating the cpHash.
+     *
+     * This breaks the compatibility with the 4.X tools where in a real tcti
+     * is invoked to get a sapi handle to retrieve the params. Also this would
+     * imply that a real NV index ought to be defined even in the case of simply
+     * calculating the cpHash.
+     *
+     * To solve this conundrum, we can only mandate the requirement for the NV
+     * index name in case tcti is specified as none. If tcti is not specified as
+     * none we fall back to the old behavior of reading from a define NV index
+     * 
+     * Also, tcti is setup to a fake_tcti when tcti is specified "none" as the
+     * tool option affords TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI.
+     * 
+     * If NVindex name is not specified and tcti is not none, it is expected
+     * that the NV index is actually define. This behavior complies with the
+     * backwards compatibility with 4.X
+     */
+    bool is_nv_name_specified = ctx.precalc_nvname.size;
+    if (ctx.is_tcti_none && !is_nv_name_specified) {
+        LOG_ERR("Must specify the NVIndex name.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.is_tcti_none && is_nv_name_specified) {
+        LOG_ERR("Do not specify NVIndex name, it is directly read from NV");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * is_tcti_none       N
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.is_tcti_none ||
+        (ctx.cp_hash_path && !ctx.rp_hash_path)) ? false : true;
+
+    if (!ctx.size_to_read) {
+        if(ctx.is_command_dispatch) {
+            LOG_WARN("Reading full size of the NV index");
+        } else {
+            LOG_ERR("Must specify the size to read.");
+            return tool_rc_option_error;
+        }
+    }
+
+    #define TYPICAL_NVACCESS_MAX 1024
+    #define TYPICAL_NVINDEX_MAX 2048
+    if (!ctx.is_command_dispatch) {
+        if (ctx.size_to_read > TYPICAL_NVACCESS_MAX) {
+            LOG_WARN("Calculating cpHash with NV access size larger than typical.");
+        }
+
+        if ((ctx.size_to_read + ctx.offset) > TYPICAL_NVINDEX_MAX) {
+            LOG_WARN("Calculating cpHash with NV index size larger than typical");
+        }
+    }
+
+    return tool_rc_success;
+}
+
 static bool on_arg(int argc, char **argv) {
-    /* If the user doesn't specify an authorization hierarchy use the index
-     * passed to -x/--index for the authorization index.
+    /*
+     * If the user doesn't specify an authorization hierarchy use the index
+     * for the authorization index.
      */
     if (!ctx.auth_hierarchy.ctx_path) {
         ctx.auth_hierarchy.ctx_path = argv0;
@@ -93,6 +306,15 @@
             return false;
         }
         break;
+    case 'n':
+        ctx.precalc_nvname.size = BUFFER_SIZE(TPM2B_NAME, name);
+        int q = tpm2_util_hex_to_byte_structure(value, &ctx.precalc_nvname.size,
+        ctx.precalc_nvname.name);
+        if (q) {
+            LOG_ERR("FAILED: %d", q);
+            return false;
+        }
+        break;
     case 0:
         result = tpm2_util_string_to_uint32(value, &ctx.offset);
         if (!result) {
@@ -103,6 +325,21 @@
     case 1:
         ctx.cp_hash_path = value;
         break;
+    case 2:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
+    case 3:
+        ctx.is_yaml = true;
+        break;
         /* no default */
     }
     return true;
@@ -116,50 +353,91 @@
         { "size",      required_argument, NULL, 's' },
         { "offset",    required_argument, NULL,  0  },
         { "cphash",    required_argument, NULL,  1  },
+        { "rphash",    required_argument, NULL,  2  },
+        { "name",      required_argument, NULL, 'n' },
         { "auth",      required_argument, NULL, 'P' },
+        { "session",   required_argument, NULL, 'S' },
+        { "print-yaml",      no_argument, NULL,  3  },
     };
 
-    *opts = tpm2_options_new("C:s:o:P:", ARRAY_LEN(topts), topts, on_option,
-            on_arg, 0);
+    *opts = tpm2_options_new("C:s:o:P:n:S:", ARRAY_LEN(topts), topts, on_option,
+            on_arg, TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI);
+
+    if (ctx.is_yaml) {
+        ctx.offset = 0;
+        ctx.size_to_read = 0;
+    }
 
     return *opts != NULL;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
-    UNUSED(flags);
-
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(flags);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid handle authorization");
         return rc;
     }
 
-    if (!ctx.cp_hash_path) {
-        return nv_read(ectx, flags, NULL);
-    }
-
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = nv_read(ectx, flags, &cp_hash);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("CpHash calculation failed!");
         return rc;
     }
 
-    bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = nv_read(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx, flags);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    /*
+     * 1. Free objects
+     */
+    if (ctx.data_buffer) {
+        free(ctx.data_buffer);
+    }
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
+    }
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("nvread", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("nvread", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_nvreadlock.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_nvreadlock.c Changed

@@ -8,8 +8,13 @@
 #include "tpm2_nv_util.h"
 #include "tpm2_options.h"
 
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2
 typedef struct tpm_nvreadlock_ctx tpm_nvreadlock_ctx;
 struct tpm_nvreadlock_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -17,15 +22,204 @@
     } auth_hierarchy;
 
     TPM2_HANDLE nv_index;
+    TPM2B_NAME precalc_nvname;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    bool is_tcti_none;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
+};
 
-    char *cp_hash_path;
+static tpm_nvreadlock_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
 };
 
-static tpm_nvreadlock_ctx ctx;
+tool_rc nv_readlock(ESYS_CONTEXT *ectx) {
+
+    return tpm2_nvreadlock(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
+        &ctx.precalc_nvname, &ctx.cp_hash, &ctx.rp_hash,
+        ctx.parameter_hash_algorithm, ctx.aux_session_handle0,
+        ctx.aux_session_handle1);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+        rc = is_file_op_success ? tool_rc_success : tool_rc_general_error;
+    }
+
+    return rc;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    tool_rc rc = tool_rc_success;
+    tpm2_handle_flags valid_handles =
+        TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P | TPM2_HANDLE_FLAGS_NV;
+    if (ctx.is_tcti_none) {
+         rc = tpm2_util_handle_from_optarg(ctx.auth_hierarchy.ctx_path,
+             &ctx.auth_hierarchy.object.handle, valid_handles) ?
+             tool_rc_success : tool_rc_option_error;
+
+         ctx.auth_hierarchy.object.tr_handle = (rc == tool_rc_success) ?
+            tpm2_tpmi_hierarchy_to_esys_tr(ctx.auth_hierarchy.object.handle) : 0;
+     } else {
+         rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+             ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+             valid_handles);
+     }
+
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid handle or authorization.");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    return rc;
+}
+
+static tool_rc check_options(tpm2_option_flags flags) {
+
+    ctx.is_tcti_none = flags.tcti_none ? true : false;
+    if (ctx.is_tcti_none && !ctx.cp_hash_path) {
+        LOG_ERR("If tcti is none, then cpHash path must be specified");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * Peculiar to this and some other tools, the object (nvindex) name must
+     * be specified when only calculating the cpHash.
+     *
+     * This breaks the compatibility with the 4.X tools where in a real tcti
+     * is invoked to get a sapi handle to retrieve the params. Also this would
+     * imply that a real NV index ought to be defined even in the case of simply
+     * calculating the cpHash.
+     *
+     * To solve this conundrum, we can only mandate the requirement for the NV
+     * index name in case tcti is specified as none. If tcti is not specified as
+     * none we fall back to the old behavior of reading from a define NV index
+     * 
+     * Also, tcti is setup to a fake_tcti when tcti is specified "none" as the
+     * tool option affords TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI.
+     * 
+     * If NVindex name is not specified and tcti is not none, it is expected
+     * that the NV index is actually define. This behavior complies with the
+     * backwards compatibility with 4.X
+     */
+    bool is_nv_name_specified = ctx.precalc_nvname.size;
+    if (ctx.is_tcti_none && !is_nv_name_specified) {
+        LOG_ERR("Must specify the NVIndex name.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.is_tcti_none && is_nv_name_specified) {
+        LOG_ERR("Do not specify NVIndex name, it is directly read from NV");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * is_tcti_none       N
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.is_tcti_none ||
+        (ctx.cp_hash_path && !ctx.rp_hash_path)) ? false : true;
+
+    return tool_rc_success;
+}
 
 static bool on_arg(int argc, char **argv) {
-    /* If the user doesn't specify an authorization hierarchy use the index
-     * passed to -x/--index for the authorization index.
+    /*
+     * If the user doesn't specify an authorization hierarchy use the index
      */
     if (!ctx.auth_hierarchy.ctx_path) {
         ctx.auth_hierarchy.ctx_path = argv0;
@@ -46,6 +240,27 @@
     case 0:
         ctx.cp_hash_path = value;
         break;
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
+    case 'n':
+        ctx.precalc_nvname.size = BUFFER_SIZE(TPM2B_NAME, name);
+        int q = tpm2_util_hex_to_byte_structure(value, &ctx.precalc_nvname.size,
+        ctx.precalc_nvname.name);
+        if (q) {
+            LOG_ERR("FAILED: %d", q);
+            return false;
+        }
+        break;
     }
 
     return true;
@@ -57,10 +272,13 @@
         { "hierarchy", required_argument, NULL, 'C' },
         { "auth",      required_argument, NULL, 'P' },
         { "cphash",    required_argument, NULL,  0  },
+        { "rphash",    required_argument, NULL,  1  },
+        { "session",   required_argument, NULL, 'S' },
+        { "name",      required_argument, NULL, 'n' },
     };
 
-    *opts = tpm2_options_new("C:P:", ARRAY_LEN(topts), topts, on_option, on_arg,
-            0);
+    *opts = tpm2_options_new("C:P:S:n:", ARRAY_LEN(topts), topts, on_option,
+        on_arg, TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI);
 
     return *opts != NULL;
 }
@@ -69,41 +287,68 @@
 
     UNUSED(flags);
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(flags);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid handle authorization");
         return rc;
     }
 
-    if (!ctx.cp_hash_path) {
-        return tpm2_nvreadlock(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
-            NULL);
-    }
-
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = tpm2_nvreadlock(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
-        &cp_hash);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = nv_readlock(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    if (!ctx.cp_hash_path) {
-        return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
-    return tool_rc_success;
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("nvreadlock", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("nvreadlock", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_nvreadpublic.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_nvreadpublic.c Changed

@@ -2,19 +2,77 @@
 
 #include <stdlib.h>
 
+#include "files.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_attr_util.h"
 #include "tpm2_nv_util.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 3
 typedef struct tpm2_nvreadpublic_ctx tpm2_nvreadpublic_ctx;
 struct tpm2_nvreadpublic_ctx {
+    /*
+     * Inputs
+     */
     TPMI_RH_NV_INDEX nv_index;
+    TPMS_CAPABILITY_DATA *capability_data;
+    TPM2B_NAME precalc_nvname;
+
+    /*
+     * Outputs
+     */
+    TPM2B_NV_PUBLIC **nv_public_list;
+  
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    bool is_tcti_none;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
 };
 
-static tpm2_nvreadpublic_ctx ctx;
+static tpm2_nvreadpublic_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
+    .aux_session_handle2 = ESYS_TR_NONE,
+};
+
+static tool_rc nv_readpublic(ESYS_CONTEXT *ectx) {
 
-static tool_rc print_nv_public(ESYS_CONTEXT *context, TPMI_RH_NV_INDEX index, TPM2B_NV_PUBLIC *nv_public) {
+    tool_rc rc = tool_rc_success;
+    uint32_t i;
+    for (i = 0; i < ctx.capability_data->data.handles.count; i++) {
+        rc = tpm2_util_nv_read_public(ectx,
+            ctx.capability_data->data.handles.handlei, &ctx.precalc_nvname,
+            &ctx.nv_public_listi, &ctx.cp_hash, &ctx.rp_hash,
+            ctx.parameter_hash_algorithm, ctx.aux_session_handle0,
+            ctx.aux_session_handle1, ctx.aux_session_handle2);
+        if (rc != tool_rc_success) {
+            LOG_ERR("Failed to read the public part of NV index 0x%X",
+                ctx.capability_data->data.handles.handlei);
+            break;
+        }
+    }
+
+    return rc;
+}
+
+static tool_rc print_nv_public(ESYS_CONTEXT *context, TPMI_RH_NV_INDEX index,
+    TPM2B_NV_PUBLIC *nv_public) {
 
     ESYS_TR tr_handle = ESYS_TR_NONE;
     tool_rc rc = tpm2_tr_from_tpm_public(context, index,
@@ -61,7 +119,7 @@
     tpm2_tool_output("  attributes:\n");
     tpm2_tool_output("    friendly: %s\n", attrs);
     tpm2_tool_output("    value: 0x%X\n",
-            tpm2_util_ntoh_32(nv_public->nvPublic.attributes));
+            nv_public->nvPublic.attributes);
 
     tpm2_tool_output("  size: %d\n", nv_public->nvPublic.dataSize);
 
@@ -80,47 +138,198 @@
     return tool_rc_success;
 }
 
-static tool_rc nv_readpublic(ESYS_CONTEXT *context) {
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-    TPMS_CAPABILITY_DATA *capability_data = NULL;
-    if (ctx.nv_index == 0) {
-        tool_rc rc = tpm2_getcap(context, TPM2_CAP_HANDLES, TPM2_HT_NV_INDEX << 24,
-                TPM2_PT_NV_INDEX_MAX, NULL, &capability_data);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-    } else {
-        capability_data = calloc(1, sizeof(*capability_data));
-        if (!capability_data) {
-            LOG_ERR("oom");
+        if (!is_file_op_success) {
             return tool_rc_general_error;
         }
-        capability_data->data.handles.count = 1;
-        capability_data->data.handles.handle0 = ctx.nv_index;
     }
-    UINT32 i;
-    for (i = 0; i < capability_data->data.handles.count; i++) {
-        TPMI_RH_NV_INDEX index = capability_data->data.handles.handlei;
 
-        TPM2B_NV_PUBLIC *nv_public;
-        tool_rc rc = tpm2_util_nv_read_public(context, index, &nv_public);
-        if (rc != tool_rc_success) {
-            LOG_ERR("Failed to read the public part of NV index 0x%X", index);
-            free(capability_data);
-            return rc;
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    uint32_t i;
+    for (i = 0; i < ctx.capability_data->data.handles.count; i++) {
+        if (ctx.is_command_dispatch) {
+            rc = print_nv_public(ectx,
+                ctx.capability_data->data.handles.handlei,
+                ctx.nv_public_listi);
+            tpm2_tool_output("\n");
+            if (rc != tool_rc_success) {
+                return rc;
+            }
         }
+    }
 
-        rc = print_nv_public(context, index, nv_public);
-        free(nv_public);
-        tpm2_tool_output("\n");
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+        rc = is_file_op_success ? tool_rc_success : tool_rc_general_error;
+    }
+
+    return rc;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    tool_rc rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations dependent on loaded objects
+     */
+    if (ctx.nv_index == 0 && ctx.is_command_dispatch) {
+        rc = tpm2_getcap(ectx, TPM2_CAP_HANDLES,
+            TPM2_HT_NV_INDEX << 24, TPM2_PT_NV_INDEX_MAX, NULL,
+            &ctx.capability_data);
         if (rc != tool_rc_success) {
-            free(capability_data);
             return rc;
         }
     }
+    
+    if (ctx.nv_index != 0 || !ctx.is_command_dispatch) {
+        /*
+         * This path is taken for calculating cpHash as NV index cannot be 0
+         * with cpHash option specified
+         */
+        ctx.capability_data = calloc(1, sizeof(*ctx.capability_data));
+        if (!ctx.capability_data) {
+            LOG_ERR("oom");
+            return tool_rc_general_error;
+        }
+        ctx.capability_data->data.handles.count = 1;
+        ctx.capability_data->data.handles.handle0 = ctx.nv_index;
+    }
+
+    /*
+     * Allocate space for holding NV public data for all indices.
+     * Individual index NV public structure is allocated by Esys_NV_ReadPublic.
+     */
+    ctx.nv_public_list =
+    malloc(ctx.capability_data->data.handles.count * sizeof(TPM2B_NV_PUBLIC*));
+    /*
+     * When calculating cpHash only, Esys_NV_Readpublic isn't invoked and so
+     * allocate space for one index.
+     */
+    if (!ctx.is_command_dispatch) {
+        ctx.nv_public_list0 = malloc(sizeof(TPM2B_NV_PUBLIC));
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.aux_session0,
+        ctx.aux_session1,
+        ctx.aux_session2
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+
+    UNUSED(ectx);
+
+    ctx.is_tcti_none = flags.tcti_none ? true : false;
+    if (ctx.is_tcti_none && !ctx.cp_hash_path) {
+        LOG_ERR("If tcti is none, then cpHash path must be specified");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * Peculiar to this and some other tools, the object (nvindex) name must
+     * be specified when only calculating the cpHash.
+     *
+     * This breaks the compatibility with the 4.X tools where in a real tcti
+     * is invoked to get a sapi handle to retrieve the params. Also this would
+     * imply that a real NV index ought to be defined even in the case of simply
+     * calculating the cpHash.
+     *
+     * To solve this conundrum, we can only mandate the requirement for the NV
+     * index name in case tcti is specified as none. If tcti is not specified as
+     * none we fall back to the old behavior of reading from a define NV index
+     * 
+     * Also, tcti is setup to a fake_tcti when tcti is specified "none" as the
+     * tool option affords TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI.
+     * 
+     * If NVindex name is not specified and tcti is not none, it is expected
+     * that the NV index is actually define. This behavior complies with the
+     * backwards compatibility with 4.X
+     */
+    bool is_nv_name_specified = ctx.precalc_nvname.size;
+    if (ctx.is_tcti_none && !is_nv_name_specified) {
+        LOG_ERR("Must specify the NVIndex name.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.is_tcti_none && is_nv_name_specified) {
+        LOG_ERR("Do not specify NVIndex name, it is directly read from NV");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.is_tcti_none && ctx.rp_hash_path) {
+        LOG_ERR("Cannot dispatch command with tcti=none & rphash path specified");
+    }
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * is_tcti_none       N
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.is_tcti_none ||
+        (ctx.cp_hash_path && !ctx.rp_hash_path)) ? false : true;
+
+    /*
+     * Prevent overwriting pHash by allowing only one index at a time.
+     */
+    if ((ctx.cp_hash_path || ctx.rp_hash_path) && ctx.nv_index == 0) {
+        LOG_ERR("Must specify NV Index to calculate pHash");
+        return tool_rc_option_error;
+    }
 
-    free(capability_data);
     return tool_rc_success;
 }
 
@@ -129,20 +338,128 @@
     return on_arg_nv_index(argc, argv, &ctx.nv_index);
 }
 
+static bool on_option(char key, char *value) {
+
+    bool result = true;
+    switch (key) {
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
+    case 'n':
+        ctx.precalc_nvname.size = BUFFER_SIZE(TPM2B_NAME, name);
+        int q = tpm2_util_hex_to_byte_structure(value, &ctx.precalc_nvname.size,
+        ctx.precalc_nvname.name);
+        if (q) {
+            LOG_ERR("FAILED: %d", q);
+            return false;
+        }
+        break;
+    }
+
+    return result;
+}
+
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
-    *opts = tpm2_options_new(NULL, 0, NULL, NULL,
-            on_arg, 0);
+    static const struct option topts = {
+        { "cphash", required_argument, NULL,  0  },
+        { "rphash", required_argument, NULL,  1  },
+        { "session",required_argument, NULL, 'S' },
+        { "name",   required_argument, NULL, 'n' },
+    };
+
+    *opts = tpm2_options_new("S:n:", ARRAY_LEN(topts), topts, on_option, on_arg,
+        TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
+    /* opts is unused, avoid compiler warning */
     UNUSED(flags);
 
-    return nv_readpublic(context);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx, flags);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = nv_readpublic(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
+
+}
+
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+    uint32_t i = 0;
+    if (ctx.capability_data) {
+        for (i = 0; i < ctx.capability_data->data.handles.count; i++) {
+            free(ctx.nv_public_listi);
+        }
+        free(ctx.capability_data);
+    }
+
+    free(ctx.nv_public_list);
+
+    /*
+     * 2. Close authorization sessions
+     */
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tool_rc_success;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("nvreadpublic", tpm2_tool_onstart, tpm2_tool_onrun, NULL, NULL)
+TPM2_TOOL_REGISTER("nvreadpublic", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_nvsetbits.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_nvsetbits.c Changed

@@ -8,8 +8,13 @@
 #include "tpm2_nv_util.h"
 #include "tpm2_options.h"
 
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2
 typedef struct tpm_nvsetbits_ctx tpm_nvsetbits_ctx;
 struct tpm_nvsetbits_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -17,20 +22,209 @@
     } auth_hierarchy;
 
     const char *bit_string;
+    UINT64 bits;
     TPM2_HANDLE nv_index;
+    TPM2B_NAME precalc_nvname;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    bool is_tcti_none;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 
-    char *cp_hash_path;
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
 };
 
-static tpm_nvsetbits_ctx ctx;
+static tpm_nvsetbits_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
+};
 
-static bool on_arg(int argc, char **argv) {
-    /* If the user doesn't specify an authorization hierarchy use the index
-     * passed to -x/--index for the authorization index.
+static tool_rc nvsetbits(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. TPM2_CC_<command> OR Retrieve cpHash
+     */
+    return tpm2_nvsetbits(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
+        ctx.bits, &ctx.cp_hash, &ctx.rp_hash, ctx.parameter_hash_algorithm,
+        &ctx.precalc_nvname, ctx.aux_session_handle0,
+        ctx.aux_session_handle1);
+
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+    }
+
+    return is_file_op_success ? tool_rc_success : tool_rc_general_error;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    tool_rc rc = tool_rc_success;
+    if (ctx.is_tcti_none) {
+        /*
+         * Cannot use tpm2_util_object_load like in nvdefine as it makes a call
+         * to tpm2_util_sys_handle_to_esys_handle which then tries to read the
+         * ESYS_TR object off of the TPM expecting it to be there.
+         * Note: this if it is a permanent handle ESYS_TR is fixed and so the
+         * TPM is not probed even with tpm2_util_sys_handle_to_esys_handle.
+         */
+        rc = tpm2_util_handle_from_optarg(ctx.auth_hierarchy.ctx_path,
+            &ctx.auth_hierarchy.object.handle,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P) ?
+            tool_rc_success : tool_rc_option_error;
+
+        ctx.auth_hierarchy.object.tr_handle = (rc == tool_rc_success) ?
+           tpm2_tpmi_hierarchy_to_esys_tr(ctx.auth_hierarchy.object.handle) : 0;
+    } else {
+        rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    }
+
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid handle authorization");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations
+     */
+    bool result = tpm2_util_string_to_uint64(ctx.bit_string, &ctx.bits);
+    if (!result) {
+        LOG_ERR("Could not convert option argument to number, got: \"%s\"",
+                ctx.bit_string);
+        return tool_rc_general_error;
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * is_tcti_none       N
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
      */
+    ctx.is_command_dispatch = (ctx.is_tcti_none ||
+        (ctx.cp_hash_path && !ctx.rp_hash_path)) ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(tpm2_option_flags flags) {
+
+    ctx.is_tcti_none = flags.tcti_none ? true : false;
+    if (ctx.is_tcti_none && !ctx.cp_hash_path) {
+        LOG_ERR("If tcti is none, then cpHash path must be specified");
+        return tool_rc_option_error;
+    }
+
+    bool is_nv_name_specified = ctx.precalc_nvname.size;
+    if (ctx.is_tcti_none && !is_nv_name_specified) {
+        LOG_ERR("Must specify the NVIndex name.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.is_tcti_none && is_nv_name_specified) {
+        LOG_ERR("Do not specify NVIndex name, it is directly read from NV");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.bit_string) {
+        LOG_ERR("Expected option --bits for specifying the bits to set");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
+
+static bool on_arg(int argc, char **argv) {
+
     if (!ctx.auth_hierarchy.ctx_path) {
         ctx.auth_hierarchy.ctx_path = argv0;
     }
+
     return on_arg_nv_index(argc, argv, &ctx.nv_index);
 }
 
@@ -50,6 +244,27 @@
     case 0:
         ctx.cp_hash_path = value;
         break;
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
+    case 'n':
+        ctx.precalc_nvname.size = BUFFER_SIZE(TPM2B_NAME, name);
+        int q = tpm2_util_hex_to_byte_structure(value, &ctx.precalc_nvname.size,
+        ctx.precalc_nvname.name);
+        if (q) {
+            LOG_ERR("FAILED: %d", q);
+            return false;
+        }
+        break;
     }
 
     return true;
@@ -62,10 +277,13 @@
         { "auth",      required_argument, NULL, 'P' },
         { "bits",      required_argument, NULL, 'i' },
         { "cphash",    required_argument, NULL,  0  },
+        { "rphash",    required_argument, NULL,  1  },
+        { "session",   required_argument, NULL, 'S' },
+        { "name",      required_argument, NULL, 'n' },
     };
 
-    *opts = tpm2_options_new("C:P:i:", ARRAY_LEN(topts), topts, on_option,
-            on_arg, 0);
+    *opts = tpm2_options_new("C:P:i:S:n:", ARRAY_LEN(topts), topts, on_option,
+            on_arg, TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI);
 
     return *opts != NULL;
 }
@@ -74,54 +292,68 @@
 
     UNUSED(flags);
 
-    if (!ctx.bit_string) {
-        LOG_ERR("Expected option --bits for specifying the bits to set");
-        return tool_rc_option_error;
-    }
-
-    UINT64 bits = 0;
-    bool result = tpm2_util_string_to_uint64(ctx.bit_string, &bits);
-    if (!result) {
-        LOG_ERR("Could not convert option argument to number, got: \"%s\"",
-                ctx.bit_string);
-        return tool_rc_general_error;
-    }
-
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(flags);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid handle authorization");
         return rc;
     }
 
-    if (!ctx.cp_hash_path) {
-        return tpm2_nvsetbits(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
-            bits, NULL);
-    }
-
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = tpm2_nvsetbits(ectx, &ctx.auth_hierarchy.object, ctx.nv_index, bits,
-        &cp_hash);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = nvsetbits(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    if (!ctx.cp_hash_path) {
-        return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
-    return tool_rc_success;
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("nvsetbits", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("nvsetbits", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_nvundefine.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_nvundefine.c Changed

@@ -8,8 +8,13 @@
 #include "tpm2_nv_util.h"
 #include "tpm2_options.h"
 
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2
 typedef struct tpm_nvundefine_ctx tpm_nvundefine_ctx;
 struct tpm_nvundefine_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -21,109 +26,135 @@
         tpm2_session *session;
     } policy_session;
 
-    struct {
-        bool C;
-    } flags;
+    bool is_auth_hierarchy_specified;
 
     TPM2_HANDLE nv_index;
+    TPM2B_NAME precalc_nvname;
+    bool has_policy_delete_set;
+
+    /*
+     * Outputs
+     */
 
-    char *cp_hash_path;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    bool is_tcti_none;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
 };
 
 static tpm_nvundefine_ctx ctx = {
     .auth_hierarchy.ctx_path = "owner",
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
 };
 
-static bool on_option(char key, char *value) {
+static tool_rc nv_undefine(ESYS_CONTEXT *ectx) {
 
-    switch (key) {
+    tool_rc rc = ctx.has_policy_delete_set ?
 
-    case 'C':
-        ctx.flags.C = true;
-        ctx.auth_hierarchy.ctx_path = value;
-        break;
-    case 'P':
-        ctx.auth_hierarchy.auth_str = value;
-        break;
-    case 'S':
-        ctx.policy_session.path = value;
-        break;
-    case 0:
-        ctx.cp_hash_path = value;
-        break;
-    }
+        tpm2_nvundefinespecial(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
+            &ctx.precalc_nvname, ctx.policy_session.session, &ctx.cp_hash,
+            &ctx.rp_hash, ctx.parameter_hash_algorithm,
+            ctx.aux_session_handle0) :
 
-    return true;
+        tpm2_nvundefine(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
+            &ctx.precalc_nvname, &ctx.cp_hash, &ctx.rp_hash,
+            ctx.parameter_hash_algorithm, ctx.aux_session_handle0,
+            ctx.aux_session_handle1);
+
+    return rc;
 }
 
-static bool on_arg(int argc, char **argv) {
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
-    return on_arg_nv_index(argc, argv, &ctx.nv_index);
-}
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-static bool tpm2_tool_onstart(tpm2_options **opts) {
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
 
-    const struct option topts = {
-        { "hierarchy", required_argument, NULL, 'C' },
-        { "auth",      required_argument, NULL, 'P' },
-        { "session",   required_argument, NULL, 'S' },
-        { "cphash",    required_argument, NULL,  0  },
-    };
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
 
-    *opts = tpm2_options_new("C:P:S:", ARRAY_LEN(topts), topts, on_option, on_arg,
-            0);
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+        rc = is_file_op_success ? tool_rc_success : tool_rc_general_error;
+    }
 
-    return *opts != NULL;
+    return rc;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
-    UNUSED(flags);
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
     /*
-     * Read the public portion of the NV index so we can ascertain if
-     * TPMA_NV_POLICYDELETE is set. This determines which command to use
-     * to undefine the space. Either undefine or undefinespecial.
+     * 1. Object and auth initializations
      */
-    TPM2B_NV_PUBLIC *nv_public = NULL;
-    tool_rc rc = tpm2_util_nv_read_public(ectx, ctx.nv_index, &nv_public);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to read the public part of NV index 0x%X", ctx.nv_index);
-        return rc;
-    }
-
-    bool has_policy_delete_set = !!(nv_public->nvPublic.attributes & TPMA_NV_POLICY_DELETE);
 
-    Esys_Free(nv_public);
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
 
     /*
-     * The default hierarchy is typically owner, however with a policy delete object it's always
-     * the platform.
+     * 1.b Add object names and their auth sessions
      */
-    if (!ctx.flags.C) {
-        ctx.auth_hierarchy.ctx_path  = has_policy_delete_set ? "platform" : "owner";
-    }
 
-    /* now with the default sorted out, load the authorization object */
-    rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    /* Object #1 */
+    tool_rc rc = tool_rc_success;
+    tpm2_handle_flags valid_handles =
+        TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P;
+    if (ctx.is_tcti_none) {
+         rc = tpm2_util_handle_from_optarg(ctx.auth_hierarchy.ctx_path,
+             &ctx.auth_hierarchy.object.handle, valid_handles) ?
+             tool_rc_success : tool_rc_option_error;
+
+         ctx.auth_hierarchy.object.tr_handle = (rc == tool_rc_success) ?
+            tpm2_tpmi_hierarchy_to_esys_tr(ctx.auth_hierarchy.object.handle) : 0;
+     } else {
+         rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+             ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+             valid_handles);
+     }
+
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid handle authorization");
+        LOG_ERR("Invalid handle or authorization.");
         return rc;
     }
 
-    bool result = true;
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    /* has policy delete set, so do NV undefine special */
-    if (has_policy_delete_set) {
-
-        if (!ctx.policy_session.path) {
-            LOG_ERR("NV Spaces with attribute TPMA_NV_POLICY_DELETE require a"
-                    " policy session to be specified via \"-S\"");
-            return tool_rc_general_error;
-        }
-
+    /*
+     * Object #2
+     *
+     * Must be a policy session satisfying the ADMIN role with policycommandcode
+     * TPM2_CC_NV_UndefineSpaceSpecial
+     */
+    if (ctx.has_policy_delete_set && !ctx.is_tcti_none) {
         rc = tpm2_session_restore(ectx, ctx.policy_session.path, false,
                 &ctx.policy_session.session);
         if (rc != tool_rc_success) {
@@ -131,66 +162,333 @@
         }
 
         /*
-         * has to be an admin policy session for undefinespecial.
-         * We can at least check that it is a session.
+         * In case of undefinespacespecial first session is expected to satisfy
+         * the ADMIN role in a policycommandcode session.
          */
         TPM2_SE type = tpm2_session_get_type(ctx.policy_session.session);
-        if (type != TPM2_SE_POLICY) {
+        if (ctx.has_policy_delete_set && type != TPM2_SE_POLICY) {
             LOG_ERR("Expected a policy session when NV index has attribute"
-                    " TPMA_NV_POLICY_DELETE set.");
-            return tool_rc_general_error;
+                    " TPMA_NV_POLICY_DELETE set. Also note that "
+                    "the policy session must be specified first with -S");
+            return tool_rc_option_error;
         }
 
-        if (!ctx.cp_hash_path) {
-            return tpm2_nvundefinespecial(ectx, &ctx.auth_hierarchy.object,
-                ctx.nv_index, ctx.policy_session.session, NULL);
-        }
+        /*
+         * Adjust aux session structure to reflect the only allowed additional
+         * aux structure.
+         */
+        ctx.aux_session_cnt-=1;
+        ctx.aux_session_path0 = ctx.aux_session_path1;
+        ctx.aux_session_path1 = 0;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *is_undefinespecial_session = ctx.has_policy_delete_set ?
+        ctx.policy_session.session : ctx.aux_session0;
+
+    tpm2_session *last_aux_session = ctx.has_policy_delete_set ?
+        ctx.aux_session0 : ctx.aux_session1;
+
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        is_undefinespecial_session,
+        last_aux_session,
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.cp_hash_path && !ctx.rp_hash_path) ?
+        false : true;
+
+    return rc;
+}
 
-        rc = tpm2_nvundefinespecial(ectx, &ctx.auth_hierarchy.object,
-                ctx.nv_index, ctx.policy_session.session, &cp_hash);;
+static tool_rc check_options(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+
+    ctx.is_tcti_none = flags.tcti_none ? true : false;
+    if (ctx.is_tcti_none && !ctx.cp_hash_path) {
+        LOG_ERR("If tcti is none, then cpHash path must be specified");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * is_tcti_none       N
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.is_tcti_none ||
+        (ctx.cp_hash_path && !ctx.rp_hash_path)) ? false : true;
+
+    /*
+     * Peculiar to this and some other tools, the object (nvindex) name must
+     * be specified when only calculating the cpHash.
+     *
+     * This breaks the compatibility with the 4.X tools where in a real tcti
+     * is invoked to get a sapi handle to retrieve the params. Also this would
+     * imply that a real NV index ought to be defined even in the case of simply
+     * calculating the cpHash.
+     *
+     * To solve this conundrum, we can only mandate the requirement for the NV
+     * index name in case tcti is specified as none. If tcti is not specified as
+     * none we fall back to the old behavior of reading from a define NV index
+     * 
+     * Also, tcti is setup to a fake_tcti when tcti is specified "none" as the
+     * tool option affords TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI.
+     * 
+     * If NVindex name is not specified and tcti is not none, it is expected
+     * that the NV index is actually define. This behavior complies with the
+     * backwards compatibility with 4.X
+     */
+    bool is_nv_name_specified = ctx.precalc_nvname.size;
+    if (ctx.is_tcti_none && !is_nv_name_specified) {
+        LOG_ERR("Must specify the NVIndex name.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.is_tcti_none && is_nv_name_specified) {
+        LOG_ERR("Do not specify NVIndex name, it is directly read from NV");
+        return tool_rc_option_error;
+    }
+
+    bool is_platform_hierarchy_required = ctx.has_policy_delete_set;
+    if (!ctx.is_tcti_none) {
+        /*
+         * Read the public portion of the NV index so we can ascertain if
+         * TPMA_NV_POLICYDELETE is set. This determines which command to use
+         * to undefine the space. Either undefine or undefinespecial.
+         */
+        TPM2B_NV_PUBLIC *nv_public = NULL;
+        tool_rc rc = tpm2_util_nv_read_public(ectx, ctx.nv_index, 0, &nv_public,
+            0, 0, 0, ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE);
         if (rc != tool_rc_success) {
+            LOG_ERR("Failed to read the public part of NV index 0x%X", ctx.nv_index);
             return rc;
         }
-        goto nvundefine_out;
+
+        if (ctx.has_policy_delete_set &&
+        !(nv_public->nvPublic.attributes & TPMA_NV_POLICY_DELETE)) {
+            LOG_ERR("Specified --with-policydelete but NV index attribute not set");
+            return tool_rc_option_error;
+        }
+        ctx.has_policy_delete_set =
+            nv_public->nvPublic.attributes & TPMA_NV_POLICY_DELETE;
+
+        is_platform_hierarchy_required = ctx.has_policy_delete_set ||
+            (nv_public->nvPublic.attributes & TPMA_NV_PLATFORMCREATE);
+
+        Esys_Free(nv_public);
+    }
+
+    /*
+     * When calculating cpHash with tcti=none, assumption is that the auth
+     * hierarchy will be specified as TPM2_RH_PLATFORM. Note that the default
+     * setting for auth hierarchy is TPM2_RH_OWNER.
+     */
+    if (!ctx.is_auth_hierarchy_specified && is_platform_hierarchy_required) {
+        ctx.auth_hierarchy.ctx_path = "platform";
+    }
+
+    if (!ctx.is_tcti_none &&
+    (ctx.has_policy_delete_set && !ctx.policy_session.path)) {
+        LOG_ERR("NV Spaces with attribute TPMA_NV_POLICY_DELETE require a "
+                "policy session to be specified via \"-S\"");
+        return tool_rc_option_error;
     }
 
-    if (ctx.policy_session.path && !has_policy_delete_set) {
-       LOG_WARN("Option -S is not required on NV indices that don't have"
-               " attribute TPMA_NV_POLICY_DELETE set");
+    return tool_rc_success;
+}
+
+static bool on_arg(int argc, char **argv) {
+    /*
+     * If the user doesn't specify an authorization hierarchy use the index
+     */
+    return on_arg_nv_index(argc, argv, &ctx.nv_index);
+}
+
+static bool on_option(char key, char *value) {
+
+    switch (key) {
+    case 'C':
+        ctx.is_auth_hierarchy_specified = true;
+        ctx.auth_hierarchy.ctx_path = value;
+        break;
+    case 'P':
+        ctx.auth_hierarchy.auth_str = value;
+        break;
+    case 'S':
+        /*
+         * In case of undefinespacespecial first session is expected to satisfy
+         * the ADMIN role in a policycommandcode session.
+         */
+        if (!ctx.aux_session_cnt) {
+            ctx.policy_session.path = value;   
+        }
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 2:
+        ctx.has_policy_delete_set = true;
+        break;
+    case 'n':
+        ctx.precalc_nvname.size = BUFFER_SIZE(TPM2B_NAME, name);
+        int q = tpm2_util_hex_to_byte_structure(value, &ctx.precalc_nvname.size,
+        ctx.precalc_nvname.name);
+        if (q) {
+            LOG_ERR("FAILED: %d", q);
+            return false;
+        }
+        break;
     }
 
-    if (!ctx.cp_hash_path) {
-        return tpm2_nvundefine(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
-            NULL);
+    return true;
+}
+
+static bool tpm2_tool_onstart(tpm2_options **opts) {
+/*
+ * The tool does both undefine and undefine space special and so the options
+ * are interpreted accordingly.
+ * 
+ * Case NV_Undefine:
+ *       1. 'C' and 'P' correspond to either TPM2_RH_OWNER or TPM2_RH_PLATFORM
+ *       2. In this case, two aux sessions are allowed.
+ * Case NV_UndefineSpaceSpecial:
+ *       1. 'S' is for the NV-Index --> Object#1, Session#1.
+ *       2. 'C' and 'P' is defaulted to TPM2_RH_PLATFORM --> Object#2, Session#2
+ *       3. In this case, just one aux session is allowed.
+ *       4. Additional option --with-policydelete is required with tcti=none as
+ *          the NV index isn't available to read the attribute when only
+ *          calculating cpHash and command is not dispatched.
+ */
+    const struct option topts = {
+        { "hierarchy",          required_argument, NULL, 'C' },
+        { "auth",               required_argument, NULL, 'P' },
+        { "session",            required_argument, NULL, 'S' },
+        { "cphash",             required_argument, NULL,  0  },
+        { "rphash",             required_argument, NULL,  1  },
+        { "with-policydelete",  no_argument,       NULL,  2  },
+        { "name",               required_argument, NULL, 'n' },
+    };
+
+    *opts = tpm2_options_new("C:P:S:n:", ARRAY_LEN(topts), topts, on_option,
+        on_arg, TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI);
+
+    return *opts != NULL;
+}
+
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+
+    UNUSED(flags);
+
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx, flags);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    rc = tpm2_nvundefine(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
-        &cp_hash);;
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-nvundefine_out:
-    result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = nv_undefine(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
+    /*
+     * 1. Free objects
+     */
 
-    /* attempt to close all sessions and report errors */
+    /*
+     * 2. Close authorization sessions
+     */
     tool_rc rc = tool_rc_success;
-    if (!ctx.cp_hash_path) {
-        rc = tpm2_session_close(&ctx.policy_session.session);
-        rc |= tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    tool_rc tmp_rc = tpm2_session_close(&ctx.policy_session.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
+    }
+
+    tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
+    }
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
     }
 
     return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("nvundefine", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("nvundefine", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_nvwrite.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_nvwrite.c Changed

@@ -9,8 +9,13 @@
 #include "tpm2_nv_util.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2
 typedef struct tpm_nvwrite_ctx tpm_nvwrite_ctx;
 struct tpm_nvwrite_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -18,115 +23,355 @@
     } auth_hierarchy;
 
     TPM2_HANDLE nv_index;
+    TPM2B_NAME precalc_nvname;
 
     BYTE nv_bufferTPM2_MAX_NV_BUFFER_SIZE;
     FILE *input_file;
     UINT16 data_size;
     UINT16 offset;
-    char *cp_hash_path;
+
+    uint16_t max_data_size;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    bool is_tcti_none;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
 };
 
 static tpm_nvwrite_ctx ctx = {
-    .data_size = TPM2_MAX_NV_BUFFER_SIZE
+    .data_size = TPM2_MAX_NV_BUFFER_SIZE,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
 };
 
-static bool is_input_options_args_valid(ESYS_CONTEXT *ectx) {
+static tool_rc nv_write(ESYS_CONTEXT *ectx) {
 
-    if (ctx.cp_hash_path && ctx.data_size > TPM2_MAX_NV_BUFFER_SIZE) {
-        LOG_ERR("Cannot calculat cpHash for buffers larger than NV max buffer");
-        return false;
-    }
+    TPM2B_MAX_NV_BUFFER nv_write_data;
+    UINT16 data_offset = 0;
+    bool is_nvwritten_set = false;
+    bool is_nv_auth_updated = false;
+    while (ctx.data_size > 0) {
+        nv_write_data.size = ctx.data_size > ctx.max_data_size ?
+            ctx.max_data_size : ctx.data_size;
 
-    if (!ctx.data_size) {
-        LOG_WARN("Data to write is of size 0");
+        LOG_INFO("The data(size=%d) to be written:", nv_write_data.size);
+
+        memcpy(nv_write_data.buffer, &ctx.nv_bufferdata_offset,
+                nv_write_data.size);
+
+        tool_rc rc = tool_rc_success;
+        /*
+         * The attribute nvwritten is set after the first write and so the
+         * HMAC must be calculated again with the new name.
+         * Fixes #2846
+         */
+        if (is_nvwritten_set && !is_nv_auth_updated &&
+        ctx.is_command_dispatch) {
+            rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+            if (rc != tool_rc_success) {
+                LOG_ERR("Failed HMAC auth session clean-up");
+                return rc;
+            }
+
+            rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+            if (rc != tool_rc_success) {
+                LOG_ERR("Failed updating the auth");
+                return rc;
+            }
+            is_nv_auth_updated = true;
+        }
+
+        rc = tpm2_nvwrite(ectx, &ctx.auth_hierarchy.object,
+            ctx.nv_index, &ctx.precalc_nvname, &nv_write_data,
+            ctx.offset + data_offset, &ctx.cp_hash, &ctx.rp_hash,
+            ctx.parameter_hash_algorithm, ctx.aux_session_handle0,
+            ctx.aux_session_handle1);
+        if (rc != tool_rc_success) {
+            return rc;
+        }
+        is_nvwritten_set = true;
+
+        ctx.data_size -= nv_write_data.size;
+        data_offset += nv_write_data.size;
     }
 
+    return tool_rc_success;
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
     /*
-     * Ensure that writes will fit before attempting write to prevent data
-     * from being partially written to the index.
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
      */
-    TPM2B_NV_PUBLIC *nv_public = NULL;
-    tool_rc rc = tpm2_util_nv_read_public(ectx, ctx.nv_index, &nv_public);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed to write NVRAM public area at index 0x%X",
-                ctx.nv_index);
-        free(nv_public);
-        return false;
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
     }
 
-    if (ctx.offset + ctx.data_size > nv_public->nvPublic.dataSize) {
-        LOG_ERR("The starting offset (%u) and the size (%u) are larger than the"
-                " defined space: %u.", ctx.offset, ctx.data_size,
-                nv_public->nvPublic.dataSize);
-        free(nv_public);
-        return false;
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
     }
-    free(nv_public);
-    return true;
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+        rc = is_file_op_success ? tool_rc_success : tool_rc_general_error;
+    }
+
+    return rc;
 }
 
-static tool_rc nv_write(ESYS_CONTEXT *ectx) {
 
-    TPM2B_MAX_NV_BUFFER nv_write_data;
-    UINT16 data_offset = 0;
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
-    if (ctx.cp_hash_path) {
-        nv_write_data.size = ctx.data_size;
-        memcpy(nv_write_data.buffer, &ctx.nv_buffer, ctx.data_size);
-        LOG_WARN("Calculating cpHash. Exiting without performing write.");
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_nvwrite(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
-                &nv_write_data, ctx.offset, &cp_hash);
-        if (rc != tool_rc_success) {
-            LOG_ERR("CpHash calculation failed!");
-            return rc;
-        }
+    /*
+     * 1. Object and auth initializations
+     */
 
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    /*
+     * When tcti is none AND only calculating cpHash only load the object
+     * strings to calculate the names.
+     */
+    tool_rc rc = tool_rc_success;
+    if (ctx.is_tcti_none) {
+        /*
+         * Cannot use tpm2_util_object_load like in nvdefine as it makes a call
+         * to tpm2_util_sys_handle_to_esys_handle which then tries to read the
+         * ESYS_TR object off of the TPM expecting it to be there.
+         * Note: this if it is a permanent handle ESYS_TR is fixed and so the
+         * TPM is not probed even with tpm2_util_sys_handle_to_esys_handle.
+         */
+        rc = tpm2_util_handle_from_optarg(ctx.auth_hierarchy.ctx_path,
+            &ctx.auth_hierarchy.object.handle,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P) ?
+            tool_rc_success : tool_rc_option_error;
+
+        ctx.auth_hierarchy.object.tr_handle = (rc == tool_rc_success) ?
+           tpm2_tpmi_hierarchy_to_esys_tr(ctx.auth_hierarchy.object.handle) : 0;
+    } else {
+        rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    }
+
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid handle or authorization.");
         return rc;
     }
 
-    UINT32 max_data_size;
-    tool_rc rc = tpm2_util_nv_max_buffer_size(ectx, &max_data_size);
+    bool is_auth_a_policy_session = ctx.is_command_dispatch &&
+    tpm2_session_get_type(ctx.auth_hierarchy.object.session) == TPM2_SE_POLICY;
+    if (is_auth_a_policy_session && ctx.data_size > ctx.max_data_size) {
+         LOG_ERR("Cannot continue as the policy auth session must be "
+                 "reinstantiated for multiple iterations of NV write. "
+                 "Specify a max write size of %u or specify an offset and max "
+                 "write size of %u", ctx.max_data_size, ctx.max_data_size);
+         return tool_rc_option_error;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    if (max_data_size > TPM2_MAX_NV_BUFFER_SIZE) {
-        max_data_size = TPM2_MAX_NV_BUFFER_SIZE;
-    } else if (max_data_size == 0) {
-        max_data_size = NV_DEFAULT_BUFFER_SIZE;
+    /*
+     * 3. Command specific initializations
+     */
+    /*
+     * Ensure that writes will fit before attempting write to prevent data
+     * from being partially written to the index.
+     */
+    if (!ctx.is_tcti_none) {
+        TPM2B_NV_PUBLIC *nv_public = NULL;
+        rc = tpm2_util_nv_read_public(ectx, ctx.nv_index, 0, &nv_public, 0, 0,
+            0, ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE);
+        if (rc != tool_rc_success) {
+            LOG_ERR("Failed to read NVRAM public area at index 0x%X",\
+                ctx.nv_index);
+            free(nv_public);
+            return tool_rc_general_error;
+        }
+
+        if (ctx.offset + ctx.data_size > nv_public->nvPublic.dataSize) {
+            LOG_ERR("The starting offset (%u) and the size (%u) are larger than the"
+                    " defined space: %u.", ctx.offset, ctx.data_size,
+                    nv_public->nvPublic.dataSize);
+            free(nv_public);
+            return tool_rc_option_error;
+        }
+
+        free(nv_public);
     }
 
-    while (ctx.data_size > 0) {
+    /*
+     * 4. Configuration for calculating the pHash
+     */
 
-        nv_write_data.size =
-                ctx.data_size > max_data_size ? max_data_size : ctx.data_size;
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
 
-        LOG_INFO("The data(size=%d) to be written:", nv_write_data.size);
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
 
-        memcpy(nv_write_data.buffer, &ctx.nv_bufferdata_offset,
-                nv_write_data.size);
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
 
-        rc = tpm2_nvwrite(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
-                &nv_write_data, ctx.offset + data_offset, NULL);
-        if (rc != tool_rc_success) {
-            return rc;
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+
+    if (!ctx.data_size) {
+        LOG_ERR("Data to write is of size 0");
+        return tool_rc_option_error;
+    }
+
+    ctx.is_tcti_none = flags.tcti_none ? true : false;
+    if (ctx.is_tcti_none && !ctx.cp_hash_path) {
+        LOG_ERR("If tcti is none, then cpHash path must be specified");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * Peculiar to this and some other tools, the object (nvindex) name must
+     * be specified when only calculating the cpHash.
+     *
+     * This breaks the compatibility with the 4.X tools where in a real tcti
+     * is invoked to get a sapi handle to retrieve the params. Also this would
+     * imply that a real NV index ought to be defined even in the case of simply
+     * calculating the cpHash.
+     *
+     * To solve this conundrum, we can only mandate the requirement for the NV
+     * index name in case tcti is specified as none. If tcti is not specified as
+     * none we fall back to the old behavior of reading from a define NV index
+     * 
+     * Also, tcti is setup to a fake_tcti when tcti is specified "none" as the
+     * tool option affords TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI.
+     * 
+     * If NVindex name is not specified and tcti is not none, it is expected
+     * that the NV index is actually define. This behavior complies with the
+     * backwards compatibility with 4.X
+     */
+    bool is_nv_name_specified = ctx.precalc_nvname.size;
+    if (ctx.is_tcti_none && !is_nv_name_specified) {
+        LOG_ERR("Must specify the NVIndex name.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.is_tcti_none && is_nv_name_specified) {
+        LOG_ERR("Do not specify NVIndex name, it is directly read from NV");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * is_tcti_none       N
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.is_tcti_none ||
+        (ctx.cp_hash_path && !ctx.rp_hash_path)) ? false : true;
+
+    /*
+     * Avoid overwritting pHash
+     */
+    if (!ctx.is_command_dispatch) {
+        /*
+         * Assuming user specified size
+         */
+        ctx.max_data_size = ctx.data_size;
+    } else {
+        ctx.max_data_size = tpm2_nv_util_max_allowed_nv_size(ectx, false);
+    }
+
+    if ((ctx.cp_hash_path || ctx.rp_hash_path) &&
+    ctx.data_size > ctx.max_data_size) {
+        LOG_ERR("Cannot calculate pHash for buffer larger than NV max buffer");
+        return tool_rc_option_error;
+    }
+
+    #define TYPICAL_NVINDEX_MAX 2048
+    #define TYPICAL_NVACCESS_MAX 1024
+    if (!ctx.is_command_dispatch) {
+        if (ctx.data_size > TYPICAL_NVACCESS_MAX) {
+            LOG_WARN("Calculating cpHash with NV access size larger than typical.");
         }
 
-        ctx.data_size -= nv_write_data.size;
-        data_offset += nv_write_data.size;
+        if ((ctx.data_size + ctx.offset) > TYPICAL_NVINDEX_MAX) {
+            LOG_WARN("Calculating cpHash with NV index size larger than typical");
+        }
     }
 
     return tool_rc_success;
 }
 
+static bool on_arg(int argc, char **argv) {
+    /* If the user doesn't specify an authorization hierarchy use the index
+     * as the authorization object.
+     */
+    if (!ctx.auth_hierarchy.ctx_path) {
+        ctx.auth_hierarchy.ctx_path = argv0;
+    }
+    return on_arg_nv_index(argc, argv, &ctx.nv_index);
+}
+
 static bool on_option(char key, char *value) {
+
     char *input_file;
+
     switch (key) {
+
     case 'C':
         ctx.auth_hierarchy.ctx_path = value;
         break;
@@ -147,61 +392,115 @@
     case 1:
         ctx.cp_hash_path = value;
         break;
+    case 2:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
+    case 'n':
+        ctx.precalc_nvname.size = BUFFER_SIZE(TPM2B_NAME, name);
+        int q = tpm2_util_hex_to_byte_structure(value, &ctx.precalc_nvname.size,
+        ctx.precalc_nvname.name);
+        if (q) {
+            LOG_ERR("FAILED: %d", q);
+            return false;
+        }
+        break;
     }
 
     return true;
 }
 
-static bool on_arg(int argc, char **argv) {
-    /* If the user doesn't specify an authorization hierarchy use the index
-     * passed to -x/--index for the authorization index.
-     */
-    if (!ctx.auth_hierarchy.ctx_path) {
-        ctx.auth_hierarchy.ctx_path = argv0;
-    }
-    return on_arg_nv_index(argc, argv, &ctx.nv_index);
-}
-
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
-        { "hierarchy",            required_argument, NULL, 'C' },
-        { "auth",                 required_argument, NULL, 'P' },
-        { "input",                required_argument, NULL, 'i' },
-        { "offset",               required_argument, NULL,  0  },
-        { "cphash",               required_argument, NULL,  1  },
+        { "hierarchy", required_argument, NULL, 'C' },
+        { "auth",      required_argument, NULL, 'P' },
+        { "input",     required_argument, NULL, 'i' },
+        { "offset",    required_argument, NULL,  0  },
+        { "cphash",    required_argument, NULL,  1  },
+        { "rphash",    required_argument, NULL,  2  },
+        { "name",      required_argument, NULL, 'n' },
+        { "session",   required_argument, NULL, 'S' },
     };
 
-    *opts = tpm2_options_new("C:P:i:", ARRAY_LEN(topts), topts, on_option,
-            on_arg, 0);
+    *opts = tpm2_options_new("C:P:i:S:n:", ARRAY_LEN(topts), topts, on_option,
+            on_arg, TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI);
 
     return *opts != NULL;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
-    UNUSED(flags);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx, flags);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
 
-    bool retval = is_input_options_args_valid(ectx);
-    if (!retval) {
-        return tool_rc_option_error;
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = nv_write(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid handle authorization");
         return rc;
     }
 
-    return nv_write(ectx);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
+    }
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("nvwrite", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("nvwrite", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_nvwritelock.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_nvwritelock.c Changed

@@ -8,8 +8,13 @@
 #include "tpm2_nv_util.h"
 #include "tpm2_options.h"
 
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2
 typedef struct tpm_nvwritelock_ctx tpm_nvwritelock_ctx;
 struct tpm_nvwritelock_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -19,15 +24,230 @@
     bool global_writelock;
     bool has_nv_argument;
     TPM2_HANDLE nv_index;
+    TPM2B_NAME precalc_nvname;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    bool is_tcti_none;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
+};
 
-    char *cp_hash_path;
+static tpm_nvwritelock_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
 };
 
-static tpm_nvwritelock_ctx ctx;
+static tool_rc nv_writelock(ESYS_CONTEXT *ectx) {
+
+    return ctx.global_writelock ?
+    
+        tpm2_nvglobalwritelock(ectx, &ctx.auth_hierarchy.object, &ctx.cp_hash,
+            &ctx.rp_hash, ctx.parameter_hash_algorithm,
+            ctx.aux_session_handle0, ctx.aux_session_handle1) :
+
+        tpm2_nvwritelock(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
+            &ctx.precalc_nvname, &ctx.cp_hash, &ctx.rp_hash,
+            ctx.parameter_hash_algorithm, ctx.aux_session_handle0,
+            ctx.aux_session_handle1);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+        rc = is_file_op_success ? tool_rc_success : tool_rc_general_error;
+    }
+
+    return rc;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /* Object #1 */
+    tpm2_handle_flags valid_handles = TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P;
+    if (!ctx.global_writelock) {
+        valid_handles |= TPM2_HANDLE_FLAGS_NV;
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (ctx.is_tcti_none) {
+        /*
+         * Cannot use tpm2_util_object_load like in nvdefine as it makes a call
+         * to tpm2_util_sys_handle_to_esys_handle which then tries to read the
+         * ESYS_TR object off of the TPM expecting it to be there.
+         * Note: this if it is a permanent handle ESYS_TR is fixed and so the
+         * TPM is not probed even with tpm2_util_sys_handle_to_esys_handle.
+         */
+         rc = tpm2_util_handle_from_optarg(ctx.auth_hierarchy.ctx_path,
+             &ctx.auth_hierarchy.object.handle, valid_handles) ?
+             tool_rc_success : tool_rc_option_error;
+
+         ctx.auth_hierarchy.object.tr_handle = (rc == tool_rc_success) ?
+           tpm2_tpmi_hierarchy_to_esys_tr(ctx.auth_hierarchy.object.handle) : 0;
+     } else {
+         rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+             ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+             valid_handles);
+     }
+
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid handle or authorization.");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    return rc;
+}
+
+static tool_rc check_options(tpm2_option_flags flags) {
+
+    if (ctx.global_writelock && ctx.precalc_nvname.size) {
+        LOG_ERR("Cannot specify nv index name and --global flag");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.global_writelock && ctx.has_nv_argument) {
+        LOG_ERR("Cannot specify nv index and --global flag");
+        return tool_rc_option_error;
+    }
+
+    ctx.is_tcti_none = flags.tcti_none ? true : false;
+    if (ctx.is_tcti_none && !ctx.cp_hash_path) {
+        LOG_ERR("If tcti is none, then cpHash path must be specified");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * Peculiar to this and some other tools, the object (nvindex) name must
+     * be specified when only calculating the cpHash.
+     *
+     * This breaks the compatibility with the 4.X tools where in a real tcti
+     * is invoked to get a sapi handle to retrieve the params. Also this would
+     * imply that a real NV index ought to be defined even in the case of simply
+     * calculating the cpHash.
+     *
+     * To solve this conundrum, we can only mandate the requirement for the NV
+     * index name in case tcti is specified as none. If tcti is not specified as
+     * none we fall back to the old behavior of reading from a define NV index
+     * 
+     * Also, tcti is setup to a fake_tcti when tcti is specified "none" as the
+     * tool option affords TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI.
+     * 
+     * If NVindex name is not specified and tcti is not none, it is expected
+     * that the NV index is actually define. This behavior complies with the
+     * backwards compatibility with 4.X
+     */
+    bool is_nv_name_specified = ctx.precalc_nvname.size;
+    if (!ctx.global_writelock && ctx.is_tcti_none && !is_nv_name_specified) {
+        LOG_ERR("Must specify the NVIndex name.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.is_tcti_none && is_nv_name_specified) {
+        LOG_ERR("Do not specify NVIndex name, it is directly read from NV");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * is_tcti_none       N
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.is_tcti_none ||
+        (ctx.cp_hash_path && !ctx.rp_hash_path)) ? false : true;
+
+    return tool_rc_success;
+}
 
 static bool on_arg(int argc, char **argv) {
-    /* If the user doesn't specify an authorization hierarchy use the index
-     * passed to -x/--index for the authorization index.
+    /*
+     * If the user doesn't specify an authorization hierarchy use the index
      */
     if (!ctx.auth_hierarchy.ctx_path) {
         ctx.auth_hierarchy.ctx_path = argv0;
@@ -54,6 +274,27 @@
     case 1:
         ctx.cp_hash_path = value;
         break;
+    case 2:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            LOG_ERR("Specify a max of 3 sessions");
+            return false;
+        }
+        break;
+    case 'n':
+        ctx.precalc_nvname.size = BUFFER_SIZE(TPM2B_NAME, name);
+        int q = tpm2_util_hex_to_byte_structure(value, &ctx.precalc_nvname.size,
+        ctx.precalc_nvname.name);
+        if (q) {
+            LOG_ERR("FAILED: %d", q);
+            return false;
+        }
+        break;
     }
 
     return true;
@@ -66,64 +307,84 @@
         { "auth",      required_argument, NULL, 'P' },
         { "global",    no_argument,       NULL,  0  },
         { "cphash",    required_argument, NULL,  1  },
+        { "rphash",    required_argument, NULL,  2  },
+        { "session",   required_argument, NULL, 'S' },
+        { "name",      required_argument, NULL, 'n' },
     };
 
-    *opts = tpm2_options_new("C:P:", ARRAY_LEN(topts), topts, on_option, on_arg,
-            0);
+    *opts = tpm2_options_new("C:P:S:n:", ARRAY_LEN(topts), topts, on_option,
+        on_arg, TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI);
 
     return *opts != NULL;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
-    UNUSED(flags);
-
-    tpm2_handle_flags valid_handles = TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P;
 
-    if (!ctx.global_writelock) {
-        valid_handles |= TPM2_HANDLE_FLAGS_NV;
-    } else if (ctx.has_nv_argument) {
-        LOG_ERR("Cannot specify nv index and --global flag");
-        return tool_rc_general_error;
-    }
+    UNUSED(flags);
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            valid_handles);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(flags);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid handle authorization");
         return rc;
     }
 
-    if (!ctx.cp_hash_path) {
-        return ctx.global_writelock ?
-            tpm2_nvglobalwritelock(ectx, &ctx.auth_hierarchy.object, NULL) :
-            tpm2_nvwritelock(ectx, &ctx.auth_hierarchy.object, ctx.nv_index, NULL);
-    }
-
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = ctx.global_writelock ?
-         tpm2_nvglobalwritelock(ectx, &ctx.auth_hierarchy.object, &cp_hash) :
-         tpm2_nvwritelock(ectx, &ctx.auth_hierarchy.object, ctx.nv_index, &cp_hash);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = nv_writelock(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    if (!ctx.cp_hash_path) {
-        return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
-    return tool_rc_success;
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    size_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+            if (tmp_rc != tool_rc_success) {
+                rc = tmp_rc;
+            }
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("nvwritelock", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("nvwritelock", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_pcrallocate.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_pcrallocate.c Changed

@@ -5,15 +5,39 @@
 #include "tpm2.h"
 #include "tpm2_tool.h"
 #include "tpm2_options.h"
+#include "files.h"
 
-static struct {
-    TPML_PCR_SELECTION pcr_selection;
+#define MAX_SESSIONS 3
+typedef struct tpm_pcrallocate_ctx tpm_pcrallocate_ctx;
+struct tpm_pcrallocate_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
         tpm2_loaded_object object;
     } auth_hierarchy;
-} ctx = {
+
+    const char *user_pcr_alloc_str;
+    TPML_PCR_SELECTION pcr_selection;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+};
+
+static tpm_pcrallocate_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .auth_hierarchy.ctx_path = "platform",
     .pcr_selection = {
         .count = 2,
         .pcrSelections = { {
@@ -26,66 +50,216 @@
             .pcrSelect = { 0xff, 0xff, 0xff, }
         }, }
     },
-    .auth_hierarchy.ctx_path = "platform",
 };
 
+static tool_rc pcrallocate(ESYS_CONTEXT *ectx) {
+
+    tool_rc rc = tpm2_pcr_allocate(ectx, &ctx.auth_hierarchy.object,
+        &ctx.pcr_selection, &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed TPM2_CC_ECDH_ZGen"); 
+    }
+
+    return rc;
+}
+
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    pcr_print_pcr_selections(&ctx.pcr_selection);
+
+    return tool_rc_success;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_P);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid platform authorization format.");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * Use the default allocation defined in ctx initialization when pcr
+     * allocation string is not specified.
+     */
+    if (ctx.user_pcr_alloc_str) {
+        bool result = pcr_parse_selections(ctx.user_pcr_alloc_str,
+            &ctx.pcr_selection);
+        if (!result) {
+            LOG_ERR("Could not parse pcr selections");
+            return tool_rc_general_error;
+        }
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        0,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
+
+    return tool_rc_success;
+}
+
 static bool on_arg(int argc, char **argv) {
+
     if (argc > 1) {
         LOG_ERR("Too many arguments");
         return false;
     }
 
-    if (argc == 1 && !pcr_parse_selections(argv0, &ctx.pcr_selection)) {
-        LOG_ERR("Could not parse pcr selections");
-        return false;
+    if (argc == 1) {
+        ctx.user_pcr_alloc_str = argv0;
     }
 
     return true;
 }
 
 static bool on_option(char key, char *value) {
+
     switch (key) {
     case 'P':
         ctx.auth_hierarchy.auth_str = value;
         break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
     }
 
     return true;
 }
 
 static bool tpm2_tool_onstart(tpm2_options **opts) {
-    const struct option topts = { { "auth", required_argument, NULL, 'P' }, };
+    const struct option topts = {
+        { "auth",   required_argument, NULL, 'P' }, 
+        { "cphash", required_argument, 0,     0  },
+
+    };
 
     *opts = tpm2_options_new("P:", ARRAY_LEN(topts), topts, on_option, on_arg,
-            0);
+        0);
 
     return *opts != NULL;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+
     UNUSED(flags);
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_P);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid platform authorization format.");
         return rc;
     }
 
-    rc = tpm2_pcr_allocate(ectx, &ctx.auth_hierarchy.object,
-        &ctx.pcr_selection);
-    if (rc == tool_rc_success) {
-        pcr_print_pcr_selections(&ctx.pcr_selection);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return rc;
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = pcrallocate(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
     return tpm2_session_close(&ctx.auth_hierarchy.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("pcrallocate", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("pcrallocate", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_pcrevent.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_pcrevent.c Changed

@@ -15,42 +15,43 @@
 #include "tpm2_auth_util.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_pcrevent_ctx tpm_pcrevent_ctx;
 struct tpm_pcrevent_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *auth_str;
         tpm2_session *session;
     } auth;
+
     ESYS_TR pcr;
     FILE *input;
+    unsigned long file_size;
+    TPM2B_EVENT pcrevent_buffer;
+    bool is_input_not_fifo;
+    bool is_hashsequence_needed;
+
+    /*
+     * Outputs
+     */
+    TPML_DIGEST_VALUES *digests;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_pcrevent_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
     .pcr = ESYS_TR_RH_NULL,
 };
 
-static tool_rc tpm_pcrevent_file(ESYS_CONTEXT *ectx,
-        TPML_DIGEST_VALUES **result) {
-
-    unsigned long file_size = 0;
-    FILE *input = ctx.input;
-
-    /* Suppress error reporting with NULL path */
-    bool res = files_get_file_size(input, &file_size, NULL);
-
-    /* If we can get the file size and its less than 1024, just do it in one hash invocation */
-    if (res && file_size <= BUFFER_SIZE(TPM2B_EVENT, buffer)) {
-
-        TPM2B_EVENT buffer = TPM2B_INIT(file_size);
-
-        res = files_read_bytes(ctx.input, buffer.buffer, buffer.size);
-        if (!res) {
-            LOG_ERR("Error reading input file!");
-            return tool_rc_general_error;
-        }
-
-        return tpm2_pcr_event(ectx, ctx.pcr, ctx.auth.session, &buffer, result);
-    }
+static tool_rc pcr_hashsequence(ESYS_CONTEXT *ectx) {
 
     ESYS_TR sequence_handle;
     TPM2B_AUTH null_auth = TPM2B_EMPTY_INIT;
@@ -66,20 +67,22 @@
         return rc;
     }
 
-    /* If we know the file size, we decrement the amount read and terminate the
-     * loop when 1 block is left, else we go till feof.
+    /*
+     * If file size is non-zero we decrement the amount read and terminate the
+     * loop when 1 block is left.
+     *
+     * If file size is reported zero we go till feof.
      */
-    size_t left = file_size;
-    bool use_left = !!res;
+    size_t left = ctx.file_size;
+    bool is_filesize_nonzero = !!ctx.is_input_not_fifo && left;
 
     TPM2B_MAX_BUFFER data;
-
     bool done = false;
     while (!done) {
 
         size_t bytes_read = fread(data.buffer, 1,
-                BUFFER_SIZE(typeof(data), buffer), input);
-        if (ferror(input)) {
+                BUFFER_SIZE(typeof(data), buffer), ctx.input);
+        if (ferror(ctx.input)) {
             LOG_ERR("Error reading from input file");
             return tool_rc_general_error;
         }
@@ -92,21 +95,21 @@
             return rc;
         }
 
-        if (use_left) {
+        if (is_filesize_nonzero) {
             left -= bytes_read;
             if (left <= TPM2_MAX_DIGEST_BUFFER) {
                 done = true;
                 continue;
             }
-        } else if (feof(input)) {
+        } else if (feof(ctx.input)) {
             done = true;
         }
     } /* end file read/hash update loop */
 
-    if (use_left) {
+    if (is_filesize_nonzero) {
         data.size = left;
-        bool res = files_read_bytes(input, data.buffer, left);
-        if (!res) {
+        bool result = files_read_bytes(ctx.input, data.buffer, left);
+        if (!result) {
             LOG_ERR("Error reading from input file.");
             return tool_rc_general_error;
         }
@@ -115,22 +118,56 @@
     }
 
     return tpm2_event_sequence_complete(ectx, ctx.pcr, sequence_handle,
-            ctx.auth.session, &data, result);
+            ctx.auth.session, &data, &ctx.digests);
 }
 
-static tool_rc do_pcrevent_and_output(ESYS_CONTEXT *ectx) {
+static tool_rc pcrevent(ESYS_CONTEXT *ectx) {
 
-    TPML_DIGEST_VALUES *digests = NULL;
-    tool_rc rc = tpm_pcrevent_file(ectx, &digests);
-    if (rc != tool_rc_success) {
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_hashsequence_needed) {
+        rc = tpm2_pcr_event(ectx, ctx.pcr, ctx.auth.session,
+            &ctx.pcrevent_buffer, &ctx.digests, &ctx.cp_hash,
+            ctx.parameter_hash_algorithm);
+    } else {
+        /*
+         * Note: We must not calculate pHash in this case to avoid overwriting
+         *       the pHash output in the file when we loop.
+         */
+        rc = pcr_hashsequence(ectx);
+    }
+
+    return rc;
+}
+
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
         return rc;
     }
 
-    assert(digests);
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    assert(ctx.digests);
 
     UINT32 i;
-    for (i = 0; i < digests->count; i++) {
-        TPMT_HA *d = &digests->digestsi;
+    for (i = 0; i < ctx.digests->count; i++) {
+        TPMT_HA *d = &ctx.digests->digestsi;
 
         tpm2_tool_output("%s: ",
                 tpm2_alg_util_algtostr(d->hashAlg, tpm2_alg_util_flags_hash));
@@ -165,7 +202,7 @@
             static const BYTE byte = 0;
             bytes = &byte;
             size = sizeof(byte);
-        }
+            }
         }
 
         size_t j;
@@ -174,10 +211,94 @@
         }
 
         tpm2_tool_output("\n");
+    }
+
+    free(ctx.digests);
+    return tool_rc_success;
+}
 
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_auth_util_from_optarg(ectx, ctx.auth.auth_str,
+            &ctx.auth.session, false);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid key handle authorization");
+        return rc;
     }
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    /*
+     * If no arguments are given:
+     * a. ctx.pcr defaults to zero which is a valid pcr handle
+     * b. ctx.input defaults to stdin
+     */
+    ctx.input = ctx.input ? ctx.input : stdin;
+    /*
+     * Suppress error reporting with NULL path
+     */
+    ctx.is_input_not_fifo = files_get_file_size(ctx.input, &ctx.file_size, NULL);
+    /*
+     * If we can get the non-zero file-size and its less than 1024,
+     * just an invocation of TPM2_CC_PCR_EVENT suffices.
+     */
+    if (ctx.is_input_not_fifo && ctx.file_size &&
+    (ctx.file_size <= BUFFER_SIZE(TPM2B_EVENT, buffer))) {
+        ctx.pcrevent_buffer.size = ctx.file_size;
+        bool result = files_read_bytes(ctx.input, ctx.pcrevent_buffer.buffer,
+            ctx.pcrevent_buffer.size);
+        if (!result) {
+            LOG_ERR("Error reading input file!");
+            return tool_rc_general_error;
+        }
+    } else {
+        ctx.is_hashsequence_needed = true;
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        0,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
 
-    free(digests);
     return tool_rc_success;
 }
 
@@ -190,7 +311,6 @@
 
     FILE *f = NULL;
     const char *pcr = NULL;
-
     unsigned i;
     /* argc can never be negative so cast is safe */
     for (i = 0; i < (unsigned) argc; i++) {
@@ -203,7 +323,8 @@
             goto error;
             /* looking for file and got a file so assign */
         } else if (x && !f) {
-            f = ctx.input = x;
+            f = x;
+            ctx.input = x;
             /* looking for pcr and not a file */
         } else if (!pcr) {
             pcr = argvi;
@@ -213,7 +334,6 @@
                 LOG_ERR("Could not convert \"%s\", to a pcr index.", pcr);
                 return false;
             }
-
             /* got pcr and not a file (another pcr) */
         } else {
             LOG_ERR("Already got PCR index.");
@@ -238,6 +358,9 @@
         ctx.auth.auth_str = value;
         break;
         /* no default */
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
     }
 
     return true;
@@ -246,11 +369,13 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static const struct option topts = {
-        { "auth",      required_argument, NULL, 'P' },
+        { "auth",   required_argument, NULL, 'P' },
+        { "cphash", required_argument, 0,     0  },
+
     };
 
     *opts = tpm2_options_new("P:", ARRAY_LEN(topts), topts, on_option, on_arg,
-            0);
+        0);
 
     return *opts != NULL;
 }
@@ -259,21 +384,52 @@
 
     UNUSED(flags);
 
-    ctx.input = ctx.input ? ctx.input : stdin;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
+    }
 
-    tool_rc rc = tpm2_auth_util_from_optarg(ectx, ctx.auth.auth_str,
-            &ctx.auth.session, false);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid key handle authorization");
         return rc;
     }
 
-    return do_pcrevent_and_output(ectx);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = pcrevent(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
     return tpm2_session_close(&ctx.auth.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
 }
 
 static void tpm2_tool_onexit(void) {
@@ -284,4 +440,5 @@
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("pcrevent", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, tpm2_tool_onexit)
+TPM2_TOOL_REGISTER("pcrevent", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, tpm2_tool_onexit)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_pcrextend.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_pcrextend.c Changed

@@ -3,41 +3,34 @@
 #include <stdlib.h>
 
 #include "log.h"
+#include "tpm2.h"
 #include "tpm2_tool.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_options.h"
 
 typedef struct tpm_pcr_extend_ctx tpm_pcr_extend_ctx;
 struct tpm_pcr_extend_ctx {
+    /*
+     * Inputs
+     */
     size_t digest_spec_len;
     tpm2_pcr_digest_spec *digest_spec;
+
+    /*
+     * Outputs
+     */
 };
 
 static tpm_pcr_extend_ctx ctx;
 
-static tool_rc pcr_extend_one(ESYS_CONTEXT *ectx,
-        TPMI_DH_PCR pcr_index, TPML_DIGEST_VALUES *digests) {;
-
-    TSS2_RC rval = Esys_PCR_Extend(ectx, pcr_index,
-                            ESYS_TR_PASSWORD, ESYS_TR_NONE, ESYS_TR_NONE,
-                            digests);
-    if (rval != TSS2_RC_SUCCESS) {
-        LOG_ERR("Could not extend pcr index: 0x%X", pcr_index);
-        LOG_PERR(Esys_PCR_Extend, rval);
-        return tool_rc_from_tpm(rval);
-    }
-
-    return tool_rc_success;
-}
-
 static tool_rc pcr_extend(ESYS_CONTEXT *ectx) {
 
     size_t i;
     for (i = 0; i < ctx.digest_spec_len; i++) {
         tpm2_pcr_digest_spec *dspec = &ctx.digest_speci;
-        tool_rc rc = pcr_extend_one(ectx, dspec->pcr_index,
-                &dspec->digests);
+        tool_rc rc = tpm2_pcr_extend(ectx, dspec->pcr_index, &dspec->digests);
         if (rc != tool_rc_success) {
+            LOG_ERR("Could not extend pcr index: 0x%X", dspec->pcr_index);
             return rc;
         }
     }
@@ -45,6 +38,64 @@
     return tool_rc_success;
 }
 
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    return tool_rc_success;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
+
+    return tool_rc_success;
+}
+
 static bool on_arg(int argc, char **argv) {
 
     if (argc < 1) {
@@ -76,7 +127,53 @@
 
     UNUSED(flags);
 
-    return pcr_extend(ectx);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = pcr_extend(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
+}
+
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return tool_rc_success;
 }
 
 static void tpm2_tool_onexit(void) {
@@ -85,4 +182,5 @@
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("pcrextend", tpm2_tool_onstart, tpm2_tool_onrun, NULL, tpm2_tool_onexit)
+TPM2_TOOL_REGISTER("pcrextend", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, tpm2_tool_onexit)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_pcrread.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_pcrread.c Changed

@@ -7,103 +7,168 @@
 #include "log.h"
 #include "pcr.h"
 #include "tpm2_alg_util.h"
+#include "tpm2_convert.h"
 #include "tpm2_tool.h"
+#include "files.h"
 
+#define MAX_SESSIONS 3
 typedef struct listpcr_context listpcr_context;
 struct listpcr_context {
-    char *output_file_path;
-    FILE *output_file;
+    /*
+     * Inputs
+     */
+    tpm2_convert_pcrs_output_fmt format;
     tpm2_algorithm algs;
     tpm2_pcrs pcrs;
     TPML_PCR_SELECTION pcr_selections;
     TPMI_ALG_HASH selected_algorithm;
+    TPMS_CAPABILITY_DATA capdata;
+
+    /*
+     * Outputs
+     */
+    char *output_file_path;
+    FILE *output_file;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
-static listpcr_context ctx;
-
-// show all PCR banks according to g_pcrSelection & g_pcrs->
-static bool print_pcr_values(void) {
-
-    UINT32 vi = 0, di = 0, i;
-
-    for (i = 0; i < ctx.pcr_selections.count; i++) {
-        const char *alg_name = tpm2_alg_util_algtostr(
-                ctx.pcr_selections.pcrSelectionsi.hash,
-                tpm2_alg_util_flags_hash);
-
-        tpm2_tool_output("%s:\n", alg_name);
-
-        unsigned int pcr_id;
-        for (pcr_id = 0;
-                pcr_id < ctx.pcr_selections.pcrSelectionsi.sizeofSelect * 8u;
-                pcr_id++) {
-            if (!tpm2_util_is_pcr_select_bit_set(
-                    &ctx.pcr_selections.pcrSelectionsi, pcr_id)) {
-                continue;
-            }
-            if (vi >= ctx.pcrs.count || di >= ctx.pcrs.pcr_valuesvi.count) {
-                LOG_ERR("Something wrong, trying to print but nothing more");
-                return false;
-            }
-
-            tpm2_tool_output("  %-2d: 0x", pcr_id);
-
-            int k;
-            for (k = 0; k < ctx.pcrs.pcr_valuesvi.digestsdi.size; k++) {
-                tpm2_tool_output("%02X",
-                        ctx.pcrs.pcr_valuesvi.digestsdi.bufferk);
-            }
-            tpm2_tool_output("\n");
-
-            if (ctx.output_file != NULL
-                    && fwrite(ctx.pcrs.pcr_valuesvi.digestsdi.buffer,
-                            ctx.pcrs.pcr_valuesvi.digestsdi.size,
-                            required_argument, ctx.output_file) != 1) {
-                LOG_ERR("write to output file failed: %s", strerror(errno));
-                return false;
-            }
-
-            if (++di < ctx.pcrs.pcr_valuesvi.count) {
-                continue;
-            }
-
-            di = 0;
-            if (++vi < ctx.pcrs.count) {
-                continue;
-            }
-        }
+static listpcr_context ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+    .format = pcrs_output_format_values
+};
+
+static tool_rc pcrread(ESYS_CONTEXT *ectx) {
+
+    tool_rc rc = pcr_read_pcr_values(ectx, &ctx.pcr_selections, &ctx.pcrs,
+        &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed TPM2_CC_PCR_Read"); 
     }
 
-    return true;
+    return rc;
 }
 
-static tool_rc show_pcr_list_selected_values(ESYS_CONTEXT *esys_context,
-        TPMS_CAPABILITY_DATA *capdata,
-        bool check) {
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
 
-    if (check && !pcr_check_pcr_selection(capdata, &ctx.pcr_selections)) {
-        return tool_rc_general_error;
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
     }
 
-    tool_rc rc = pcr_read_pcr_values(esys_context, &ctx.pcr_selections,
-            &ctx.pcrs);
-    if (rc != tool_rc_success) {
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
         return rc;
     }
 
-    return print_pcr_values() ? tool_rc_success : tool_rc_general_error;
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    bool success = pcr_print_values(&ctx.pcr_selections, &ctx.pcrs);
+    if (success && ctx.output_file) {
+        if (ctx.format == pcrs_output_format_values) {
+            success = pcr_fwrite_values(&ctx.pcr_selections, &ctx.pcrs,
+                ctx.output_file);
+        }
+        
+        if (ctx.format == pcrs_output_format_serialized) {
+            success = pcr_fwrite_serialized(&ctx.pcr_selections, &ctx.pcrs,
+                ctx.output_file);
+        }
+    }
+    return success ? tool_rc_success : tool_rc_general_error;
 }
 
-static tool_rc show_pcr_alg_or_all_values(ESYS_CONTEXT *esys_context,
-        TPMS_CAPABILITY_DATA *capdata) {
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
 
-    bool res = pcr_init_pcr_selection(capdata, &ctx.pcr_selections,
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    tool_rc rc = pcr_get_banks(ectx, &ctx.capdata, &ctx.algs);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    bool result = true;
+    if (ctx.pcr_selections.count > 0) {
+        result = pcr_check_pcr_selection(&ctx.capdata, &ctx.pcr_selections);
+    } else {
+        result = pcr_init_pcr_selection(&ctx.capdata, &ctx.pcr_selections,
             ctx.selected_algorithm);
-    if (!res) {
+    }
+    if (!result) {
         return tool_rc_general_error;
     }
 
-    return show_pcr_list_selected_values(esys_context, capdata, false);
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        0,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
+
+    if (ctx.output_file_path) {
+        ctx.output_file = fopen(ctx.output_file_path, "wb+");
+        if (!ctx.output_file) {
+            LOG_ERR("Could not open output file \"%s\" error: \"%s\"",
+                    ctx.output_file_path, strerror(errno));
+            return tool_rc_general_error;
+        }
+    }
+
+    return tool_rc_success;
 }
 
 static bool on_option(char key, char *value) {
@@ -112,7 +177,16 @@
     case 'o':
         ctx.output_file_path = value;
         break;
+    case 'F':
+        ctx.format = tpm2_convert_pcrs_output_fmt_from_optarg(value);
+        if (ctx.format == pcrs_output_format_err) {
+            return false;
+        }
+        break;
         /* no default */
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
     }
 
     return true;
@@ -126,7 +200,7 @@
     }
 
     ctx.selected_algorithm = tpm2_alg_util_from_optarg(argv0,
-            tpm2_alg_util_flags_hash);
+        tpm2_alg_util_flags_hash);
     if (ctx.selected_algorithm == TPM2_ALG_ERROR) {
         bool res = pcr_parse_selections(argv0, &ctx.pcr_selections);
         if (!res) {
@@ -142,49 +216,71 @@
 
     static struct option topts = {
          { "output",         required_argument, NULL, 'o' },
+         { "pcrs_format",    required_argument, NULL, 'F' },
+         { "cphash",         required_argument, 0,     0  },
      };
 
-    *opts = tpm2_options_new("o:", ARRAY_LEN(topts), topts, on_option, on_arg,
+    *opts = tpm2_options_new("o:F:", ARRAY_LEN(topts), topts, on_option, on_arg,
             0);
 
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *esys_context, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    if (ctx.output_file_path) {
-        ctx.output_file = fopen(ctx.output_file_path, "wb+");
-        if (!ctx.output_file) {
-            LOG_ERR("Could not open output file \"%s\" error: \"%s\"",
-                    ctx.output_file_path, strerror(errno));
-            return tool_rc_general_error;
-        }
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    TPMS_CAPABILITY_DATA capdata;
-    tool_rc rc = pcr_get_banks(esys_context, &capdata, &ctx.algs);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    if (ctx.pcr_selections.count > 0) {
-        return show_pcr_list_selected_values(esys_context, &capdata, true);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = pcrread(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return show_pcr_alg_or_all_values(esys_context, &capdata);
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
 }
 
-static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *esys_context) {
-    UNUSED(esys_context);
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
 
+    UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
     if (ctx.output_file) {
         fclose(ctx.output_file);
     }
+    /*
+     * 2. Close authorization sessions
+     */
+
+    /*
+     * 3. Close auxiliary sessions
+     */
 
     return tool_rc_success;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("pcrread", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("pcrread", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_pcrreset.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_pcrreset.c Changed

@@ -7,33 +7,45 @@
 #include "tpm2.h"
 #include "tpm2_tool.h"
 #include "tpm2_options.h"
+#include "files.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_pcr_reset_ctx tpm_pcr_reset_ctx;
 struct tpm_pcr_reset_ctx {
+    /*
+     * Inputs
+     */
     bool pcr_listTPM2_MAX_PCRS;
-};
-
-static tpm_pcr_reset_ctx ctx;
-
-static tool_rc pcr_reset_one(ESYS_CONTEXT *ectx, TPMI_DH_PCR pcr_index) {
 
-    tool_rc rc = tpm2_pcr_reset(ectx, pcr_index);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Could not reset PCR index: %d", pcr_index);
-    }
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+};
 
-    return rc;
-}
+static tpm_pcr_reset_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+};
 
 static tool_rc pcr_reset(ESYS_CONTEXT *ectx) {
-    size_t i;
 
+    size_t i;
     for (i = 0; i < TPM2_MAX_PCRS; i++) {
-        if (!ctx.pcr_listi)
+        if (!ctx.pcr_listi) {
             continue;
+        }
 
-        tool_rc rc = pcr_reset_one(ectx, i);
+        tool_rc rc = tpm2_pcr_reset(ectx, i, &ctx.cp_hash,
+            ctx.parameter_hash_algorithm);
         if (rc != tool_rc_success) {
+            LOG_ERR("Could not reset PCR index: %zu", i);
             return rc;
         }
     }
@@ -41,11 +53,89 @@
     return tool_rc_success;
 }
 
-static bool on_arg(int argc, char** argv) {
-    int i;
-    uint32_t pcr;
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
 
-    memset(ctx.pcr_list, 0, TPM2_MAX_PCRS);
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+
+    return tool_rc_success;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        0,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
+
+    return tool_rc_success;
+}
+
+static bool on_arg(int argc, char** argv) {
 
     if (argc < 1) {
         LOG_ERR("Expected at least one PCR index"
@@ -53,19 +143,41 @@
         return false;
     }
 
+    int i = 0;
+    uint32_t pcr = 0;
+    bool is_valid_pcr_index = false;
+    memset(ctx.pcr_list, 0, TPM2_MAX_PCRS);
     for (i = 0; i < argc; i++) {
-        if (!pcr_get_id(argvi, &pcr))
+        is_valid_pcr_index = pcr_get_id(argvi, &pcr);
+        if (!is_valid_pcr_index) {
             return false;
-
+        }
         ctx.pcr_listpcr = 1;
     }
 
     return true;
 }
 
+static bool on_option(char key, char *value) {
+
+    switch (key) {
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
+    }
+
+    return true;
+}
+
 static bool tpm2_tool_onstart(tpm2_options **opts) {
-    *opts = tpm2_options_new(NULL, 0, NULL, NULL, on_arg, 0);
 
+    static const struct option topts = {
+        { "cphash", required_argument, 0, 0},
+
+    };
+    
+    *opts = tpm2_options_new(NULL, ARRAY_LEN(topts), topts, on_option, on_arg,
+        0);
     return *opts != NULL;
 }
 
@@ -73,8 +185,55 @@
 
     UNUSED(flags);
 
-    return pcr_reset(ectx);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = pcr_reset(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
+}
+
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return tool_rc_success;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("pcrreset", tpm2_tool_onstart, tpm2_tool_onrun, NULL, NULL)
+TPM2_TOOL_REGISTER("pcrreset", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policyauthorize.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policyauthorize.c Changed

@@ -8,26 +8,145 @@
 #include "tpm2_policy.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm2_policyauthorize_ctx tpm2_policyauthorize_ctx;
 struct tpm2_policyauthorize_ctx {
-    //File path for the session context data
-    const char *session_path;
-    //File path for the policy digest that will be authorized
-    const char *policy_digest_path;
-    //File path for the policy qualifier data
-    const char *qualifier_data_path;
-    //File path for the verifying public key name
-    const char *verifying_pubkey_name_path;
-    //File path for the verification ticket
-    const char *ticket_path;
-    //File path for storing the policy digest output
-    const char *out_policy_dgst_path;
-
+    /*
+     * Inputs
+     */
+    const char *session_path; //File path for the session context data
     tpm2_session *session;
-    TPM2B_DIGEST *policy_digest;
+    const char *policy_digest_path; //File path for the policy digest that will be authorized
+    const char *qualifier_data_path; //File path for the policy qualifier data
+    const char *verifying_pubkey_name_path; //File path for the verifying public key name
+    const char *ticket_path; //File path for the verification ticket
+
+    /*
+     * Outputs
+     */
+    const char *out_policy_dgst_path; //File path for storing the policy digest output
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+};
+
+static tpm2_policyauthorize_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tpm2_policyauthorize_ctx ctx;
+static tool_rc tpm2_policyauthorize_build(ESYS_CONTEXT *ectx) {
+
+    tool_rc rc = tpm2_policy_build_policyauthorize(ectx, ctx.session,
+        ctx.policy_digest_path, ctx.qualifier_data_path,
+        ctx.verifying_pubkey_name_path, ctx.ticket_path, &ctx.cp_hash,
+        ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Could not build tpm authorized policy");
+    }
+
+    return rc;
+}
+
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.out_policy_dgst_path);
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
+            &ctx.session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+tool_rc check_options(void) {
+
+    if (!ctx.session_path) {
+        LOG_ERR("Must specify a session file with -S.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.verifying_pubkey_name_path) {
+        LOG_ERR("Must specify name of the public key used for verification -n.");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
 
 static bool on_option(char key, char *value) {
 
@@ -50,6 +169,9 @@
     case 't':
         ctx.ticket_path = value;
         break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
     }
     return true;
 }
@@ -63,6 +185,8 @@
         { "qualification", required_argument, NULL, 'q' },
         { "name",          required_argument, NULL, 'n' },
         { "ticket",        required_argument, NULL, 't' },
+        { "cphash",        required_argument, NULL,  0  },
+
     };
 
     *opts = tpm2_options_new("L:S:i:q:n:t:", ARRAY_LEN(topts), topts, on_option,
@@ -71,51 +195,58 @@
     return *opts != NULL;
 }
 
-bool is_check_input_options_ok(void) {
-
-    if (!ctx.session_path) {
-        LOG_ERR("Must specify a session file with -S.");
-        return false;
-    }
-
-    if (!ctx.verifying_pubkey_name_path) {
-        LOG_ERR("Must specify name of the public key used for verification -n.");
-        return false;
-    }
-
-    return true;
-}
-
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    if (!is_check_input_options_ok()) {
-        return tool_rc_option_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
-            &ctx.session);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    rc = tpm2_policy_build_policyauthorize(ectx, ctx.session,
-            ctx.policy_digest_path, ctx.qualifier_data_path,
-            ctx.verifying_pubkey_name_path, ctx.ticket_path);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = tpm2_policyauthorize_build(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Could not build tpm authorized policy");
         return rc;
     }
 
-    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.out_policy_dgst_path);
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    free(ctx.policy_digest);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
     return tpm2_session_close(&ctx.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("policyauthorize", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("policyauthorize", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policyauthorizenv.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policyauthorizenv.c Changed

@@ -9,8 +9,12 @@
 #include "tpm2_options.h"
 #include "tpm2_policy.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_policyauthorizenv_ctx tpm_policyauthorizenv_ctx;
 struct tpm_policyauthorizenv_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -18,21 +22,141 @@
     } auth_hierarchy;
 
     TPM2_HANDLE nv_index;
+    const char *session_path;
+    tpm2_session *session;
 
+    /*
+     * Outputs
+     */
     const char *out_policy_dgst_path;
 
-    const char *session_path;
-    tpm2_session *session;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+};
 
-    char *cp_hash_path;
+static tpm_policyauthorizenv_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tpm_policyauthorizenv_ctx ctx;
+static tool_rc policyauthorizenv(ESYS_CONTEXT *ectx) {
 
-static bool on_arg(int argc, char **argv) {
-    /* If the user doesn't specify an authorization hierarchy use the index
-     * passed to -x/--index for the authorization index.
+    ESYS_TR policy_session_handle = tpm2_session_get_handle(ctx.session);
+    return tpm2_policy_authorize_nv(ectx, &ctx.auth_hierarchy.object,
+        ctx.nv_index, policy_session_handle, &ctx.cp_hash,
+        ctx.parameter_hash_algorithm);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.out_policy_dgst_path);
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid handle authorization");
+        return rc;
+    }
+
+    rc = tpm2_session_restore(ectx, ctx.session_path, false, &ctx.session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
      */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        ctx.session,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    if (!ctx.session_path) {
+        LOG_ERR("Must specify -S session file.");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.cp_hash_path && ctx.out_policy_dgst_path) {
+        LOG_ERR("Cannot output policyhash when calculating cphash.");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
+
+static bool on_arg(int argc, char **argv) {
+
     if (!ctx.auth_hierarchy.ctx_path) {
         ctx.auth_hierarchy.ctx_path = argv0;
     }
@@ -68,108 +192,82 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
-        { "hierarchy", required_argument, NULL, 'C' },
-        { "auth",      required_argument, NULL, 'P' },
-        { "policy",    required_argument, NULL, 'L' },
-        { "session",   required_argument, NULL, 'S' },
-        { "cphash",    required_argument, NULL,  0  },
+        { "hierarchy", required_argument, 0, 'C' },
+        { "auth",      required_argument, 0, 'P' },
+        { "policy",    required_argument, 0, 'L' },
+        { "session",   required_argument, 0, 'S' },
+        { "cphash",    required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("C:P:L:S:", ARRAY_LEN(topts), topts, on_option,
-            on_arg, 0);
+        on_arg, 0);
 
-    return *opts != NULL;
-}
-
-static bool is_input_option_args_valid(void) {
-
-    if (!ctx.session_path) {
-        LOG_ERR("Must specify -S session file.");
-        return false;
-    }
-
-    if (ctx.cp_hash_path && ctx.out_policy_dgst_path) {
-        LOG_WARN("Cannot output policyhash when calculating cphash.");
-        return false;
-    }
-
-    return true;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    bool retval = is_input_option_args_valid();
-    if (!retval) {
-        return tool_rc_option_error;
-    }
-
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid handle authorization");
         return rc;
     }
 
-    rc = tpm2_session_restore(ectx, ctx.session_path, false, &ctx.session);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    ESYS_TR policy_session_handle = tpm2_session_get_handle(ctx.session);
-
-    if (!ctx.cp_hash_path) {
-        rc = tpm2_policy_authorize_nv(ectx, &ctx.auth_hierarchy.object,
-            ctx.nv_index, policy_session_handle, NULL);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-
-        return tpm2_policy_tool_finish(ectx, ctx.session,
-            ctx.out_policy_dgst_path);
-    }
-
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = tpm2_policy_authorize_nv(ectx, &ctx.auth_hierarchy.object,
-        ctx.nv_index, policy_session_handle, &cp_hash);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = policyauthorizenv(ectx);
     if (rc != tool_rc_success) {
-        goto cphash_error_out;
-    }
-
-    bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
-    } else {
-        goto cphash_out;
+        return rc;
     }
 
-cphash_error_out:
-    LOG_ERR("Failed cphash calculation operation");
-cphash_out:
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    tool_rc rc = tool_rc_success;
-    tool_rc tmp_rc = tool_rc_success;
+    /*
+     * 1. Free objects
+     */
 
-    if (!ctx.cp_hash_path) {
-        tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
-        if (tmp_rc != tool_rc_success) {
-            rc = tmp_rc;
-        }
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
+
     tmp_rc = tpm2_session_close(&ctx.session);
     if (tmp_rc != tool_rc_success) {
         rc = tmp_rc;
     }
 
+    /*
+     * 3. Close auxiliary sessions
+     */
+
     return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("policyauthorizenv", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("policyauthorizenv", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policyauthvalue.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policyauthvalue.c Changed

@@ -7,17 +7,134 @@
 #include "tpm2_policy.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm2_policyauthvalue_ctx tpm2_policyauthvalue_ctx;
 struct tpm2_policyauthvalue_ctx {
-    //File path for the session context data
+    /*
+     * Inputs
+     */
     const char *session_path;
-    //File path for storing the policy digest output
+    tpm2_session *session;
+
+    /*
+     * Outputs
+     */
     const char *policy_digest_path;
 
-    tpm2_session *session;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+};
+
+static tpm2_policyauthvalue_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tpm2_policyauthvalue_ctx ctx;
+static tool_rc tpm2_policyauthvalue_build(ESYS_CONTEXT *ectx) {
+
+    tool_rc rc = tpm2_policy_build_policyauthvalue(ectx, ctx.session,
+        &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Could not build policyauthvalue TPM");
+    }
+
+    return rc;
+}
+
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.policy_digest_path);
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
+            &ctx.session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
+
+    if (!ctx.session_path) {
+        LOG_ERR("Must specify -S session file.");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
 
 static bool on_option(char key, char *value) {
 
@@ -28,6 +145,9 @@
     case 'S':
         ctx.session_path = value;
         break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
     }
 
     return true;
@@ -38,6 +158,8 @@
     static struct option topts = {
         { "policy",  required_argument, NULL, 'L' },
         { "session", required_argument, NULL, 'S' },
+        { "cphash",  required_argument, NULL,  0  },
+
     };
 
     *opts = tpm2_options_new("S:L:", ARRAY_LEN(topts), topts, on_option,
@@ -46,44 +168,58 @@
     return *opts != NULL;
 }
 
-static bool is_input_option_args_valid(void) {
-
-    if (!ctx.session_path) {
-        LOG_ERR("Must specify -S session file.");
-        return false;
-    }
-    return true;
-}
-
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    bool retval = is_input_option_args_valid();
-    if (!retval) {
-        return tool_rc_option_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
-            &ctx.session);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    rc = tpm2_policy_build_policyauthvalue(ectx, ctx.session);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = tpm2_policyauthvalue_build(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Could not build policyauthvalue TPM");
         return rc;
     }
 
-    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.policy_digest_path);
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
 
     UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
     return tpm2_session_close(&ctx.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("policyauthvalue", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("policyauthvalue", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policycommandcode.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policycommandcode.c Changed

@@ -8,37 +8,134 @@
 #include "tpm2_policy.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm2_policycommandcode_ctx tpm2_policycommandcode_ctx;
 struct tpm2_policycommandcode_ctx {
+    /*
+     * Inputs
+     */
     const char *session_path;
     TPM2_CC command_code;
-    const char *out_policy_dgst_path;
     tpm2_session *session;
+
+    /*
+     * Outputs
+     */
+    const char *out_policy_dgst_path;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
-static tpm2_policycommandcode_ctx ctx;
+static tpm2_policycommandcode_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+};
 
-static bool on_option(char key, char *value) {
+static tool_rc tpm2_policycommandcode_build(ESYS_CONTEXT *ectx) {
 
-    switch (key) {
-    case 'S':
-        ctx.session_path = value;
-        break;
-    case 'L':
-        ctx.out_policy_dgst_path = value;
-        break;
+    tool_rc rc = tpm2_policy_build_policycommandcode(ectx, ctx.session,
+            ctx.command_code, &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Could not build TPM policy_command_code");
     }
-    return true;
+
+    return rc;
+}
+
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.out_policy_dgst_path);
 }
 
-static bool is_input_option_args_valid(void) {
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
+            &ctx.session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
 
     if (!ctx.session_path) {
         LOG_ERR("Must specify -S session file.");
-        return false;
+        return tool_rc_option_error;
     }
 
-    return true;
+    return tool_rc_success;
 }
 
 static bool on_arg(int argc, char **argv) {
@@ -61,11 +158,29 @@
     return true;
 }
 
+static bool on_option(char key, char *value) {
+
+    switch (key) {
+    case 'S':
+        ctx.session_path = value;
+        break;
+    case 'L':
+        ctx.out_policy_dgst_path = value;
+        break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
+    }
+    return true;
+}
+
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static struct option topts = {
         { "session", required_argument,  NULL,   'S' },
         { "policy",  required_argument,  NULL,   'L' },
+        { "cphash",  required_argument,  NULL,    0  },
+
     };
 
     *opts = tpm2_options_new("S:L:", ARRAY_LEN(topts), topts, on_option, on_arg,
@@ -78,31 +193,54 @@
 
     UNUSED(flags);
 
-    bool retval = is_input_option_args_valid();
-    if (!retval) {
-        return tool_rc_option_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
-            &ctx.session);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    rc = tpm2_policy_build_policycommandcode(ectx, ctx.session,
-            ctx.command_code);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = tpm2_policycommandcode_build(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Could not build TPM policy_command_code");
         return rc;
     }
 
-    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.out_policy_dgst_path);
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
     return tpm2_session_close(&ctx.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("policycommandcode", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("policycommandcode", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policycountertimer.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policycountertimer.c Changed

@@ -11,34 +11,132 @@
 #include "tpm2_options.h"
 #include "tpm2_policy.h"
 
-#define OFFSET_TPMS_TIME_INFO_TIME offsetof(TPMS_TIME_INFO, time)
-#define OFFSET_TPMS_TIME_INFO_CLOCK offsetof(TPMS_TIME_INFO, clockInfo.clock)
-#define OFFSET_TPMS_TIME_INFO_RESETS offsetof(TPMS_TIME_INFO, clockInfo.resetCount)
-#define OFFSET_TPMS_TIME_INFO_RESTARTS offsetof(TPMS_TIME_INFO, clockInfo.restartCount)
-#define OFFSET_TPMS_TIME_INFO_SAFE offsetof(TPMS_TIME_INFO, clockInfo.safe);
-
+#define MAX_SESSIONS 3
 typedef struct tpm_policycountertimer_ctx tpm_policycountertimer_ctx;
 struct tpm_policycountertimer_ctx {
-    //Inputs
+    /*
+     * Inputs
+     */
     const char *session_path;
     tpm2_session *session;
-
     TPM2B_OPERAND operand_b;
-
     uint16_t offset;
-
     bool operation_set;
     TPM2_EO operation;
 
-    //Output
+    /*
+     * Outputs
+     */
     const char *policy_digest_path;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_policycountertimer_ctx ctx = {
     .operation = TPM2_EO_EQ,
     .offset = 0,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
+static tool_rc policycountertimer(ESYS_CONTEXT *ectx) {
+
+    ESYS_TR policy_session = tpm2_session_get_handle(ctx.session);
+    tool_rc rc = tpm2_policy_countertimer(ectx, policy_session, &ctx.operand_b,
+        ctx.offset, ctx.operation, &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("PolicyCounterTimer errored.");
+    }
+
+    return rc;
+}
+
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.policy_digest_path);
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
+            &ctx.session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
 static bool convert_keyvalue_to_operand_buffer(const char *value,
     uint16_t offset, uint8_t size) {
 
@@ -90,6 +188,11 @@
     return true;
 }
 
+#define OFFSET_TPMS_TIME_INFO_TIME offsetof(TPMS_TIME_INFO, time)
+#define OFFSET_TPMS_TIME_INFO_CLOCK offsetof(TPMS_TIME_INFO, clockInfo.clock)
+#define OFFSET_TPMS_TIME_INFO_RESETS offsetof(TPMS_TIME_INFO, clockInfo.resetCount)
+#define OFFSET_TPMS_TIME_INFO_RESTARTS offsetof(TPMS_TIME_INFO, clockInfo.restartCount)
+#define OFFSET_TPMS_TIME_INFO_SAFE offsetof(TPMS_TIME_INFO, clockInfo.safe);
 static bool on_arg(int argc, char **argv) {
 
     if (argc > 1) {
@@ -123,22 +226,26 @@
     }
 
     // look up key and process value
-    if (!strcmp("time", key)) {
+    bool is_time = (strcmp("time", key) == 0);
+    if (is_time) {
         return convert_keyvalue_to_operand_buffer(value,
             OFFSET_TPMS_TIME_INFO_TIME, sizeof(uint64_t));
     }
 
-    if (!strcmp("clock", key)) {
+    bool is_clock = (strcmp("clock", key) == 0);
+    if (is_clock) {
         return convert_keyvalue_to_operand_buffer(value,
             OFFSET_TPMS_TIME_INFO_CLOCK, sizeof(uint64_t));
     }
 
-    if (!strcmp("resets", key)) {
+    bool is_resets = (strcmp("resets", key) == 0);
+    if (is_resets) {
         return convert_keyvalue_to_operand_buffer(value,
             OFFSET_TPMS_TIME_INFO_RESETS, sizeof(uint32_t));
     }
 
-    if (!strcmp("restarts", key)) {
+    bool is_restarts = (strcmp("restarts", key) == 0);
+    if (is_restarts) {
         return convert_keyvalue_to_operand_buffer(value,
             OFFSET_TPMS_TIME_INFO_RESTARTS, sizeof(uint32_t));
     }
@@ -158,7 +265,9 @@
     case 'S':
         ctx.session_path = value;
         break;
-    case TPM2_EO_EQ:
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
     case TPM2_EO_NEQ:
     case TPM2_EO_SIGNED_GT:
     case TPM2_EO_UNSIGNED_GT:
@@ -201,6 +310,8 @@
         { "ule",       no_argument,       NULL,  TPM2_EO_UNSIGNED_LE },
         { "bs",        no_argument,       NULL,  TPM2_EO_BITSET      },
         { "bc",        no_argument,       NULL,  TPM2_EO_BITCLEAR    },
+        { "cphash",    required_argument, NULL,  0                   },
+
     };
 
     *opts = tpm2_options_new("L:S:", ARRAY_LEN(topts), topts, on_option,
@@ -209,54 +320,73 @@
     return *opts != NULL;
 }
 
-bool is_input_option_args_valid(void) {
+static tool_rc check_options(void) {
 
     if (!ctx.session_path) {
         LOG_ERR("Must specify -S session file.");
-        return false;
+        return tool_rc_option_error;
     }
 
     if (!ctx.operand_b.size) {
         LOG_WARN("Data to compare is of size 0");
-        return false;
+        return tool_rc_option_error;
     }
 
-    return true;
+    return tool_rc_success;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    bool result = is_input_option_args_valid();
-    if (!result) {
-        return tool_rc_general_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    //Input
-    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
-        &ctx.session);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    ESYS_TR policy_session = tpm2_session_get_handle(ctx.session);
-
-    //ESAPI call
-    rc = tpm2_policy_countertimer(ectx, policy_session, &ctx.operand_b,
-        ctx.offset, ctx.operation);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = policycountertimer(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    //Output
-    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.policy_digest_path);
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
     return tpm2_session_close(&ctx.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("policycountertimer", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("policycountertimer", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policycphash.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policycphash.c Changed

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policylocality.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policylocality.c Changed

@@ -8,38 +8,127 @@
 #include "tpm2_policy.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm2_policylocality_ctx tpm2_policylocality_ctx;
 struct tpm2_policylocality_ctx {
     const char *session_path;
     TPMA_LOCALITY locality;
     const char *out_policy_dgst_path;
-    TPM2B_DIGEST *policy_digest;
     tpm2_session *session;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
-static tpm2_policylocality_ctx ctx;
+static tpm2_policylocality_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+};
 
-static bool on_option(char key, char *value) {
+static tool_rc tpm2_policylocality_build(ESYS_CONTEXT *ectx) {
 
-    switch (key) {
-    case 'S':
-        ctx.session_path = value;
-        break;
-    case 'L':
-        ctx.out_policy_dgst_path = value;
-        break;
+    tool_rc rc = tpm2_policy_build_policylocality(ectx, ctx.session,
+        ctx.locality, &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Could not build TPM policy_locality");
     }
-    return true;
+
+    return rc;
 }
 
-static bool is_input_option_args_valid(void) {
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.out_policy_dgst_path);
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
+            &ctx.session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
 
     if (!ctx.session_path) {
         LOG_ERR("Must specify -S session file.");
-        return false;
+        return tool_rc_option_error;
     }
 
-    return true;
+    return tool_rc_success;
 }
 
 static bool on_arg(int argc, char **argv) {
@@ -54,15 +143,15 @@
         return false;
     }
 
-    if (strcmp(argv0, "zero")) {
+    if (strcmp(argv0, "zero") == 0) {
         ctx.locality = TPMA_LOCALITY_TPM2_LOC_ZERO;
-    } else if (strcmp(argv0, "one")) {
+    } else if (strcmp(argv0, "one") == 0) {
         ctx.locality = TPMA_LOCALITY_TPM2_LOC_ONE;
-    } else if (strcmp(argv0, "two")) {
+    } else if (strcmp(argv0, "two") == 0) {
         ctx.locality = TPMA_LOCALITY_TPM2_LOC_TWO;
-    } else if (strcmp(argv0, "three")) {
+    } else if (strcmp(argv0, "three") == 0) {
         ctx.locality = TPMA_LOCALITY_TPM2_LOC_THREE;
-    } else if (strcmp(argv0, "four")) {
+    } else if (strcmp(argv0, "four") == 0) {
         ctx.locality = TPMA_LOCALITY_TPM2_LOC_FOUR;
     } else {
         bool result = tpm2_util_string_to_uint8(argv0, &ctx.locality);
@@ -76,11 +165,29 @@
     return true;
 }
 
+static bool on_option(char key, char *value) {
+
+    switch (key) {
+    case 'S':
+        ctx.session_path = value;
+        break;
+    case 'L':
+        ctx.out_policy_dgst_path = value;
+        break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
+    }
+    return true;
+}
+
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static struct option topts = {
         { "session", required_argument,  NULL, 'S' },
         { "policy",  required_argument,  NULL, 'L' },
+        { "cphash",  required_argument,  NULL,  0  },
+
     };
 
     *opts = tpm2_options_new("S:L:", ARRAY_LEN(topts), topts, on_option, on_arg,
@@ -93,31 +200,54 @@
 
     UNUSED(flags);
 
-    bool retval = is_input_option_args_valid();
-    if (!retval) {
-        return tool_rc_option_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
-            &ctx.session);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    rc = tpm2_policy_build_policylocality(ectx, ctx.session, ctx.locality);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = tpm2_policylocality_build(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Could not build TPM policy_locality");
         return rc;
     }
 
-    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.out_policy_dgst_path);
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    free(ctx.policy_digest);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
     return tpm2_session_close(&ctx.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("policylocality", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("policylocality", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policynv.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policynv.c Changed

@@ -9,8 +9,12 @@
 #include "tpm2_options.h"
 #include "tpm2_policy.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_policynv_ctx tpm_policynv_ctx;
 struct tpm_policynv_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -19,22 +23,168 @@
 
     TPM2_HANDLE nv_index;
 
-    const char *policy_digest_path;
+    TPM2B_OPERAND operand_b;
+    UINT16 offset;
+    TPM2_EO operation;
 
     const char *session_path;
     tpm2_session *session;
 
-    TPM2B_OPERAND operand_b;
-    UINT16 offset;
-    TPM2_EO operation;
+    /*
+     * Outputs
+     */
+    const char *policy_digest_path;
 
-    char *cp_hash_path;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_policynv_ctx ctx = {
-    .operand_b = { .size = BUFFER_SIZE(TPM2B_OPERAND, buffer) }
+    .operand_b = { .size = BUFFER_SIZE(TPM2B_OPERAND, buffer) },
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
+static tool_rc policynv(ESYS_CONTEXT *ectx) {
+
+    ESYS_TR policy_session_handle = tpm2_session_get_handle(ctx.session);
+    return tpm2_policy_nv(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
+        policy_session_handle, &ctx.operand_b, ctx.offset, ctx.operation,
+        &ctx.cp_hash, ctx.parameter_hash_algorithm);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.policy_digest_path);
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+        ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+        TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid handle authorization");
+        return rc;
+    }
+
+    rc = tpm2_session_restore(ectx, ctx.session_path, false, &ctx.session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    /*
+     * Ensure that NV index is large enough to compare the size of input data.
+     */
+    TPM2B_NV_PUBLIC *nv_public = 0;
+    rc = tpm2_util_nv_read_public(ectx, ctx.nv_index, 0, &nv_public, 0, 0, 0,
+        ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Failed to access NVRAM public area at index 0x%X",
+                ctx.nv_index);
+        free(nv_public);
+        return rc;
+    }
+
+    if (ctx.operand_b.size > nv_public->nvPublic.dataSize - ctx.offset) {
+        LOG_ERR("The operand size is larger than NV data"
+                " starting at the offset");
+        free(nv_public);
+        return tool_rc_general_error;
+    }
+    free(nv_public);
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        ctx.session,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    if (!ctx.session_path) {
+        LOG_ERR("Must specify -S session file.");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.cp_hash_path && ctx.policy_digest_path) {
+        LOG_WARN("Cannot output policyhash when calculating cphash.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.operand_b.size) {
+        LOG_WARN("Data to compare is of size 0");
+    }
+
+    return tool_rc_success;
+}
+
 static bool on_arg(int argc, char **argv) {
 
     switch (argc) {
@@ -109,7 +259,7 @@
         ctx.session_path = value;
         break;
     case 'i':
-        input_file = strcmp("-", value) ? value : NULL;
+        input_file = strcmp("-", value) ? value : 0;
         if (input_file) {
             result = files_get_file_size_path(value,
                     (long unsigned *) &ctx.operand_b.size);
@@ -117,7 +267,7 @@
         if (input_file && !result) {
             return false;
         }
-        result = files_load_bytes_from_buffer_or_file_or_stdin(NULL, input_file,
+        result = files_load_bytes_from_buffer_or_file_or_stdin(0, input_file,
                 &ctx.operand_b.size,
                 ctx.operand_b.buffer);
         if (!result) {
@@ -143,134 +293,84 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
-        { "hierarchy", required_argument, NULL, 'C' },
-        { "auth",      required_argument, NULL, 'P' },
-        { "policy",    required_argument, NULL, 'L' },
-        { "session",   required_argument, NULL, 'S' },
-        { "input",     required_argument, NULL, 'i' },
-        { "offset",    required_argument, NULL,  0  },
-        { "cphash",    required_argument, NULL,  1  },
+        { "hierarchy", required_argument, 0, 'C' },
+        { "auth",      required_argument, 0, 'P' },
+        { "policy",    required_argument, 0, 'L' },
+        { "session",   required_argument, 0, 'S' },
+        { "input",     required_argument, 0, 'i' },
+        { "offset",    required_argument, 0,  0  },
+        { "cphash",    required_argument, 0,  1  },
     };
 
     *opts = tpm2_options_new("C:P:L:S:i:", ARRAY_LEN(topts), topts, on_option,
-            on_arg, 0);
-
-    return *opts != NULL;
-}
+        on_arg, 0);
 
-static bool is_input_option_args_valid(void) {
-
-    if (!ctx.session_path) {
-        LOG_ERR("Must specify -S session file.");
-        return false;
-    }
-
-    if (ctx.cp_hash_path && ctx.policy_digest_path) {
-        LOG_WARN("Cannot output policyhash when calculating cphash.");
-        return false;
-    }
-    return true;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    bool retval = is_input_option_args_valid();
-    if (!retval) {
-        return tool_rc_option_error;
-    }
-
-    if (!ctx.operand_b.size) {
-        LOG_WARN("Data to compare is of size 0");
-    }
     /*
-     * Ensure that NV index is large enough to compare the size of input data.
+     * 1. Process options
      */
-    TPM2B_NV_PUBLIC *nv_public = NULL;
-    tool_rc rc = tpm2_util_nv_read_public(ectx, ctx.nv_index, &nv_public);
+    tool_rc rc = check_options(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Failed to access NVRAM public area at index 0x%X",
-                ctx.nv_index);
-        free(nv_public);
         return rc;
     }
 
-    if (ctx.operand_b.size > nv_public->nvPublic.dataSize - ctx.offset) {
-        LOG_ERR("The operand size is larger than NV data"
-                " starting at the offset");
-        free(nv_public);
-        return tool_rc_general_error;
-    }
-    free(nv_public);
-
-    rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
-            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_NV | TPM2_HANDLE_FLAGS_O | TPM2_HANDLE_FLAGS_P);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid handle authorization");
         return rc;
     }
 
-    rc = tpm2_session_restore(ectx, ctx.session_path, false, &ctx.session);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = policynv(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    ESYS_TR policy_session_handle = tpm2_session_get_handle(ctx.session);
-
-    if (!ctx.cp_hash_path) {
-        rc = tpm2_policy_nv(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
-            policy_session_handle, &ctx.operand_b, ctx.offset, ctx.operation,
-            NULL);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-
-        return tpm2_policy_tool_finish(ectx, ctx.session, ctx.policy_digest_path);
-    }
-
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = tpm2_policy_nv(ectx, &ctx.auth_hierarchy.object, ctx.nv_index,
-            policy_session_handle, &ctx.operand_b, ctx.offset, ctx.operation,
-            &cp_hash);
-    if (rc != tool_rc_success) {
-        goto cphash_error_out;
-    }
-
-    bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        rc = tool_rc_general_error;
-    } else {
-        goto cphash_out;
-    }
-
-cphash_error_out:
-    LOG_ERR("Failed cphash calculation operation");
-cphash_out:
-    return rc;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
 
     UNUSED(ectx);
 
-    tool_rc rc = tool_rc_success;
-    tool_rc tmp_rc = tool_rc_success;
+    /*
+     * 1. Free objects
+     */
 
-    if (!ctx.cp_hash_path) {
-        tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
-        if (tmp_rc != tool_rc_success) {
-            rc = tmp_rc;
-        }
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
+
     tmp_rc = tpm2_session_close(&ctx.session);
     if (tmp_rc != tool_rc_success) {
         rc = tmp_rc;
     }
 
+    /*
+     * 3. Close auxiliary sessions
+     */
+
     return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("policynv", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("policynv", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policynvwritten.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policynvwritten.c Changed

@@ -9,39 +9,135 @@
 #include "tpm2_policy.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm2_policynvwritten_ctx tpm2_policynvwritten_ctx;
 struct tpm2_policynvwritten_ctx {
+    /*
+     * Inputs
+     */
     const char *session_path;
-    const char *policy_digest_path;
     tpm2_session *session;
     TPMI_YES_NO written_set;
+
+    /*
+     * Outputs
+     */
+    const char *policy_digest_path;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm2_policynvwritten_ctx ctx = {
     .written_set = TPM2_NO,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static bool on_option(char key, char *value) {
+static tool_rc tpm2_policynvwritten_build(ESYS_CONTEXT *ectx) {
 
-    switch (key) {
-    case 'S':
-        ctx.session_path = value;
-        break;
-    case 'L':
-        ctx.policy_digest_path = value;
-        break;
+    tool_rc rc = tpm2_policy_build_policynvwritten(ectx, ctx.session,
+        ctx.written_set, &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Could not build policy_nv_written!");
     }
-    return true;
+
+    return rc;
 }
 
-static bool is_input_option_args_valid(void) {
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.policy_digest_path);
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
+            &ctx.session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
 
     if (!ctx.session_path) {
         LOG_ERR("Must specify -S session file.");
-        return false;
+        return tool_rc_option_error;
     }
 
-    return true;
+    return tool_rc_success;
 }
 
 static bool on_arg(int argc, char **argv) {
@@ -83,11 +179,29 @@
     return true;
 }
 
+static bool on_option(char key, char *value) {
+
+    switch (key) {
+    case 'S':
+        ctx.session_path = value;
+        break;
+    case 'L':
+        ctx.policy_digest_path = value;
+        break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
+    }
+    return true;
+}
+
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static struct option topts = {
         { "session", required_argument,  NULL,   'S' },
         { "policy",  required_argument,  NULL,   'L' },
+        { "cphash",  required_argument,  NULL,    0  },
+
     };
 
     *opts = tpm2_options_new("S:L:", ARRAY_LEN(topts), topts, on_option, on_arg,
@@ -100,30 +214,54 @@
 
     UNUSED(flags);
 
-    bool retval = is_input_option_args_valid();
-    if (!retval) {
-        return tool_rc_option_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
-            &ctx.session);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    rc = tpm2_policy_build_policynvwritten(ectx, ctx.session, ctx.written_set);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = tpm2_policynvwritten_build(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Could not build policy_nv_written!");
         return rc;
     }
 
-    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.policy_digest_path);
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
     return tpm2_session_close(&ctx.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("policynvwritten", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("policynvwritten", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policyor.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policyor.c Changed

@@ -14,7 +14,7 @@
     //File path for the session context data
     const char *session_path;
     //List of policy digests that will be compounded
-    TPML_DIGEST *policy_list;
+    TPML_DIGEST policy_list;
     //File path for storing the policy digest output
     const char *out_policy_dgst_path;
 
@@ -36,8 +36,7 @@
         ctx.session_path = value;
         break;
     case 'l':
-        ctx.policy_list = calloc(1, sizeof(TPML_DIGEST));
-        result = tpm2_policy_parse_policy_list(value, ctx.policy_list);
+        result = tpm2_policy_parse_policy_list(value, &ctx.policy_list);
         if (!result) {
             return false;
         }
@@ -54,8 +53,7 @@
         return false;
     }
 
-    ctx.policy_list = calloc(1, sizeof(TPML_DIGEST));
-    bool result = tpm2_policy_parse_policy_list(argv0, ctx.policy_list);
+    bool result = tpm2_policy_parse_policy_list(argv0, &ctx.policy_list);
     if (!result) {
         return false;
     }
@@ -85,7 +83,7 @@
     }
 
     //Minimum two policies needed to be specified for compounding
-    if (ctx.policy_list->count < 1) {
+    if (ctx.policy_list.count < 1) {
         LOG_ERR("Must specify at least 2 policy digests for compounding.");
         return false;
     }
@@ -109,14 +107,14 @@
     }
 
     /* Policy digest hash alg should match that of the session */
-    if (ctx.policy_list->digests0.size
+    if (ctx.policy_list.digests0.size
             != tpm2_alg_util_get_hash_size(
                     tpm2_session_get_authhash(ctx.session))) {
         LOG_ERR("Policy digest hash alg should match that of the session.");
         return tool_rc_general_error;
     }
 
-    rc = tpm2_policy_build_policyor(ectx, ctx.session, ctx.policy_list);
+    rc = tpm2_policy_build_policyor(ectx, ctx.session, &ctx.policy_list);
     if (rc != tool_rc_success) {
         LOG_ERR("Could not build policyor TPM");
         return rc;
@@ -127,7 +125,6 @@
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
     UNUSED(ectx);
-    free(ctx.policy_list);
     free(ctx.policy_digest);
     return tpm2_session_close(&ctx.session);
 }

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policypassword.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policypassword.c Changed

@@ -7,17 +7,134 @@
 #include "tpm2_policy.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm2_policypassword_ctx tpm2_policypassword_ctx;
 struct tpm2_policypassword_ctx {
-    //File path for the session context data
+    /*
+     * Inputs
+     */
     const char *session_path;
-    //File path for storing the policy digest output
+    tpm2_session *session;
+
+    /*
+     * Outputs
+     */
     const char *out_policy_dgst_path;
 
-    tpm2_session *session;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+};
+
+static tpm2_policypassword_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tpm2_policypassword_ctx ctx;
+static tool_rc tpm2_policypassword_build(ESYS_CONTEXT *ectx) {
+
+    tool_rc rc = tpm2_policy_build_policypassword(ectx, ctx.session,
+        &ctx.cp_hash, ctx.parameter_hash_algorithm);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Could not build policyauthvalue TPM");
+    }
+
+    return rc;
+}
+
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.out_policy_dgst_path);
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
+            &ctx.session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
+
+    if (!ctx.session_path) {
+        LOG_ERR("Must specify -S session file.");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
 
 static bool on_option(char key, char *value) {
 
@@ -28,6 +145,9 @@
     case 'S':
         ctx.session_path = value;
         break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
     }
 
     return true;
@@ -38,6 +158,8 @@
     static struct option topts = {
         { "policy",  required_argument, NULL, 'L' },
         { "session", required_argument, NULL, 'S' },
+        { "cphash",  required_argument, NULL,  0  },
+
     };
 
     *opts = tpm2_options_new("S:L:", ARRAY_LEN(topts), topts, on_option,
@@ -46,44 +168,58 @@
     return *opts != NULL;
 }
 
-static bool is_input_option_args_valid(void) {
-
-    if (!ctx.session_path) {
-        LOG_ERR("Must specify -S session file.");
-        return false;
-    }
-    return true;
-}
-
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    bool retval = is_input_option_args_valid();
-    if (!retval) {
-        return tool_rc_option_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_session_restore(ectx, ctx.session_path, false,
-            &ctx.session);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    rc = tpm2_policy_build_policypassword(ectx, ctx.session);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = tpm2_policypassword_build(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Could not build policypassword TPM");
         return rc;
     }
 
-    return tpm2_policy_tool_finish(ectx, ctx.session, ctx.out_policy_dgst_path);
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
 
     UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
     return tpm2_session_close(&ctx.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("policypassword", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("policypassword", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policyrestart.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policyrestart.c Changed

@@ -3,14 +3,129 @@
 #include "log.h"
 #include "tpm2_tool.h"
 #include "tpm2_options.h"
+#include "files.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm2_policyreset_ctx tpm2_policyreset_ctx;
 struct tpm2_policyreset_ctx {
+    /*
+     * Inputs
+     */
     char *path;
     tpm2_session *session;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+};
+
+static tpm2_policyreset_ctx ctx = {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tpm2_policyreset_ctx ctx;
+static tool_rc policyrestart(ESYS_CONTEXT *ectx) {
+
+    return tpm2_session_restart(ectx, ctx.session, &ctx.cp_hash,
+        ctx.parameter_hash_algorithm);
+}
+
+static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    return tool_rc_success;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_session_restore(ectx, ctx.path, false, &ctx.session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+        
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return tool_rc_success;
+}
+
+static tool_rc check_options(void) {
+
+    if (!ctx.path) {
+        LOG_ERR("Must specify -S session file.");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
 
 static bool on_option(char key, char *value) {
 
@@ -18,6 +133,9 @@
     case 'S':
         ctx.path = value;
         break;
+    case 0:
+        ctx.cp_hash_path = value;
+        break;
     }
     return true;
 }
@@ -26,10 +144,12 @@
 
     static struct option topts = {
         { "session", required_argument,  NULL, 'S' },
+        { "cphash",  required_argument,  NULL,  0  },
+
     };
 
     *opts = tpm2_options_new("S:", ARRAY_LEN(topts), topts, on_option,
-    NULL, 0);
+        NULL, 0);
 
     return *opts != NULL;
 }
@@ -38,18 +158,54 @@
 
     UNUSED(flags);
 
-    tool_rc rc = tpm2_session_restore(ectx, ctx.path, false, &ctx.session);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    return tpm2_session_restart(ectx, ctx.session);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = policyrestart(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_outputs(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
     return tpm2_session_close(&ctx.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("policyrestart", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("policyrestart", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_policysecret.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_policysecret.c Changed

@@ -9,38 +9,203 @@
 #include "tpm2_policy.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm2_policysecret_ctx tpm2_policysecret_ctx;
 struct tpm2_policysecret_ctx {
+    /*
+     * Inputs
+     */
     struct {
-        const char *ctx_path; //auth_entity.ctx_path
-        const char *auth_str; //auth_str
-        tpm2_loaded_object object; //context_object && pwd_session
+        const char *ctx_path;
+        const char *auth_str;
+        tpm2_loaded_object object;
     } auth_entity;
 
-    //File path for storing the policy digest output
-    const char *policy_digest_path;
-    //File path for the session context data
+    INT32 expiration;
+    const char *qualifier_data_arg;
+    bool is_nonce_tpm;
+
     const char *extended_session_path;
     tpm2_session *extended_session;
 
-    INT32 expiration;
-
+    /*
+     * Outputs
+     */
+    TPMT_TK_AUTH *policy_ticket;
     char *policy_ticket_path;
-
+    TPM2B_TIMEOUT *timeout;
     char *policy_timeout_path;
+    const char *policy_digest_path;
 
-    const char *qualifier_data_arg;
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+};
 
-    bool is_nonce_tpm;
+static tpm2_policysecret_ctx ctx= {
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
+};
 
-    struct {
-        UINT8 c :1;
-    } flags;
+static tool_rc policysecret(ESYS_CONTEXT *ectx) {
 
-    char *cp_hash_path;
-};
+    return tpm2_policy_build_policysecret(ectx, ctx.extended_session,
+        &ctx.auth_entity.object, ctx.expiration, &ctx.policy_ticket,
+        &ctx.timeout, ctx.is_nonce_tpm, ctx.qualifier_data_arg, &ctx.cp_hash,
+        ctx.parameter_hash_algorithm);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    rc = tpm2_policy_tool_finish(ectx, ctx.extended_session,
+        ctx.policy_digest_path);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    if (ctx.policy_timeout_path) {
+        if(!ctx.timeout->size) {
+            LOG_WARN("Policy assertion did not produce timeout");
+        } else {
+            is_file_op_success = files_save_bytes_to_file(
+                ctx.policy_timeout_path, ctx.timeout->buffer,
+                ctx.timeout->size);
+            
+            if (!is_file_op_success) {
+                LOG_ERR("Failed to save timeout to file.");
+                return tool_rc_general_error;
+            }
+        }
+    }
 
-static tpm2_policysecret_ctx ctx;
+    if (ctx.policy_ticket_path) {
+        if (!ctx.policy_ticket->digest.size) {
+            LOG_WARN("Policy assertion did not produce auth ticket.");
+        } else {
+            is_file_op_success = files_save_authorization_ticket(
+                ctx.policy_ticket, ctx.policy_ticket_path);
+            
+            if (!is_file_op_success) {
+                LOG_ERR("Failed to save auth ticket");
+                return tool_rc_general_error;
+            }
+        }
+    }
+
+    return rc;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+
+    /*
+     * The auth string of the referenced object is strictly for
+     * a password session
+     */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_entity.ctx_path,
+            ctx.auth_entity.auth_str, &ctx.auth_entity.object, false,
+            TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+    
+    rc = tpm2_session_restore(ectx, ctx.extended_session_path, false,
+            &ctx.extended_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_entity.object.session,
+        ctx.extended_session,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    if (!ctx.extended_session_path) {
+        LOG_ERR("Must specify -S session file.");
+        return tool_rc_option_error;
+    }
+
+    if (!ctx.auth_entity.ctx_path) {
+        LOG_ERR("Must specify -c handle-id/ context file path.");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.cp_hash_path && ctx.policy_digest_path) {
+        LOG_ERR("Cannot output policyhash when calculating cphash.");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
+}
 
 static bool on_option(char key, char *value) {
 
@@ -55,7 +220,6 @@
         break;
     case 'c':
         ctx.auth_entity.ctx_path = value;
-        ctx.flags.c = 1;
         break;
     case 0:
         ctx.policy_ticket_path = value;
@@ -105,154 +269,88 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static struct option topts = {
-        { "policy",         required_argument, NULL, 'L' },
-        { "session",        required_argument, NULL, 'S' },
-        { "object-context", required_argument, NULL, 'c' },
-        { "expiration",     required_argument, NULL, 't' },
-        { "nonce-tpm",      no_argument,       NULL, 'x' },
-        { "ticket",         required_argument, NULL,  0  },
-        { "timeout",        required_argument, NULL,  1  },
-        { "qualification",  required_argument, NULL, 'q' },
-        { "cphash",         required_argument, NULL,  2  },
+        { "policy",         required_argument, 0, 'L' },
+        { "session",        required_argument, 0, 'S' },
+        { "object-context", required_argument, 0, 'c' },
+        { "expiration",     required_argument, 0, 't' },
+        { "nonce-tpm",      no_argument,       0, 'x' },
+        { "ticket",         required_argument, 0,  0  },
+        { "timeout",        required_argument, 0,  1  },
+        { "qualification",  required_argument, 0, 'q' },
+        { "cphash",         required_argument, 0,  2  },
     };
 
     *opts = tpm2_options_new("L:S:c:t:q:x", ARRAY_LEN(topts), topts, on_option,
             on_arg, 0);
 
-    return *opts != NULL;
-}
-
-static bool is_input_option_args_valid(void) {
-
-    if (!ctx.extended_session_path) {
-        LOG_ERR("Must specify -S session file.");
-        return false;
-    }
-
-    if (!ctx.flags.c) {
-        LOG_ERR("Must specify -c handle-id/ context file path.");
-        return false;
-    }
-
-    if (ctx.cp_hash_path && ctx.policy_digest_path) {
-        LOG_WARN("Cannot output policyhash when calculating cphash.");
-        return false;
-    }
-
-    return true;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    bool result = is_input_option_args_valid();
-    if (!result) {
-        return tool_rc_option_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_session_restore(ectx, ctx.extended_session_path, false,
-            &ctx.extended_session);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
     /*
-     * The auth string of the referenced object is strictly for a password session
+     * 3. TPM2_CC_<command> call
      */
-    rc = tpm2_util_object_load_auth(ectx, ctx.auth_entity.ctx_path,
-            ctx.auth_entity.auth_str, &ctx.auth_entity.object, false,
-            TPM2_HANDLE_ALL_W_NV);
+    rc = policysecret(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    if (!ctx.cp_hash_path) {
-        /*
-         * Build a policysecret using the pwd session. If the event of
-         * a failure:
-         * 1. always close the pwd session.
-         * 2. log the policy secret failure and return tool_rc_general_error.
-         * 3. if the error was closing the policy secret session, return that rc.
-         */
-        TPMT_TK_AUTH *policy_ticket = NULL;
-        TPM2B_TIMEOUT *timeout = NULL;
-        rc = tpm2_policy_build_policysecret(ectx, ctx.extended_session,
-                &ctx.auth_entity.object, ctx.expiration, &policy_ticket, &timeout,
-                ctx.is_nonce_tpm, ctx.qualifier_data_arg, NULL);
-        tool_rc rc2 = tpm2_session_close(&ctx.auth_entity.object.session);
-        if (rc != tool_rc_success) {
-            goto tpm2_tool_onrun_out;
-        }
-        if (rc2 != tool_rc_success) {
-            rc = rc2;
-            goto tpm2_tool_onrun_out;
-        }
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
+}
 
-        rc = tpm2_policy_tool_finish(ectx, ctx.extended_session,
-                ctx.policy_digest_path);
-        if (rc != tool_rc_success) {
-            goto tpm2_tool_onrun_out;
-        }
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
 
-        if (ctx.policy_timeout_path) {
-            if(!timeout->size) {
-                LOG_WARN("Policy assertion did not produce timeout");
-            } else {
-                result = files_save_bytes_to_file(ctx.policy_timeout_path,
-                timeout->buffer, timeout->size);
-            }
-        }
-        if (!result) {
-            LOG_ERR("Failed to save timeout to file.");
-            rc = tool_rc_general_error;
-            goto tpm2_tool_onrun_out;
-        }
+    UNUSED(ectx);
 
-        if (ctx.policy_ticket_path) {
-            if (!policy_ticket->digest.size) {
-                LOG_WARN("Policy assertion did not produce auth ticket.");
-            } else {
-                result = files_save_authorization_ticket(policy_ticket,
-                ctx.policy_ticket_path);
-            }
-        }
-        if (!result) {
-            LOG_ERR("Failed to save auth ticket");
-            rc = tool_rc_general_error;
-        }
+    /*
+     * 1. Free objects
+     */
+    free(ctx.policy_ticket);
+    free(ctx.timeout);
 
-tpm2_tool_onrun_out:
-        free(policy_ticket);
-        free(timeout);
-        if (rc != tool_rc_success) {
-            LOG_ERR("Could not build policysecret");
-        }
-        return rc;
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tpm2_session_close(&ctx.auth_entity.object.session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
 
-    TPM2B_DIGEST cp_hash = { .size = 0 };
-    rc = tpm2_policy_build_policysecret(ectx, ctx.extended_session,
-        &ctx.auth_entity.object, ctx.expiration, NULL, NULL, ctx.is_nonce_tpm,
-        ctx.qualifier_data_arg, &cp_hash);
-    if (rc != tool_rc_success) {
-        LOG_ERR("Failed cphash calculation operation");
-        return rc;
+    tmp_rc = tpm2_session_close(&ctx.extended_session);
+    if (tmp_rc != tool_rc_success) {
+        rc = tmp_rc;
     }
 
-    result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-    if (!result) {
-        LOG_ERR("Failed saving command parameter hash for policysecret");
-        rc = tool_rc_general_error;
-    }
+    /*
+     * 3. Close auxiliary sessions
+     */
 
     return rc;
 }
 
-static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
-    UNUSED(ectx);
-    return tpm2_session_close(&ctx.extended_session);
-}
-
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("policysecret", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("policysecret", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_quote.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_quote.c Changed

@@ -14,143 +14,134 @@
 #include "tpm2_systemdeps.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_quote_ctx tpm_quote_ctx;
 struct tpm_quote_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
         tpm2_loaded_object object;
     } key;
 
-    char *signature_path;
-    char *message_path;
-    char *pcr_path;
-    FILE *pcr_output;
     tpm2_convert_sig_fmt sig_format;
     TPMI_ALG_HASH sig_hash_algorithm;
-    tpm2_algorithm algs;
     TPM2B_DATA qualification_data;
     TPML_PCR_SELECTION pcr_selections;
     TPMS_CAPABILITY_DATA cap_data;
     tpm2_pcrs pcrs;
+    tpm2_convert_pcrs_output_fmt pcrs_format;
+    TPMT_SIG_SCHEME in_scheme;
+    TPMI_ALG_SIG_SCHEME sig_scheme;
 
-    char *cp_hash_path;
+    /*
+     * Outputs
+     */
+    FILE *pcr_output;
+    char *pcr_path;
+    char *signature_path;
+    char *message_path;
+    TPMS_ATTEST attest;
+    TPM2B_ATTEST *quoted;
+    TPMT_SIGNATURE *signature;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_quote_ctx ctx = {
     .sig_hash_algorithm = TPM2_ALG_NULL,
     .qualification_data = TPM2B_EMPTY_INIT,
+    .pcrs_format = pcrs_output_format_serialized,
+    .in_scheme.scheme = TPM2_ALG_NULL,
+    .sig_scheme = TPM2_ALG_NULL,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
+static tool_rc quote(ESYS_CONTEXT *ectx) {
 
-// write all PCR banks according to g_pcrSelection & g_pcrs->
-static bool write_pcr_values() {
-    UINT32 count;
-
-    // PCR output to file wasn't requested
-    if (ctx.pcr_output == NULL) {
-        return true;
-    }
-
-    // Make sure the file content is written in little endian format
-    ctx.pcr_selections.count = htole32(ctx.pcr_selections.count);
-    UINT32 i;
-    for (i = 0; i < le32toh(ctx.pcr_selections.count); i++)
-        ctx.pcr_selections.pcrSelectionsi.hash = htole16(ctx.pcr_selections.pcrSelectionsi.hash);
-
-    // Export TPML_PCR_SELECTION structure to pcr outfile
-    if (fwrite(&ctx.pcr_selections, sizeof(TPML_PCR_SELECTION), 1,
-            ctx.pcr_output) != 1) {
-        LOG_ERR("write to output file failed: %s", strerror(errno));
-        return false;
-    }
-
-    count = htole32(ctx.pcrs.count);
-    // Export PCR digests to pcr outfile
-    if (fwrite(&count, sizeof(UINT32), 1, ctx.pcr_output) != 1) {
-        LOG_ERR("write to output file failed: %s", strerror(errno));
-        return false;
-    }
-
-    UINT32 j;
-    for (j = 0; j < ctx.pcrs.count; j++) {
-        ctx.pcrs.pcr_valuesj.count = htole32(ctx.pcrs.pcr_valuesj.count);
-
-        UINT32 k;
-        for(k = 0; k < le32toh(ctx.pcrs.pcr_valuesj.count); k++)
-            ctx.pcrs.pcr_valuesj.digestsk.size = htole16(ctx.pcrs.pcr_valuesj.digestsk.size);
-
-        if (fwrite(&ctx.pcrs.pcr_valuesj, sizeof(TPML_DIGEST), 1,
-                ctx.pcr_output) != 1) {
-            LOG_ERR("write to output file failed: %s", strerror(errno));
-            return false;
-        }
-    }
-
-    return true;
+    return tpm2_quote(ectx, &ctx.key.object, &ctx.in_scheme,
+        &ctx.qualification_data, &ctx.pcr_selections, &ctx.quoted,
+        &ctx.signature, &ctx.cp_hash, ctx.parameter_hash_algorithm);
 }
 
-static bool write_output_files(TPM2B_ATTEST *quoted, TPMT_SIGNATURE *signature) {
+static tool_rc write_output_files(void) {
 
-    bool res = true;
+    bool is_file_op_success = true;
+    bool result = true;
     if (ctx.signature_path) {
-        res &= tpm2_convert_sig_save(signature, ctx.sig_format,
-                ctx.signature_path);
+        result = tpm2_convert_sig_save(ctx.signature, ctx.sig_format,
+            ctx.signature_path);
+        if (!result) {
+            is_file_op_success = result;
+        }
     }
 
     if (ctx.message_path) {
-        res &= files_save_bytes_to_file(ctx.message_path,
-                (UINT8*) quoted->attestationData, quoted->size);
+        result = files_save_bytes_to_file(ctx.message_path,
+            (UINT8*) &ctx.quoted->attestationData, ctx.quoted->size);
+        if (!result) {
+            is_file_op_success = result;
+        }
     }
 
-    res &= write_pcr_values();
+    if (ctx.pcr_output) {
+        if (ctx.pcrs_format == pcrs_output_format_serialized) {
+            result = pcr_fwrite_serialized(&ctx.pcr_selections, &ctx.pcrs,
+                ctx.pcr_output);
+            if (!result) {
+                is_file_op_success = result;
+            }
+        } else if (ctx.pcrs_format == pcrs_output_format_values) {
+            result = pcr_fwrite_values(&ctx.pcr_selections, &ctx.pcrs,
+                ctx.pcr_output);
+            if (!result) {
+                is_file_op_success = result;
+            }
+        }
+    }
 
-    return res;
+    return is_file_op_success ? tool_rc_success : tool_rc_general_error;
 }
 
-static tool_rc quote(ESYS_CONTEXT *ectx, TPML_PCR_SELECTION *pcr_selection) {
-
-    TPM2B_ATTEST *quoted = NULL;
-    TPMT_SIGNATURE *signature = NULL;
-    TPMT_SIG_SCHEME in_scheme = { .scheme = TPM2_ALG_NULL };
-
-    tool_rc rc = tpm2_alg_util_get_signature_scheme(ectx,
-            ctx.key.object.tr_handle, &ctx.sig_hash_algorithm, TPM2_ALG_NULL,
-            &in_scheme);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
     if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        rc = tpm2_quote(ectx, &ctx.key.object, &in_scheme,
-        &ctx.qualification_data, pcr_selection, &quoted, &signature, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
         }
-
-        return rc;
     }
 
-    rc = tpm2_quote(ectx, &ctx.key.object, &in_scheme, &ctx.qualification_data,
-            pcr_selection, &quoted, &signature, NULL);
-    if (rc != tool_rc_success) {
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
         return rc;
     }
 
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
     tpm2_tool_output("quoted: ");
-    tpm2_util_print_tpm2b(quoted);
+    tpm2_util_print_tpm2b(ctx.quoted);
     tpm2_tool_output("\nsignature:\n");
-    tpm2_tool_output("  alg: %s\n",
-            tpm2_alg_util_algtostr(signature->sigAlg, tpm2_alg_util_flags_sig));
+    tpm2_tool_output("  alg: %s\n", tpm2_alg_util_algtostr(
+        ctx.signature->sigAlg, tpm2_alg_util_flags_sig));
 
     UINT16 size;
-    BYTE *sig = tpm2_convert_sig(&size, signature);
+    BYTE *sig = tpm2_convert_sig(&size, ctx.signature);
     if (!sig) {
         return tool_rc_general_error;
     }
@@ -167,29 +158,33 @@
         }
 
         // Gather PCR values from the TPM (the quote doesn't have them!)
-        rc = pcr_read_pcr_values(ectx, &ctx.pcr_selections, &ctx.pcrs);
+        rc = pcr_read_pcr_values(ectx, &ctx.pcr_selections, &ctx.pcrs,
+            NULL, TPM2_ALG_ERROR);
         if (rc != tool_rc_success) {
             LOG_ERR("Failed to retrieve PCR values related to quote!");
             return rc;
         }
 
         // Grab the digest from the quote
-        TPMS_ATTEST attest;
-        rc = files_tpm2b_attest_to_tpms_attest(quoted, &attest);
+        rc = files_tpm2b_attest_to_tpms_attest(ctx.quoted, &ctx.attest);
         if (rc != tool_rc_success) {
             return rc;
         }
 
         // Print out PCR values as output
-        if (!pcr_print_pcr_struct(&ctx.pcr_selections, &ctx.pcrs)) {
+        bool is_pcr_print_successful = pcr_print_pcr_struct(&ctx.pcr_selections,
+            &ctx.pcrs);
+        if (!is_pcr_print_successful) {
             LOG_ERR("Failed to print PCR values related to quote!");
             return tool_rc_general_error;
         }
 
         // Calculate the digest from our selected PCR values (to ensure correctness)
         TPM2B_DIGEST pcr_digest = TPM2B_TYPE_INIT(TPM2B_DIGEST, buffer);
-        if (!tpm2_openssl_hash_pcr_banks(ctx.sig_hash_algorithm,
-                &ctx.pcr_selections, &ctx.pcrs, &pcr_digest)) {
+        bool is_pcr_hashing_success = tpm2_openssl_hash_pcr_banks(
+            ctx.sig_hash_algorithm, &ctx.pcr_selections, &ctx.pcrs,
+            &pcr_digest);
+        if (!is_pcr_hashing_success) {
             LOG_ERR("Failed to hash PCR values related to quote!");
             return tool_rc_general_error;
         }
@@ -198,23 +193,114 @@
         tpm2_tool_output("\n");
 
         // Make sure digest from quote matches calculated PCR digest
-        if (!tpm2_util_verify_digests(&attest.attested.quote.pcrDigest, &pcr_digest)) {
+        bool is_pcr_digests_equal = tpm2_util_verify_digests(
+            &ctx.attest.attested.quote.pcrDigest, &pcr_digest);
+        if (!is_pcr_digests_equal) {
             LOG_ERR("Error validating calculated PCR composite with quote");
             return tool_rc_general_error;
         }
     }
 
     // Write everything out
-    bool res = write_output_files(quoted, signature);
+    return write_output_files();
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
-    free(quoted);
-    free(signature);
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
 
-    return res ? tool_rc_success : tool_rc_general_error;
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.key.ctx_path,
+            ctx.key.auth_str, &ctx.key.object, false, TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid key authorization");
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    if (ctx.pcr_path) {
+        ctx.pcr_output = fopen(ctx.pcr_path, "wb+");
+        if (!ctx.pcr_output) {
+            LOG_ERR("Could not open PCR output file \"%s\" error: \"%s\"",
+                    ctx.pcr_path, strerror(errno));
+            return tool_rc_general_error;
+        }
+    }
+
+    tpm2_algorithm algs;
+    rc = pcr_get_banks(ectx, &ctx.cap_data, &algs);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    rc = tpm2_alg_util_get_signature_scheme(ectx, ctx.key.object.tr_handle,
+        &ctx.sig_hash_algorithm, ctx.sig_scheme, &ctx.in_scheme);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.key.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    /* TODO this whole file needs to be re-done, especially the option validation */
+    if (!ctx.pcr_selections.count) {
+        LOG_ERR("Expected -l to be specified.");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.cp_hash_path && (ctx.signature_path || ctx.message_path)) {
+        LOG_ERR("Cannot produce output when calculating cpHash");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
 }
 
 static bool on_option(char key, char *value) {
 
+    bool result = true;
     switch (key) {
     case 'c':
         ctx.key.ctx_path = value;
@@ -223,15 +309,16 @@
         ctx.key.auth_str = value;
         break;
     case 'l':
-        if (!pcr_parse_selections(value, &ctx.pcr_selections)) {
+        result = pcr_parse_selections(value, &ctx.pcr_selections);
+        if (!result) {
             LOG_ERR("Could not parse pcr selections, got: \"%s\"", value);
             return false;
         }
         break;
     case 'q':
         ctx.qualification_data.size = sizeof(ctx.qualification_data.buffer);
-        return tpm2_util_bin_from_hex_or_file(value, &ctx.qualification_data.size,
-                ctx.qualification_data.buffer);
+        return tpm2_util_bin_from_hex_or_file(value,
+            &ctx.qualification_data.size, ctx.qualification_data.buffer);
         break;
     case 's':
         ctx.signature_path = value;
@@ -242,6 +329,12 @@
     case 'o':
         ctx.pcr_path = value;
         break;
+    case 'F':
+        ctx.pcrs_format = tpm2_convert_pcrs_output_fmt_from_optarg(value);
+        if (ctx.pcrs_format == pcrs_output_format_err) {
+            return false;
+        }
+        break;
     case 'f':
         ctx.sig_format = tpm2_convert_sig_fmt_from_optarg(value);
 
@@ -253,15 +346,22 @@
         ctx.sig_hash_algorithm = tpm2_alg_util_from_optarg(value,
                 tpm2_alg_util_flags_hash);
         if (ctx.sig_hash_algorithm == TPM2_ALG_ERROR) {
-            LOG_ERR(
-                    "Could not convert signature hash algorithm selection, got: \"%s\"",
-                    value);
+            LOG_ERR("Could not convert signature hash algorithm selection, "
+                    "got: \"%s\"", value);
             return false;
         }
         break;
     case 0:
         ctx.cp_hash_path = value;
         break;
+    case 1:
+        ctx.sig_scheme = tpm2_alg_util_from_optarg(value,
+                tpm2_alg_util_flags_sig);
+        if (ctx.sig_scheme == TPM2_ALG_ERROR) {
+            LOG_ERR("Unknown signing scheme, got: \"%s\"", value);
+            return false;
+        }
+        break;
     }
 
     return true;
@@ -270,70 +370,86 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static const struct option topts = {
-        { "key-context",    required_argument, NULL, 'c' },
-        { "auth",           required_argument, NULL, 'p' },
-        { "pcr-list",       required_argument, NULL, 'l' },
-        { "qualification",  required_argument, NULL, 'q' },
-        { "signature",      required_argument, NULL, 's' },
-        { "message",        required_argument, NULL, 'm' },
-        { "pcr",            required_argument, NULL, 'o' },
-        { "format",         required_argument, NULL, 'f' },
-        { "hash-algorithm", required_argument, NULL, 'g' },
-        { "cphash",         required_argument, NULL,  0  }
+        { "key-context",    required_argument, 0, 'c' },
+        { "auth",           required_argument, 0, 'p' },
+        { "pcr-list",       required_argument, 0, 'l' },
+        { "qualification",  required_argument, 0, 'q' },
+        { "signature",      required_argument, 0, 's' },
+        { "message",        required_argument, 0, 'm' },
+        { "pcr",            required_argument, 0, 'o' },
+        { "pcrs_format",    required_argument, 0, 'F' },
+        { "format",         required_argument, 0, 'f' },
+        { "hash-algorithm", required_argument, 0, 'g' },
+        { "cphash",         required_argument, 0,  0  },
+        { "scheme",         required_argument, 0,  1  },
     };
 
-    *opts = tpm2_options_new("c:p:l:q:s:m:o:f:g:", ARRAY_LEN(topts), topts,
-            on_option, NULL, 0);
+    *opts = tpm2_options_new("c:p:l:q:s:m:o:F:f:g:", ARRAY_LEN(topts), topts,
+            on_option, 0, 0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    /* TODO this whole file needs to be re-done, especially the option validation */
-    if (!ctx.pcr_selections.count) {
-        LOG_ERR("Expected -l to be specified.");
-        return tool_rc_option_error;
-    }
-
-    if (ctx.cp_hash_path && (ctx.signature_path || ctx.message_path)) {
-        LOG_ERR("Cannot produce output when calculating cpHash");
-        return tool_rc_option_error;
-    }
-
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.key.ctx_path,
-            ctx.key.auth_str, &ctx.key.object, false, TPM2_HANDLE_ALL_W_NV);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid key authorization");
         return rc;
     }
 
-    if (ctx.pcr_path) {
-        ctx.pcr_output = fopen(ctx.pcr_path, "wb+");
-        if (!ctx.pcr_output) {
-            LOG_ERR("Could not open PCR output file \"%s\" error: \"%s\"",
-                    ctx.pcr_path, strerror(errno));
-            return tool_rc_general_error;
-        }
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    rc = pcr_get_banks(ectx, &ctx.cap_data, &ctx.algs);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = quote(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    return quote(ectx, &ctx.pcr_selections);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
+
+    /*
+     * 1. Free objects
+     */
     if (ctx.pcr_output) {
         fclose(ctx.pcr_output);
     }
-    return tpm2_session_close(&ctx.key.object.session);
+
+    free(ctx.quoted);
+    free(ctx.signature);
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.key.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("quote", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("quote", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_rsadecrypt.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_rsadecrypt.c Changed

@@ -9,8 +9,12 @@
 #include "tpm2_alg_util.h"
 #include "tpm2_options.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_rsadecrypt_ctx tpm_rsadecrypt_ctx;
 struct tpm_rsadecrypt_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -20,58 +24,186 @@
     TPM2B_DATA label;
     TPM2B_PUBLIC_KEY_RSA cipher_text;
     char *input_path;
-    char *output_file_path;
+
     TPMT_RSA_DECRYPT scheme;
+    const char *scheme_str;
 
-    char *cp_hash_path;
+    /*
+     * Outputs
+     */
+    char *output_file_path;
+    TPM2B_PUBLIC_KEY_RSA *message;
+    FILE *foutput;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_rsadecrypt_ctx ctx = {
-    .scheme = { .scheme = TPM2_ALG_RSAES }
+    .scheme = { .scheme = TPM2_ALG_RSAES },
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tool_rc rsa_decrypt_and_save(ESYS_CONTEXT *ectx) {
+static tool_rc rsa_decrypt(ESYS_CONTEXT *ectx) {
 
-    TPM2B_PUBLIC_KEY_RSA *message = NULL;
+    return tpm2_rsa_decrypt(ectx, &ctx.key.object, &ctx.cipher_text,
+        &ctx.scheme, &ctx.label, &ctx.message, &ctx.cp_hash,
+        ctx.parameter_hash_algorithm);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
     if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_rsa_decrypt(ectx, &ctx.key.object, &ctx.cipher_text,
-            &ctx.scheme, &ctx.label, &message, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
         }
+    }
 
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
         return rc;
     }
 
-    tool_rc rc = tpm2_rsa_decrypt(ectx, &ctx.key.object, &ctx.cipher_text,
-            &ctx.scheme, &ctx.label, &message, NULL);
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    is_file_op_success = files_write_bytes(ctx.foutput, ctx.message->buffer,
+        ctx.message->size);
+    if (ctx.foutput != stdout) {
+        fclose(ctx.foutput);
+    }
+
+    return is_file_op_success ? tool_rc_success : tool_rc_general_error;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.key.ctx_path,
+        ctx.key.auth_str, &ctx.key.object, false,
+        TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    bool ret = false;
-    FILE *f =
-            ctx.output_file_path ? fopen(ctx.output_file_path, "wb+") : stdout;
-    if (!f) {
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    ctx.foutput = ctx.output_file_path ?
+        fopen(ctx.output_file_path, "wb+") : stdout;
+    if (!ctx.foutput) {
+        return tool_rc_general_error;
+    }
+
+    TPM2B_PUBLIC *key_public_info = 0;
+    rc = tpm2_readpublic(ectx, ctx.key.object.tr_handle, &key_public_info,
+        0, 0);
+    if (rc != tool_rc_success) {
         goto out;
     }
 
-    ret = files_write_bytes(f, message->buffer, message->size);
-    if (f != stdout) {
-        fclose(f);
+    if (key_public_info->publicArea.type != TPM2_ALG_RSA) {
+            LOG_ERR("Unsupported key type for RSA decryption.");
+            rc = tool_rc_general_error;
+            goto out;
+    }
+
+    /*
+     * Get scheme information
+     */
+    if (ctx.scheme_str) {
+        rc = tpm2_alg_util_handle_rsa_ext_alg(ctx.scheme_str, key_public_info);
+        ctx.scheme.scheme =
+            key_public_info->publicArea.parameters.rsaDetail.scheme.scheme;
+        ctx.scheme.details.anySig.hashAlg =
+            key_public_info->publicArea.parameters.rsaDetail.scheme.details.anySig.hashAlg;
+
+        if (rc != tool_rc_success) {
+            goto out;
+        }
+    }
+
+    /*
+     * Get enc data blob
+     */
+    ctx.cipher_text.size = BUFFER_SIZE(TPM2B_PUBLIC_KEY_RSA, buffer);
+    bool result = files_load_bytes_from_buffer_or_file_or_stdin(0,
+            ctx.input_path, &ctx.cipher_text.size, ctx.cipher_text.buffer);
+    if (!result) {
+        rc = tool_rc_general_error;
     }
 
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.key.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
 out:
-    free(message);
+    Esys_Free(key_public_info);
+    return rc;
+}
 
-    return ret ? tool_rc_success : tool_rc_general_error;
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    if (!ctx.key.ctx_path) {
+        LOG_ERR("Expected argument -c.");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.output_file_path && ctx.cp_hash_path) {
+        LOG_ERR("Cannout decrypt when calculating cphash");
+        return tool_rc_option_error;
+    }
+
+    return tool_rc_success;
 }
 
 static bool on_option(char key, char *value) {
@@ -88,13 +220,7 @@
         break;
     }
     case 's':
-        ctx.scheme.scheme = tpm2_alg_util_from_optarg(value,
-                tpm2_alg_util_flags_rsa_scheme);
-        if (ctx.scheme.scheme == TPM2_ALG_ERROR) {
-            return false;
-        }
-        ctx.scheme.details.oaep.hashAlg = ctx.scheme.scheme == TPM2_ALG_OAEP ?
-            TPM2_ALG_SHA256 : 0;
+        ctx.scheme_str = value;
         break;
     case 0:
         ctx.cp_hash_path = value;
@@ -120,59 +246,75 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static struct option topts = {
-      { "auth",        required_argument, NULL, 'p' },
-      { "output",      required_argument, NULL, 'o' },
-      { "key-context", required_argument, NULL, 'c' },
-      { "scheme",      required_argument, NULL, 's' },
-      { "label",       required_argument, NULL, 'l' },
-      { "cphash",      required_argument, NULL,  0  },
+      { "auth",        required_argument, 0, 'p' },
+      { "output",      required_argument, 0, 'o' },
+      { "key-context", required_argument, 0, 'c' },
+      { "scheme",      required_argument, 0, 's' },
+      { "label",       required_argument, 0, 'l' },
+      { "cphash",      required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("p:o:c:s:l:", ARRAY_LEN(topts), topts, on_option,
-            on_args, 0);
+        on_args, 0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
-static tool_rc init(ESYS_CONTEXT *ectx) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
-    if (!ctx.key.ctx_path) {
-        LOG_ERR("Expected argument -c.");
-        return tool_rc_option_error;
-    }
+    UNUSED(flags);
 
-    if (ctx.output_file_path && ctx.cp_hash_path) {
-        LOG_ERR("Cannout decrypt when calculating cphash");
-        return tool_rc_option_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    ctx.cipher_text.size = BUFFER_SIZE(TPM2B_PUBLIC_KEY_RSA, buffer);
-    bool result = files_load_bytes_from_buffer_or_file_or_stdin(NULL,
-            ctx.input_path, &ctx.cipher_text.size, ctx.cipher_text.buffer);
-    if (!result) {
-        return tool_rc_general_error;
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return tpm2_util_object_load_auth(ectx, ctx.key.ctx_path, ctx.key.auth_str,
-            &ctx.key.object, false, TPM2_HANDLE_ALL_W_NV);
-}
-
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
-
-    UNUSED(flags);
-
-    tool_rc rc = init(ectx);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = rsa_decrypt(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    return rsa_decrypt_and_save(ectx);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    return tpm2_session_close(&ctx.key.object.session);
+
+    /*
+     * 1. Free objects
+     */
+    free(ctx.message);
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.key.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("rsadecrypt", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("rsadecrypt", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_rsaencrypt.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_rsaencrypt.c Changed

@@ -19,6 +19,7 @@
     char *output_path;
     char *input_path;
     TPMT_RSA_DECRYPT scheme;
+    const char *scheme_str;
     TPM2B_DATA label;
 };
 
@@ -63,13 +64,7 @@
         ctx.output_path = value;
         break;
     case 's':
-        ctx.scheme.scheme = tpm2_alg_util_from_optarg(value,
-                tpm2_alg_util_flags_rsa_scheme);
-        if (ctx.scheme.scheme == TPM2_ALG_ERROR) {
-            return false;
-        }
-        ctx.scheme.details.oaep.hashAlg = ctx.scheme.scheme == TPM2_ALG_OAEP ?
-            TPM2_ALG_SHA256 : 0;
+        ctx.scheme_str = value;
         break;
     case 'l':
         return tpm2_util_get_label(value, &ctx.label);
@@ -118,8 +113,43 @@
         return tool_rc_general_error;
     }
 
-    return tpm2_util_object_load(context, ctx.context_arg, &ctx.key_context,
-            TPM2_HANDLE_ALL_W_NV);
+    /*
+     * Load the decryption key
+     */
+    tool_rc rc = tpm2_util_object_load(context, ctx.context_arg, &ctx.key_context,
+        TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    TPM2B_PUBLIC *key_public_info = 0;
+    rc = tpm2_readpublic(context, ctx.key_context.tr_handle, &key_public_info,
+        NULL, NULL);
+    if (rc != tool_rc_success) {
+        goto out;
+    }
+
+    if (key_public_info->publicArea.type != TPM2_ALG_RSA) {
+            LOG_ERR("Unsupported key type for RSA decryption.");
+            rc = tool_rc_general_error;
+            goto out;
+    }
+
+    /*
+     * Get scheme information
+     */
+    if (ctx.scheme_str) {
+        rc = tpm2_alg_util_handle_rsa_ext_alg(ctx.scheme_str, key_public_info);
+        ctx.scheme.scheme =
+            key_public_info->publicArea.parameters.rsaDetail.scheme.scheme;
+        ctx.scheme.details.anySig.hashAlg =
+            key_public_info->publicArea.parameters.rsaDetail.scheme.details.anySig.hashAlg;
+    }
+
+out:
+    Esys_Free(key_public_info);
+
+    return rc;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, tpm2_option_flags flags) {

_service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_sessionconfig.c Added

@@ -0,0 +1,241 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+
+#include <inttypes.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "files.h"
+#include "log.h"
+#include "tpm2.h"
+#include "tpm2_policy.h"
+#include "tpm2_tool.h"
+
+typedef struct tpm_sessionconfig_ctx tpm_sessionconfig_ctx;
+struct tpm_sessionconfig_ctx {
+    tpm2_session *session;
+    const char *session_path;
+    TPMA_SESSION bmask;
+    TPMA_SESSION flags;
+    bool is_policy_session;
+};
+
+static tpm_sessionconfig_ctx ctx;
+
+#define PRINT_SESSION_ATTRIBUTE(ATTR, attr) \
+do { \
+    if (attrs & ATTR) { \
+        if (is_attr_set) { \
+            tpm2_tool_output("|"); \
+        } else { \
+            is_attr_set = true; \
+        } \
+        tpm2_tool_output(attr); \
+    } \
+} while(false)
+
+static tool_rc process_output(ESYS_CONTEXT *esys_context) {
+
+    ESYS_TR sessionhandle = tpm2_session_get_handle(ctx.session);
+    if (!sessionhandle) {
+        LOG_ERR("Session handle cannot be null");
+        return tool_rc_general_error;
+    }
+
+    if (ctx.bmask) {
+        return Esys_TRSess_SetAttributes(esys_context, sessionhandle, ctx.flags,
+            ctx.bmask);
+    }
+
+    TPM2_HANDLE tpm_handle;
+    TSS2_RC rv = Esys_TR_GetTpmHandle(esys_context, sessionhandle, &tpm_handle);
+    if (rv != TSS2_RC_SUCCESS) {
+        return tool_rc_general_error;
+    }
+
+    /*
+     * Describe session attributes
+     */
+    TPMA_SESSION attrs = 0;
+    tool_rc rc = tpm2_sess_get_attributes(esys_context, sessionhandle,
+        &attrs);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    tpm2_tool_output("Session-Handle: 0x%.8"PRIx32"\n", tpm_handle);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    bool is_attr_set = false;
+    tpm2_tool_output("Session-Attributes: ");
+    PRINT_SESSION_ATTRIBUTE(TPMA_SESSION_CONTINUESESSION, "continuesession");
+    PRINT_SESSION_ATTRIBUTE(TPMA_SESSION_AUDITEXCLUSIVE, "auditexclusive");
+    PRINT_SESSION_ATTRIBUTE(TPMA_SESSION_AUDITRESET, "auditreset");
+    PRINT_SESSION_ATTRIBUTE(TPMA_SESSION_DECRYPT, "decrypt");
+    PRINT_SESSION_ATTRIBUTE(TPMA_SESSION_ENCRYPT, "encrypt");
+    PRINT_SESSION_ATTRIBUTE(TPMA_SESSION_AUDIT, "audit");
+    tpm2_tool_output("\n");
+
+    if (ctx.is_policy_session) {
+        TPM2B_DIGEST *digest = NULL;
+        rc = tpm2_policy_get_digest(esys_context, ctx.session, &digest, NULL,
+            TPM2_ALG_NULL);
+        if (rc != tool_rc_success) {
+            LOG_ERR("Cannot read policy digest");
+            goto session_digest_out;
+        }
+
+        tpm2_tool_output("Session-Digest: ");
+        tpm2_util_print_tpm2b(digest);
+        tpm2_tool_output("\n");
+session_digest_out:
+        Esys_Free(digest);
+    }
+
+    return rc;
+}
+
+static tool_rc process_input(ESYS_CONTEXT *esys_context) {
+
+    tool_rc rc = tpm2_session_restore(esys_context, ctx.session_path, false,
+        &ctx.session);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Could not restore session from the specified file");
+        return rc;
+    }
+
+    ctx.is_policy_session =
+        (tpm2_session_get_type(ctx.session) == TPM2_SE_POLICY);
+
+    return tool_rc_success;
+}
+
+static bool on_option(char key, char *value) {
+
+    UNUSED(value);
+
+    switch (key) {
+        case 0:
+            ctx.bmask |= TPMA_SESSION_CONTINUESESSION;
+            ctx.flags |= TPMA_SESSION_CONTINUESESSION;
+            break;
+        case 1:
+            ctx.bmask |= TPMA_SESSION_CONTINUESESSION;
+            break;
+        case 2:
+            ctx.bmask |= TPMA_SESSION_AUDITEXCLUSIVE;
+            ctx.flags |= TPMA_SESSION_AUDITEXCLUSIVE;
+            break;
+        case 3:
+            ctx.bmask |= TPMA_SESSION_AUDITEXCLUSIVE;
+            break;
+        case 4:
+            ctx.bmask |= TPMA_SESSION_AUDITRESET;
+            ctx.flags |= TPMA_SESSION_AUDITRESET;
+            break;
+        case 5:
+            ctx.bmask |= TPMA_SESSION_AUDITRESET;
+            break;
+        case 6:
+            ctx.bmask |= TPMA_SESSION_DECRYPT;
+            ctx.flags |= TPMA_SESSION_DECRYPT;
+            break;
+        case 7:
+            ctx.bmask |= TPMA_SESSION_DECRYPT;
+            break;
+        case 8:
+            ctx.bmask |= TPMA_SESSION_ENCRYPT;
+            ctx.flags |= TPMA_SESSION_ENCRYPT;
+            break;
+        case 9:
+            ctx.bmask |= TPMA_SESSION_ENCRYPT;
+            break;
+        case 10:
+            ctx.bmask |= TPMA_SESSION_AUDIT;
+            ctx.flags |= TPMA_SESSION_AUDIT;
+            break;
+        case 11:
+            ctx.bmask |= TPMA_SESSION_AUDIT;
+            break;
+    }
+
+    return true;
+}
+
+static bool on_args(int argc, char **argv) {
+
+    if (argc > 1) {
+        LOG_ERR("Argument takes one file name for session data");
+        return false;
+    }
+
+    ctx.session_path = argv0;
+
+    return true;
+}
+
+static bool is_input_option_args_valid(void) {
+
+    if (!ctx.session_path) {
+        LOG_ERR("Must specify session file as an argument.");
+        return false;
+    }
+
+    return true;
+}
+
+static bool tpm2_tool_onstart(tpm2_options **opts) {
+
+    const struct option topts = {
+        { "enable-continuesession",  no_argument, NULL, 0  },
+        { "disable-continuesession", no_argument, NULL, 1  },
+        { "enable-auditexclusive",   no_argument, NULL, 2  },
+        { "disable-auditexclusive",  no_argument, NULL, 3  },
+        { "enable-auditreset",       no_argument, NULL, 4  },
+        { "disable-auditreset",      no_argument, NULL, 5  },
+        { "enable-decrypt",          no_argument, NULL, 6  },
+        { "disable-decrypt",         no_argument, NULL, 7  },
+        { "enable-encrypt",          no_argument, NULL, 8  },
+        { "disable-encrypt",         no_argument, NULL, 9  },
+        { "enable-audit",            no_argument, NULL, 10 },
+        { "disable-audit",           no_argument, NULL, 11 },
+    };
+
+    *opts = tpm2_options_new(NULL, ARRAY_LEN(topts), topts, on_option, on_args,
+        0);
+
+    return *opts != NULL;
+}
+
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *esys_context,
+tpm2_option_flags flags) {
+
+    UNUSED(flags);
+
+    bool retval = is_input_option_args_valid();
+    if (!retval) {
+        return tool_rc_option_error;
+    }
+
+    tool_rc rc = process_input(esys_context);
+    if(rc != tool_rc_success) {
+        return rc;
+    }
+
+    return process_output(esys_context);
+    /*
+     * Disabling continuesession should flush the session after use.
+     */
+}
+
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *esys_context) {
+
+    UNUSED(esys_context);
+    return tpm2_session_close(&ctx.session);
+}
+
+// Register this tool with tpm2_tool.c
+TPM2_TOOL_REGISTER("sessionconfig", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_setclock.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_setclock.c Changed

@@ -7,20 +7,138 @@
 #include "tpm2_tool.h"
 #include "tpm2_util.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm2_setclock_ctx tpm2_setclock_ctx;
 struct tpm2_setclock_ctx {
+    /*
+     * Inputs
+     */
+    struct {
+        const char *ctx_path;
+        const char *auth_str;
+        tpm2_loaded_object object;
+    } auth_hierarchy;
+
     bool time_set;
     UINT64 new_time;
-    const char *auth_hierarchy;
-    tpm2_loaded_object object;
-    const char *auth_value;
-    char *cp_hash_path;
+
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm2_setclock_ctx ctx = {
-        .auth_hierarchy = "o" /* default to owner hierarchy */
+    .auth_hierarchy.ctx_path = "o", /* default to owner hierarchy */
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
+static tool_rc setclock(ESYS_CONTEXT *ectx) {
+
+    return tpm2_setclock(ectx, &ctx.auth_hierarchy.object, ctx.new_time,
+        &ctx.cp_hash, ctx.parameter_hash_algorithm);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
+    }
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    return rc;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
+            ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_P|TPM2_HANDLE_FLAGS_O);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.auth_hierarchy.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+
+    if (!ctx.time_set) {
+        LOG_ERR("Expected single argument of time to set");
+        return tool_rc_general_error;
+    }
+
+    return tool_rc_success;
+}
+
 static bool on_arg(int argc, char **argv) {
 
     if (argc != 1) {
@@ -43,10 +161,10 @@
 
     switch (key) {
     case 'c':
-        ctx.auth_hierarchy = value;
+        ctx.auth_hierarchy.ctx_path = value;
         break;
     case 'p':
-        ctx.auth_value = value;
+        ctx.auth_hierarchy.auth_str = value;
         break;
     case 0:
         ctx.cp_hash_path = value;
@@ -60,55 +178,71 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     const struct option topts = {
-        { "hierarchy", required_argument, NULL, 'c' },
-        { "auth",      required_argument, NULL, 'p' },
-        { "cphash",    required_argument, NULL,  0  },
+        { "hierarchy", required_argument, 0, 'c' },
+        { "auth",      required_argument, 0, 'p' },
+        { "cphash",    required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("c:p:", ARRAY_LEN(topts), topts, on_option,
     on_arg, 0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    if (!ctx.time_set) {
-        LOG_ERR("Expected single argument of time to set");
-        return tool_rc_general_error;
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy,
-            ctx.auth_value, &ctx.object, false,
-            TPM2_HANDLE_FLAGS_P|TPM2_HANDLE_FLAGS_O);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        LOG_WARN("Calculating cpHash. Exiting without setting clock.");
-        rc = tpm2_setclock(ectx, &ctx.object, ctx.new_time, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = setclock(ectx);
+    if (rc != tool_rc_success) {
         return rc;
     }
 
-    return tpm2_setclock(ectx, &ctx.object, ctx.new_time, NULL);
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
 
-    return tpm2_session_close(&ctx.object.session);
+    /*
+     * 1. Free objects
+     */
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.auth_hierarchy.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("setclock", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("setclock", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_setprimarypolicy.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_setprimarypolicy.c Changed

@@ -9,9 +9,12 @@
 #include "tpm2_nv_util.h"
 #include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_setprimarypolicy_ctx tpm_setprimarypolicy_ctx;
 struct tpm_setprimarypolicy_ctx {
-    //Input
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
@@ -19,25 +22,151 @@
     } hierarchy;
 
     const char *policy_path;
-
+    TPM2B_DIGEST *auth_policy;
     TPMI_ALG_HASH hash_algorithm;
 
-    char *cp_hash_path;
+    /*
+     * Outputs
+     */
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_setprimarypolicy_ctx ctx = {
     .hash_algorithm = TPM2_ALG_NULL,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static bool set_digest_algorithm(char *value) {
+static tool_rc setprimarypolicy(ESYS_CONTEXT *ectx) {
+
+    return tpm2_setprimarypolicy(ectx, &ctx.hierarchy.object, ctx.auth_policy,
+        ctx.hash_algorithm, &ctx.cp_hash, ctx.parameter_hash_algorithm);
+}
+
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
-    ctx.hash_algorithm = tpm2_alg_util_from_optarg(value, tpm2_alg_util_flags_hash);
-    if (ctx.hash_algorithm == TPM2_ALG_ERROR) {
-        LOG_ERR("Could not convert to number or lookup algorithm, got: "
-                "\"%s\"", value);
-        return false;
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
+    if (ctx.cp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
+
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
+        return rc;
     }
-    return true;
+
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    return rc;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.hierarchy.ctx_path,
+            ctx.hierarchy.auth_str, &ctx.hierarchy.object, false,
+            TPM2_HANDLE_FLAGS_O|TPM2_HANDLE_FLAGS_P|TPM2_HANDLE_FLAGS_E|
+            TPM2_HANDLE_FLAGS_L);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+    if (ctx.policy_path) {
+
+        ctx.auth_policy = malloc(UINT16_MAX + sizeof(uint16_t));
+        if (!ctx.auth_policy) {
+            LOG_ERR("oom");
+            return tool_rc_general_error;
+        }
+
+        (ctx.auth_policy)->size = UINT16_MAX;
+        bool result = files_load_bytes_from_path(ctx.policy_path,
+                (ctx.auth_policy)->buffer, &((ctx.auth_policy)->size));
+        if (!result) {
+            LOG_ERR("Failed loading policy digest from path");
+            return tool_rc_general_error;
+        }
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.hierarchy.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(ESYS_CONTEXT * ectx) {
+
+    UNUSED(ectx);
+
+    if (!ctx.hierarchy.ctx_path) {
+        LOG_ERR("Must specify the hierarchy '-C'.");
+        return tool_rc_option_error;
+    }
+
+    tool_rc rc = tool_rc_success;
+    if (ctx.policy_path) {
+        unsigned long file_size = 0;
+        bool result = files_get_file_size_path(ctx.policy_path, &file_size);
+        if (!result || file_size == 0) {
+            rc = tool_rc_general_error;
+        }
+    }
+
+    return rc;
 }
 
 static bool on_option(char key, char *value) {
@@ -55,7 +184,13 @@
         ctx.policy_path = value;
         break;
     case 'g':
-        result = set_digest_algorithm(value);
+        ctx.hash_algorithm = tpm2_alg_util_from_optarg(value,
+            tpm2_alg_util_flags_hash);
+        if (ctx.hash_algorithm == TPM2_ALG_ERROR) {
+            LOG_ERR("Could not convert to number or lookup algorithm, got: "
+                    "\"%s\"", value);
+            return false;
+        }
         break;
     case 0:
         ctx.cp_hash_path = value;
@@ -68,123 +203,75 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static const struct option topts = {
-        { "hierarchy",      required_argument, NULL, 'C' },
-        { "auth",           required_argument, NULL, 'P' },
-        { "policy",         required_argument, NULL, 'L' },
-        { "hash-algorithm", required_argument, NULL, 'g' },
-        { "cphash",         required_argument, NULL,  0  },
+        { "hierarchy",      required_argument, 0, 'C' },
+        { "auth",           required_argument, 0, 'P' },
+        { "policy",         required_argument, 0, 'L' },
+        { "hash-algorithm", required_argument, 0, 'g' },
+        { "cphash",         required_argument, 0,  0  },
     };
 
     *opts = tpm2_options_new("C:P:L:g:", ARRAY_LEN(topts), topts,
-        on_option, NULL, 0);
+        on_option, 0, 0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
-static bool is_input_options_args_valid(void) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
-    if (!ctx.hierarchy.ctx_path) {
-        LOG_ERR("Must specify the hierarchy '-C'.");
-        return false;
-    }
 
-    bool result = true;
-    if (ctx.policy_path) {
-        unsigned long file_size = 0;
-        result = files_get_file_size_path(ctx.policy_path, &file_size);
-        if (!result || file_size == 0) {
-            result = false;
-        }
-    }
+    UNUSED(flags);
 
-    if (ctx.cp_hash_path) {
-        LOG_WARN("Calculating cpHash. Exiting without setting primary policy.");
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return result;
-}
-
-static tool_rc process_setprimarypolicy_input(ESYS_CONTEXT *ectx,
-    TPM2B_DIGEST **auth_policy) {
-
     /*
-     * Load hierarchy handle and auth
+     * 2. Process inputs
      */
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.hierarchy.ctx_path,
-            ctx.hierarchy.auth_str, &ctx.hierarchy.object, false,
-            TPM2_HANDLE_FLAGS_O|TPM2_HANDLE_FLAGS_P|TPM2_HANDLE_FLAGS_E|
-            TPM2_HANDLE_FLAGS_L);
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
     /*
-     * Load policy digest if one is specified
+     * 3. TPM2_CC_<command> call
      */
-    if (ctx.policy_path) {
-
-        *auth_policy = malloc(UINT16_MAX + sizeof(uint16_t));
-        if (!*auth_policy) {
-            LOG_ERR("oom");
-            return tool_rc_general_error;
-        }
-
-        (*auth_policy)->size = UINT16_MAX;
-        bool result = files_load_bytes_from_path(ctx.policy_path,
-                (*auth_policy)->buffer, &((*auth_policy)->size));
-        if (!result) {
-            LOG_ERR("Failed loading policy digest from path");
-            return tool_rc_general_error;
-        }
+    rc = setprimarypolicy(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
     }
 
-    return tool_rc_success;
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
 
-    /* opts is unused, avoid compiler warning */
-    UNUSED(flags);
+    UNUSED(ectx);
 
-    bool result = is_input_options_args_valid();
-    if (!result) {
-        return tool_rc_option_error;
-    }
+    /*
+     * 1. Free objects
+     */
+    free(ctx.auth_policy);
 
-    //Input
-    TPM2B_DIGEST *auth_policy = NULL;
-    tool_rc rc = process_setprimarypolicy_input(ectx, &auth_policy);
-    if (rc != tool_rc_success) {
-        return rc;
-    }
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.hierarchy.object.session);
 
-    //ESAPI call
-    if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        rc = tpm2_setprimarypolicy(ectx, &ctx.hierarchy.object, auth_policy,
-        ctx.hash_algorithm, &cp_hash);
-        if (rc != tool_rc_success) {
-            goto out;
-        }
+    /*
+     * 3. Close auxiliary sessions
+     */
 
-        result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
-        }
-        goto out;
-    }
-    rc = tpm2_setprimarypolicy(ectx, &ctx.hierarchy.object, auth_policy,
-        ctx.hash_algorithm, NULL);
-out:
-    free(auth_policy);
     return rc;
 }
 
-static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
-
-    UNUSED(ectx);
-    return tpm2_session_close(&ctx.hierarchy.object.session);
-}
-
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("setprimarypolicy", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("setprimarypolicy", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, 0)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_sign.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_sign.c Changed

@@ -7,94 +7,236 @@
 #include "files.h"
 #include "log.h"
 #include "tpm2.h"
-#include "tpm2_tool.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_convert.h"
 #include "tpm2_hash.h"
 #include "tpm2_options.h"
+#include "tpm2_tool.h"
 
+#define MAX_SESSIONS 3
 typedef struct tpm_sign_ctx tpm_sign_ctx;
 struct tpm_sign_ctx {
-    TPMT_TK_HASHCHECK validation;
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
         tpm2_loaded_object object;
     } signing_key;
 
+    bool is_input_msg_digest;
+    BYTE *msg;
+    UINT16 length;
+    char *input_file;
+    bool is_hash_ticket_specified;
+    TPMT_TK_HASHCHECK validation;
+
     TPMI_ALG_HASH halg;
     TPMI_ALG_SIG_SCHEME sig_scheme;
     TPMT_SIG_SCHEME in_scheme;
     TPM2B_DIGEST *digest;
-    char *output_path;
-    BYTE *msg;
-    UINT16 length;
-    char *input_file;
     tpm2_convert_sig_fmt sig_format;
 
-    struct {
-        UINT8 d :1;
-        UINT8 t :1;
-        UINT8 o :1;
-    } flags;
-
-    char *cp_hash_path;
     char *commit_index;
+
+    /*
+     * Outputs
+     */
+    TPMT_SIGNATURE *signature;
+    char *output_path;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
 };
 
 static tpm_sign_ctx ctx = {
-        .halg = TPM2_ALG_NULL,
-        .sig_scheme = TPM2_ALG_NULL
+    .halg = TPM2_ALG_NULL,
+    .sig_scheme = TPM2_ALG_NULL,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tool_rc sign_and_save(ESYS_CONTEXT *ectx) {
+static tool_rc sign(ESYS_CONTEXT *ectx) {
 
-    TPMT_SIGNATURE *signature;
-    bool result;
+    return tpm2_sign(ectx, &ctx.signing_key.object, ctx.digest, &ctx.in_scheme,
+        &ctx.validation, &ctx.signature, &ctx.cp_hash,
+        ctx.parameter_hash_algorithm);
+}
 
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
     if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_sign(ectx, &ctx.signing_key.object, ctx.digest,
-            &ctx.in_scheme, &ctx.validation, &signature, &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
         }
+    }
 
+    tool_rc rc = tool_rc_success;
+    if (!ctx.is_command_dispatch) {
         return rc;
     }
 
-    tool_rc rc = tpm2_sign(ectx, &ctx.signing_key.object, ctx.digest,
-            &ctx.in_scheme, &ctx.validation, &signature, NULL);
-    if (rc != tool_rc_success) {
-        goto out;
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
+    is_file_op_success = tpm2_convert_sig_save(ctx.signature, ctx.sig_format,
+        ctx.output_path);
+    if (!is_file_op_success) {
+        rc = tool_rc_general_error;
     }
 
-    result = tpm2_convert_sig_save(signature, ctx.sig_format, ctx.output_path);
-    if (!result) {
-        rc = tool_rc_general_error;
-        goto out;
+    return rc;
+}
+
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
+
+    UNUSED(ectx);
+    /*
+     * 1. Object and auth initializations
+     */
+
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
+    /*
+     * Signing key object loaded in check_options
+     */
+
+    /*
+     * 2. Restore auxiliary sessions
+     */
+
+    /*
+     * 3. Command specific initializations
+     */
+
+    /*
+     * Applicable when input data is not a digest, rather the message to sign.
+     * A digest is calculated first in this case.
+     */
+    tool_rc rc = tool_rc_success;
+    TPMT_TK_HASHCHECK *temp_validation_ticket = NULL;
+    if (!ctx.is_input_msg_digest) {
+
+        FILE *input = ctx.input_file ? fopen(ctx.input_file, "rb") : stdin;
+        if (!input) {
+            LOG_ERR("Could not open file \"%s\"", ctx.input_file);
+            return tool_rc_general_error;
+        }
+
+        if (ctx.in_scheme.scheme == TPM2_ALG_SM2 && ctx.halg == TPM2_ALG_SM3_256) {
+            TPM2B_DIGEST z_digest;
+            rc = tpm2_alg_util_sm2_compute_id_digest(ectx, ctx.signing_key.object.tr_handle,
+                    SM2_DEFAULT_ID, SM2_DEFAULT_ID_LENGTH, &z_digest);
+            if (rc != tool_rc_success) {
+                LOG_ERR("Sign could not compute id digest");
+            } else {
+                rc = tpm2_sm2_compute_msg_digest_file(ectx, ctx.halg, TPM2_RH_OWNER, input, &z_digest,
+                        &ctx.digest, &temp_validation_ticket);
+            }
+        } else {
+            rc = tpm2_hash_file(ectx, ctx.halg, TPM2_RH_OWNER, input, &ctx.digest,
+                    &temp_validation_ticket);
+        }
+        if (input != stdin) {
+            fclose(input);
+        }
+
+        if (rc != tool_rc_success) {
+            LOG_ERR("Could not hash input");
+        } else {
+            ctx.validation = *temp_validation_ticket;
+        }
+
+        free(temp_validation_ticket);
     }
 
-    rc = tool_rc_success;
+    if (ctx.is_input_msg_digest) {
+        /*
+         * else process it as a pre-computed digest
+         */
+        ctx.digest = malloc(sizeof(TPM2B_DIGEST));
+        if (!ctx.digest) {
+            LOG_ERR("oom");
+            return tool_rc_general_error;
+        }
 
-out:
-    free(signature);
+        ctx.digest->size = sizeof(ctx.digest->buffer);
+        bool result = files_load_bytes_from_buffer_or_file_or_stdin(0,
+                ctx.input_file, &ctx.digest->size, ctx.digest->buffer);
+        if (!result) {
+            return tool_rc_general_error;
+        }
+
+        /*
+         * Applicable to un-restricted signing keys
+         * NOTE: When digests without tickets are specified for restricted keys,
+         * the sign operation will fail.
+         */
+        if (ctx.is_input_msg_digest && !ctx.is_hash_ticket_specified) {
+            ctx.validation.tag = TPM2_ST_HASHCHECK;
+            ctx.validation.hierarchy = TPM2_RH_NULL;
+            memset(&ctx.validation.digest, 0, sizeof(ctx.validation.digest));
+        }
+    }
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /*
+     * 4.a Determine pHash length and alg
+     */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.signing_key.object.session,
+        0,
+        0
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, 0, 0, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     */
+    ctx.is_command_dispatch = ctx.cp_hash_path ? false : true;
 
     return rc;
 }
 
-static tool_rc init(ESYS_CONTEXT *ectx) {
+static tool_rc check_options(ESYS_CONTEXT *ectx) {
+
+    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
+            ctx.signing_key.auth_str, &ctx.signing_key.object, false,
+            TPM2_HANDLE_ALL_W_NV);
+    if (rc != tool_rc_success) {
+        LOG_ERR("Invalid key authorization");
+        return rc;
+    }
 
     /*
      * Set signature scheme for key type, or validate chosen scheme is
      * allowed for key type.
      */
-    tool_rc rc = tpm2_alg_util_get_signature_scheme(ectx,
+    rc = tpm2_alg_util_get_signature_scheme(ectx,
             ctx.signing_key.object.tr_handle, &ctx.halg, ctx.sig_scheme,
             &ctx.in_scheme);
     if (rc != tool_rc_success) {
@@ -131,73 +273,16 @@
         return tool_rc_option_error;
     }
 
-    if (!ctx.flags.o && !ctx.cp_hash_path) {
+    if (!ctx.output_path && !ctx.cp_hash_path) {
         LOG_ERR("Expected option o");
         return tool_rc_option_error;
     }
 
-    if (!ctx.flags.d && ctx.flags.t) {
+    if (!ctx.is_input_msg_digest && ctx.is_hash_ticket_specified) {
         LOG_WARN("Ignoring the specified validation ticket since no TPM "
                  "calculated digest specified.");
     }
 
-    /*
-     * Applicable when input data is not a digest, rather the message to sign.
-     * A digest is calculated first in this case.
-     */
-    if (!ctx.flags.d) {
-        FILE *input = ctx.input_file ? fopen(ctx.input_file, "rb") : stdin;
-        if (!input) {
-            LOG_ERR("Could not open file \"%s\"", ctx.input_file);
-            return tool_rc_general_error;
-        }
-
-        TPMT_TK_HASHCHECK *temp_validation_ticket;
-        rc = tpm2_hash_file(ectx, ctx.halg, TPM2_RH_OWNER, input, &ctx.digest,
-                &temp_validation_ticket);
-        if (input != stdin) {
-            fclose(input);
-        }
-        if (rc != tool_rc_success) {
-            LOG_ERR("Could not hash input");
-        }
-
-        ctx.validation = *temp_validation_ticket;
-        free(temp_validation_ticket);
-
-        /*
-         * we don't need to perform the digest, just read it
-         */
-        return rc;
-    }
-
-    /*
-     * else process it as a pre-computed digest
-     */
-    ctx.digest = malloc(sizeof(TPM2B_DIGEST));
-    if (!ctx.digest) {
-        LOG_ERR("oom");
-        return tool_rc_general_error;
-    }
-
-    ctx.digest->size = sizeof(ctx.digest->buffer);
-    bool result = files_load_bytes_from_buffer_or_file_or_stdin(NULL,
-            ctx.input_file, &ctx.digest->size, ctx.digest->buffer);
-    if (!result) {
-        return tool_rc_general_error;
-    }
-
-    /*
-     * Applicable to un-restricted signing keys
-     * NOTE: When digests without tickets are specified for restricted keys,
-     * the sign operation will fail.
-     */
-    if (ctx.flags.d && !ctx.flags.t) {
-        ctx.validation.tag = TPM2_ST_HASHCHECK;
-        ctx.validation.hierarchy = TPM2_RH_NULL;
-        memset(&ctx.validation.digest, 0, sizeof(ctx.validation.digest));
-    }
-
     return tool_rc_success;
 }
 
@@ -228,19 +313,18 @@
     }
         break;
     case 'd':
-        ctx.flags.d = 1;
+        ctx.is_input_msg_digest = true;
         break;
     case 't': {
         bool result = files_load_validation(value, &ctx.validation);
         if (!result) {
             return false;
         }
-        ctx.flags.t = 1;
+        ctx.is_hash_ticket_specified = true;
     }
         break;
     case 'o':
         ctx.output_path = value;
-        ctx.flags.o = 1;
         break;
     case 0:
         ctx.cp_hash_path = value;
@@ -275,47 +359,76 @@
 static bool tpm2_tool_onstart(tpm2_options **opts) {
 
     static const struct option topts = {
-      { "auth",                 required_argument, NULL, 'p' },
-      { "hash-algorithm",       required_argument, NULL, 'g' },
-      { "scheme",               required_argument, NULL, 's' },
-      { "digest",               no_argument,       NULL, 'd' },
-      { "signature",            required_argument, NULL, 'o' },
-      { "ticket",               required_argument, NULL, 't' },
-      { "key-context",          required_argument, NULL, 'c' },
-      { "format",               required_argument, NULL, 'f' },
-      { "cphash",               required_argument, NULL,  0  },
-      { "commit-index",       required_argument, NULL,  1  },
+      { "auth",           required_argument, 0, 'p' },
+      { "hash-algorithm", required_argument, 0, 'g' },
+      { "scheme",         required_argument, 0, 's' },
+      { "digest",         no_argument,       0, 'd' },
+      { "signature",      required_argument, 0, 'o' },
+      { "ticket",         required_argument, 0, 't' },
+      { "key-context",    required_argument, 0, 'c' },
+      { "format",         required_argument, 0, 'f' },
+      { "cphash",         required_argument, 0,  0  },
+      { "commit-index",   required_argument, 0,  1  },
     };
 
     *opts = tpm2_options_new("p:g:dt:o:c:f:s:", ARRAY_LEN(topts), topts,
             on_option, on_args, 0);
 
-    return *opts != NULL;
+    return *opts != 0;
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
-    tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
-            ctx.signing_key.auth_str, &ctx.signing_key.object, false,
-            TPM2_HANDLE_ALL_W_NV);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options(ectx);
     if (rc != tool_rc_success) {
-        LOG_ERR("Invalid key authorization");
         return rc;
     }
 
-    rc = init(ectx);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    return sign_and_save(ectx);
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = sign(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    return tpm2_session_close(&ctx.signing_key.object.session);
+
+    /*
+     * 1. Free objects
+     */
+    free(ctx.signature);
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tpm2_session_close(&ctx.signing_key.object.session);
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    return rc;
 }
 
 static void tpm2_tool_onexit(void) {
@@ -323,8 +436,10 @@
     if (ctx.digest) {
         free(ctx.digest);
     }
+
     free(ctx.msg);
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("sign", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, tpm2_tool_onexit)
+TPM2_TOOL_REGISTER("sign", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, tpm2_tool_onexit)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_startauthsession.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_startauthsession.c Changed

@@ -1,9 +1,13 @@
 /* SPDX-License-Identifier: BSD-3-Clause */
 
 #include <stdbool.h>
+#include <string.h>
 
+#include "files.h"
 #include "log.h"
 #include "object.h"
+#include "tpm2.h"
+#include "tpm2_auth_util.h"
 #include "tpm2_tool.h"
 #include "tpm2_alg_util.h"
 #include "tpm2_options.h"
@@ -13,8 +17,26 @@
     struct {
         TPM2_SE type;
         TPMI_ALG_HASH halg;
-        const char *key_context_arg_str;
-        tpm2_loaded_object key_context_object;
+        TPMT_SYM_DEF sym;
+        struct {
+            /*
+             * Salt generated by esys is encrypted using the tpmkey and
+             * encryption does not require auth to be specified.
+             */
+            const char *key_context_arg_str;
+            tpm2_loaded_object key_context_object;
+        } tpmkey;
+
+        struct {
+            /*
+             * While TPM2_CC_StartAuthSession does not required the auth of the
+             * bind to be specified, it is captured here for esys to calculate
+             * the sessionkey.
+             */
+            const char *bind_context_arg_str;
+            const char *bind_context_auth_str;
+            tpm2_loaded_object bind_context_object;
+        } bind;
     } session;
     struct {
         const char *path;
@@ -23,15 +45,32 @@
     tpm2_session_data *session_data;
     TPMA_SESSION attrs;
     bool is_real_policy_session;
-    bool is_session_encryption_required;
+    bool is_hmac_session;
+    bool is_session_encryption_possibly_needed;
     bool is_session_audit_required;
+    /* Salted/ Bounded session combinations */
+    bool is_salted;
+    bool is_bounded;
+    bool is_salt_and_bind_obj_same;
+
+    const char *name_path;
+    TPM2B_NAME name;
 };
 
 static tpm2_startauthsession_ctx ctx = {
+    .attrs = TPMA_SESSION_CONTINUESESSION,
     .session = {
         .type = TPM2_SE_TRIAL,
-        .halg = TPM2_ALG_SHA256
-    }
+        .halg = TPM2_ALG_SHA256,
+        .sym = {
+            .algorithm = TPM2_ALG_AES,
+            .keyBits = { .aes = 128 },
+            .mode = { .aes = TPM2_ALG_CFB }
+        },
+    },
+    .name = {
+        .size = BUFFER_SIZE(TPM2B_NAME, name)
+    },
 };
 
 static bool on_option(char key, char *value) {
@@ -41,7 +80,9 @@
         ctx.is_real_policy_session = true;
         break;
     case 1:
+        ctx.is_hmac_session = true;
         ctx.is_session_audit_required = true;
+        ctx.attrs |= TPMA_SESSION_AUDIT;
         break;
     case 'g':
         ctx.session.halg = tpm2_alg_util_from_optarg(value,
@@ -51,11 +92,43 @@
             return false;
         }
         break;
+    case 'G':
+        ctx.session.sym.algorithm = tpm2_alg_util_from_optarg(value,
+                tpm2_alg_util_flags_symmetric);
+        if (ctx.session.sym.algorithm == TPM2_ALG_ERROR) {
+            LOG_ERR("Invalid symmetric algorithm");
+            return false;
+        }
+        break;
     case 'S':
         ctx.output.path = value;
         break;
     case 'c':
-        ctx.session.key_context_arg_str = value;
+        ctx.is_salt_and_bind_obj_same = true;
+        ctx.session.tpmkey.key_context_arg_str = value;
+        ctx.session.bind.bind_context_arg_str = value;
+        ctx.is_session_encryption_possibly_needed = true;
+        ctx.attrs |= (TPMA_SESSION_DECRYPT | TPMA_SESSION_ENCRYPT);
+        break;
+    case 'n':
+        ctx.name_path = value;
+        break;
+    case 2:
+        ctx.is_bounded = true;
+        ctx.session.bind.bind_context_arg_str = value;
+        ctx.is_session_encryption_possibly_needed = true;
+        break;
+    case 3:
+        ctx.session.bind.bind_context_auth_str = value;
+        break;
+    case 4:
+        ctx.is_salted = true;
+        ctx.session.tpmkey.key_context_arg_str = value;
+        ctx.is_session_encryption_possibly_needed = true;
+        break;
+    case 5:
+        ctx.is_hmac_session = true;
+        ctx.is_session_encryption_possibly_needed = true;
         break;
     }
 
@@ -67,12 +140,18 @@
     static struct option topts = {
         { "policy-session", no_argument,       NULL,  0 },
         { "audit-session",  no_argument,       NULL,  1 },
-        { "key-context",    required_argument, NULL, 'c'},
+        { "bind-context",   required_argument, NULL,  2 },
+        { "bind-auth",      required_argument, NULL,  3 },
+        { "tpmkey-context", required_argument, NULL,  4 },
+        { "hmac-session",   no_argument,       NULL,  5 },
         { "hash-algorithm", required_argument, NULL, 'g'},
+        { "key-algorithm",  required_argument, NULL, 'G'},
         { "session",        required_argument, NULL, 'S'},
+        { "key-context",    required_argument, NULL, 'c'},
+        { "name",           required_argument, NULL, 'n'},
     };
 
-    *opts = tpm2_options_new("g:S:c:", ARRAY_LEN(topts), topts, on_option,
+    *opts = tpm2_options_new("g:G:S:c:n:", ARRAY_LEN(topts), topts, on_option,
     NULL, 0);
 
     return *opts != NULL;
@@ -85,20 +164,52 @@
         return tool_rc_option_error;
     }
 
-    if (!ctx.is_real_policy_session && !ctx.is_session_audit_required &&
-    ctx.session.key_context_arg_str) {
+    /* Trial-session: neither real_policy nor audit/hmac session */
+    if (!ctx.is_real_policy_session && !ctx.is_hmac_session &&
+    ctx.is_session_encryption_possibly_needed) {
         LOG_ERR("Trial sessions cannot be additionally used as encrypt/decrypt "
                 "session");
         return tool_rc_option_error;
     }
 
+    /*
+     * Only use --key-context if both bind and tpmkey objects are the same.
+     */
+    if (ctx.is_salted && ctx.is_salt_and_bind_obj_same) {
+        LOG_ERR("Specify --key-context or tpmkey-context, not both.");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.is_bounded && ctx.is_salt_and_bind_obj_same) {
+        LOG_ERR("Specify --key-context or --bind-context, not both.");
+        return tool_rc_option_error;
+    }
+
+    if (ctx.session.bind.bind_context_auth_str &&
+    !ctx.session.bind.bind_context_arg_str) {
+        LOG_ERR("Specify the bind entity when specifying the bind auth "
+                "even when bind is same as tpmkey object.");
+        return tool_rc_option_error;
+    }
+
+    /*
+     * Setting sessions for audit should be handled with tpm2_sessionconfig
+     * The following support is for backwards compatibility
+     */
     if (ctx.is_real_policy_session && ctx.is_session_audit_required) {
         LOG_ERR("Policy sessions cannot be additionally used for audit");
         return tool_rc_option_error;
     }
 
-    if (ctx.is_session_audit_required) {
-        LOG_WARN("Starting an HMAC session for use with auditing.");
+    /*
+     * A session cannot be without a purpose.
+     */
+    if (!(ctx.attrs & TPMA_SESSION_AUDIT) &&
+    !(ctx.attrs & TPMA_SESSION_ENCRYPT) &&
+    !(ctx.attrs & TPMA_SESSION_DECRYPT) && ctx.is_hmac_session) {
+        LOG_WARN("Session has to be used either for auth and/or audit and/or "
+                 "parameter-encryption/decryption. Use session-config tool to "
+                 "specify the use");
     }
 
     return tool_rc_success;
@@ -110,11 +221,10 @@
         ctx.session.type = TPM2_SE_POLICY;
     }
 
-    if (ctx.is_session_audit_required) {
+    if (ctx.is_hmac_session) {
         ctx.session.type = TPM2_SE_HMAC;
     }
 
-
     ctx.session_data = tpm2_session_data_new(ctx.session.type);
     if (!ctx.session_data) {
         LOG_ERR("oom");
@@ -125,60 +235,122 @@
 
     tpm2_session_set_authhash(ctx.session_data, ctx.session.halg);
 
-    /* if it has an encryption key, set it as both the encryption key and bind key */
-    if (ctx.is_session_encryption_required) {
-        tpm2_session_set_key(ctx.session_data,
-                ctx.session.key_context_object.tr_handle);
-        tpm2_session_set_bind(ctx.session_data,
-                ctx.session.key_context_object.tr_handle);
-
-        TPMT_SYM_DEF sym = { .algorithm = TPM2_ALG_AES, .keyBits =
-                { .aes = 128 }, .mode = { .aes = TPM2_ALG_CFB } };
+    if (ctx.is_session_encryption_possibly_needed) {
 
-        tpm2_session_set_symmetric(ctx.session_data, &sym);
-
-        ctx.attrs = TPMA_SESSION_CONTINUESESSION | \
-                    TPMA_SESSION_DECRYPT | \
-                    TPMA_SESSION_ENCRYPT;
+        tpm2_session_set_symmetric(ctx.session_data, &ctx.session.sym);
     }
 
-    ctx.attrs |= ctx.is_session_audit_required ?
-                 TPMA_SESSION_CONTINUESESSION|TPMA_SESSION_AUDIT : 0;
+    if (ctx.session.bind.bind_context_arg_str) {
+        tpm2_session_set_bind(ctx.session_data,
+        ctx.session.bind.bind_context_object.tr_handle);
+    }
 
-    if (ctx.is_session_audit_required || ctx.is_session_encryption_required) {
-        tpm2_session_set_attrs(ctx.session_data, ctx.attrs);
+    if (ctx.session.tpmkey.key_context_arg_str) {
+        tpm2_session_set_key(ctx.session_data,
+        ctx.session.tpmkey.key_context_object.tr_handle);
     }
 
+    tpm2_session_set_attrs(ctx.session_data, ctx.attrs);
+
     return tool_rc_success;
 }
 
 static tool_rc process_input_data(ESYS_CONTEXT *ectx) {
 
+    if (ctx.name_path) {
+        bool ret = files_load_bytes_from_path(ctx.name_path, ctx.name.name, &ctx.name.size);
+        if (!ret) {
+            LOG_ERR("Could load name from path: \"%s\"", ctx.name_path);
+            return tool_rc_general_error;
+        }
+    }
+
     /*
-     * attempt to set up the encryption parameters for this, we load an ESYS_TR from disk for
-     * transient objects and we load from tpm public for persistent objects. Deserialized ESYS TR
-     * objects are checked.
+     * Backwards compatibility behavior/ side-effect:
+     *
+     * The presence of a tpmkey and bind object should not result in setting up
+     * the session for parameter encryption. It is not a requirement. IOW one
+     * can have a salted and bounded session and not perform parameter
+     * encryption.
+     */
+
+    if (ctx.session.tpmkey.key_context_arg_str) {
+    /*
+     * attempt to set up the encryption parameters for this, we load an ESYS_TR
+     * from disk for transient objects and we load from tpm public for
+     * persistent objects. Deserialized ESYS TR objects are checked.
      */
-    if (ctx.session.key_context_arg_str) {
         tool_rc rc = tpm2_util_object_load(ectx,
-                ctx.session.key_context_arg_str,
-                &ctx.session.key_context_object, TPM2_HANDLE_ALL_W_NV);
+                ctx.session.tpmkey.key_context_arg_str,
+                &ctx.session.tpmkey.key_context_object, TPM2_HANDLE_ALL_W_NV);
         if (rc != tool_rc_success) {
             return rc;
         }
-        ctx.is_session_encryption_required = true;
 
-        /* if the loaded object has a handle then it must be a persistent object */
-        if (ctx.session.key_context_object.handle) {
+        /* if loaded object is non-permanant, it should ideally be persistent */
+        if (ctx.session.tpmkey.key_context_object.handle) {
 
-            bool is_transient = (ctx.session.key_context_object.handle
+            bool is_transient = (ctx.session.tpmkey.key_context_object.handle
                     >> TPM2_HR_SHIFT) == TPM2_HT_TRANSIENT;
-            if (!is_transient) {
-                LOG_WARN("check public key portion manually");
+            if (!is_transient && !ctx.name_path) {
+                LOG_WARN("check public portion of the tpmkey manually");
+            }
+
+            /*
+             * ESAPI performs this check when an ESYS_TR or Context file is used, so we
+             * could only run the check on the case where a raw TPM handle is provided,
+             * however, it seems prudent that if the user specifies a name, we always
+             * just check it.
+             */
+            if (ctx.name_path) {
+                TPM2B_NAME *got_name = NULL;
+                rc = tpm2_tr_get_name(ectx, ctx.session.tpmkey.key_context_object.tr_handle,
+                        &got_name);
+                if (rc != tool_rc_success) {
+                    return rc;
+                }
+
+                bool is_expected = cmp_tpm2b(name, &ctx.name, got_name);
+                Esys_Free(got_name);
+                if (!is_expected) {
+                    LOG_ERR("Expected name does not match");
+                    return tool_rc_general_error;
+                }
             }
         }
     }
 
+    /*
+     * We need to load the bind object and set its auth value in the bind
+     * objects ESYS_TR.
+     *
+     * A loaded object creates another session and that is not what we want.
+     */
+    if (ctx.session.bind.bind_context_arg_str) {
+        tool_rc rc = tpm2_util_object_load(ectx,
+                ctx.session.bind.bind_context_arg_str,
+                &ctx.session.bind.bind_context_object, TPM2_HANDLE_ALL_W_NV);
+        if (rc != tool_rc_success) {
+            return rc;
+         }
+    }
+
+    if (ctx.session.bind.bind_context_auth_str) {
+        TPM2B_AUTH authvalue = { 0 };
+        bool result = handle_str_password(
+            ctx.session.bind.bind_context_auth_str, &authvalue);
+        if (!result) {
+            return tool_rc_general_error;
+        }
+
+        tool_rc rc = tpm2_tr_set_auth(ectx,
+        ctx.session.bind.bind_context_object.tr_handle, &authvalue);
+        if (rc != tool_rc_success) {
+            LOG_ERR("Failed setting auth in the bind object ESYS_TR");
+            return rc;
+        }
+    }
+
     return setup_session_data();
 }
 
@@ -210,4 +382,5 @@
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("startauthsession", tpm2_tool_onstart, tpm2_tool_onrun, NULL, NULL)
+TPM2_TOOL_REGISTER("startauthsession", tpm2_tool_onstart, tpm2_tool_onrun, NULL,
+NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_tool.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_tool.c Changed

@@ -149,22 +149,45 @@
      */
     umask(0117);
 
-    if (!strcmp(argv0, "tpm2")) {
-        if (argc == 1 || (argc == 2 && (!strcmp(argv1,"--help") ||
-            !strcmp(argv1, "-h") || !strcmp(argv1, "--help=man")))) {
-            char *options2 = {"tpm2","--help=man"};
-            tpm2_handle_options(2, options, 0, 0, 0);
-            exit(tool_rc_success);
-        }
+    bool is_str_tpm2 = (strcmp(argv0, "tpm2") == 0);
+
+    bool is_one_opt_specified = (argc == 2 && is_str_tpm2);
+
+    bool is_opt_str_help = (is_one_opt_specified &&
+        ((strcmp(argv1,"--help") == 0) || (strcmp(argv1,"-h") == 0) ||
+         (strcmp(argv1,"--help=man") == 0)));
+
+    bool is_no_opts = (is_str_tpm2 && argc == 1);
 
-        if ((argc == 2 && (!strcmp(argv1,"--version") ||
-        !strcmp(argv1, "-v") ))) {
-            tpm2_handle_options(argc, argv, 0, 0, 0);
-            exit(tool_rc_success);
+    if (is_no_opts || is_opt_str_help) {
+        char *options2 = {"tpm2","--help=man"};
+        tpm2_handle_options(2, options, 0, 0, 0);
+        tool_rc rc = is_no_opts ? tool_rc_option_error : tool_rc_success;
+        exit(rc);
+    }
+
+    bool is_opt_str_help_no_man = (is_one_opt_specified &&
+        (strcmp(argv1,"--help=no-man") == 0));
+
+    if (is_opt_str_help_no_man) {
+        tpm2_tool_output("Specify  -v | --version , -h | --help or one of "
+            "the following tool names:\n");
+        for(unsigned i = 0 ; i < tool_count ; i++) {
+            fprintf(stderr, "%s\n", toolsi->name);
         }
 
+        exit(tool_rc_success);
+    }
+
+    bool is_opt_str_version = (is_one_opt_specified &&
+        ((strcmp(argv1,"--version") == 0) || (strcmp(argv1,"-v") == 0)));
+
+    if (is_opt_str_version) {
+        tpm2_handle_options(argc, argv, 0, 0, 0);
+        exit(tool_rc_success);
     }
 
+
     /* don't buffer stdin/stdout/stderr so pipes work */
     setvbuf (stdin, NULL, _IONBF, 0);
     setvbuf (stdout, NULL, _IONBF, 0);
@@ -231,14 +254,6 @@
     }
 
     /*
-     * Load the openssl error strings and algorithms
-     * so library routines work as expected.
-     */
-    OpenSSL_add_all_algorithms();
-    OpenSSL_add_all_ciphers();
-    ERR_load_crypto_strings();
-
-    /*
      * Call the specific tool, all tools implement this function instead of
      * 'main'.
      */

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_unseal.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_unseal.c Changed

@@ -8,75 +8,118 @@
 #include "tpm2_tool.h"
 
 typedef struct tpm_unseal_ctx tpm_unseal_ctx;
+#define MAX_SESSIONS 3
+#define MAX_AUX_SESSIONS 2
 struct tpm_unseal_ctx {
+    /*
+     * Inputs
+     */
     struct {
         const char *ctx_path;
         const char *auth_str;
         tpm2_loaded_object object;
     } sealkey;
 
+    /*
+     * Outputs
+     */
     char *output_file_path;
+    TPM2B_SENSITIVE_DATA *output_data;
+
+    /*
+     * Parameter hashes
+     */
+    const char *cp_hash_path;
+    TPM2B_DIGEST cp_hash;
+    const char *rp_hash_path;
+    TPM2B_DIGEST rp_hash;
+    bool is_command_dispatch;
+    TPMI_ALG_HASH parameter_hash_algorithm;
+
+    /*
+     * Aux sessions
+     */
+    uint8_t aux_session_cnt;
+    tpm2_session *aux_sessionMAX_AUX_SESSIONS;
+    const char *aux_session_pathMAX_AUX_SESSIONS;
+    ESYS_TR aux_session_handleMAX_AUX_SESSIONS;
+};
 
-    char *cp_hash_path;
+static tpm_unseal_ctx ctx = {
+    .aux_session_handle0 = ESYS_TR_NONE,
+    .aux_session_handle1 = ESYS_TR_NONE,
+    .parameter_hash_algorithm = TPM2_ALG_ERROR,
 };
 
-static tpm_unseal_ctx ctx;
+tool_rc unseal(ESYS_CONTEXT *ectx) {
+
+    /*
+     * 1. TPM2_CC_<command> OR Retrieve cpHash
+     */
+    return tpm2_unseal(ectx, &ctx.sealkey.object, &ctx.output_data,
+        &ctx.cp_hash, &ctx.rp_hash, ctx.parameter_hash_algorithm,
+        ctx.aux_session_handle0, ctx.aux_session_handle1);
+}
 
-tool_rc unseal_and_save(ESYS_CONTEXT *ectx) {
+static tool_rc process_output(ESYS_CONTEXT *ectx) {
 
-    TPM2B_SENSITIVE_DATA *output_data = NULL;
+    UNUSED(ectx);
 
+    /*
+     * 1. Outputs that do not require TPM2_CC_<command> dispatch
+     */
+    bool is_file_op_success = true;
     if (ctx.cp_hash_path) {
-        TPM2B_DIGEST cp_hash = { .size = 0 };
-        tool_rc rc = tpm2_unseal(ectx, &ctx.sealkey.object, &output_data,
-            &cp_hash);
-        if (rc != tool_rc_success) {
-            return rc;
-        }
+        is_file_op_success = files_save_digest(&ctx.cp_hash, ctx.cp_hash_path);
 
-        bool result = files_save_digest(&cp_hash, ctx.cp_hash_path);
-        if (!result) {
-            rc = tool_rc_general_error;
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
         }
-        return rc;
     }
 
-    tool_rc rc = tpm2_unseal(ectx, &ctx.sealkey.object, &output_data, NULL);
-    if (rc != tool_rc_success) {
-        return rc;
+    if (!ctx.is_command_dispatch) {
+        return tool_rc_success;
     }
 
+    /*
+     * 2. Outputs generated after TPM2_CC_<command> dispatch
+     */
     if (ctx.output_file_path) {
-        bool ret = files_save_bytes_to_file(ctx.output_file_path,
-                (UINT8 *) output_data->buffer, output_data->size);
-        if (!ret) {
-            rc = tool_rc_general_error;
-            goto out;
-        }
-    } else {
-        bool ret = files_write_bytes(stdout, (UINT8 *) output_data->buffer,
-                output_data->size);
-        if (!ret) {
-            rc = tool_rc_general_error;
-            goto out;
+        is_file_op_success = files_save_bytes_to_file(ctx.output_file_path,
+                ctx.output_data->buffer, ctx.output_data->size);
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
         }
     }
 
-    rc = tool_rc_success;
+    if (!ctx.output_file_path) {
+        is_file_op_success = files_write_bytes(stdout,
+            ctx.output_data->buffer, ctx.output_data->size);
+        if (!is_file_op_success) {
+            return tool_rc_general_error;
+        }
+    }
 
-out:
-    free(output_data);
+    if (ctx.rp_hash_path) {
+        is_file_op_success = files_save_digest(&ctx.rp_hash, ctx.rp_hash_path);
+    }
 
-    return rc;
+    return is_file_op_success ? tool_rc_success : tool_rc_general_error;
 }
 
-static tool_rc init(ESYS_CONTEXT *ectx) {
+static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
 
-    if (!ctx.sealkey.ctx_path) {
-        LOG_ERR("Expected option c");
-        return tool_rc_option_error;
-    }
+    /*
+     * 1. Object and auth initializations
+     */
 
+    /*
+     * 1.a Add the new-auth values to be set for the object.
+     */
+
+    /*
+     * 1.b Add object names and their auth sessions
+     */
     tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.sealkey.ctx_path,
             ctx.sealkey.auth_str, &ctx.sealkey.object, false,
             TPM2_HANDLES_FLAGS_TRANSIENT | TPM2_HANDLES_FLAGS_PERSISTENT);
@@ -85,6 +128,56 @@
         return rc;
     }
 
+    /*
+     * 2. Restore auxiliary sessions
+     */
+    rc = tpm2_util_aux_sessions_setup(ectx, ctx.aux_session_cnt,
+        ctx.aux_session_path, ctx.aux_session_handle, ctx.aux_session);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. Command specific initializations dependent on loaded objects
+     */
+
+    /*
+     * 4. Configuration for calculating the pHash
+     */
+
+    /* 4.a Determine pHash length and alg */
+    tpm2_session *all_sessionsMAX_SESSIONS = {
+        ctx.sealkey.object.session,
+        ctx.aux_session0,
+        ctx.aux_session1
+    };
+
+    const char **cphash_path = ctx.cp_hash_path ? &ctx.cp_hash_path : 0;
+    const char **rphash_path = ctx.rp_hash_path ? &ctx.rp_hash_path : 0;
+
+    ctx.parameter_hash_algorithm = tpm2_util_calculate_phash_algorithm(ectx,
+        cphash_path, &ctx.cp_hash, rphash_path, &ctx.rp_hash, all_sessions);
+
+    /*
+     * 4.b Determine if TPM2_CC_<command> is to be dispatched
+     * !rphash && !cphash Y
+     * !rphash && cphash  N
+     * rphash && !cphash  Y
+     * rphash && cphash   Y
+     */
+    ctx.is_command_dispatch = (ctx.cp_hash_path && !ctx.rp_hash_path) ?
+        false : true;
+
+    return rc;
+}
+
+static tool_rc check_options(void) {
+
+    if (!ctx.sealkey.ctx_path) {
+        LOG_ERR("Expected option c");
+        return tool_rc_option_error;
+    }
+
     return tool_rc_success;
 }
 
@@ -104,7 +197,17 @@
     case 0:
         ctx.cp_hash_path = value;
         break;
-        /* no default */
+    case 1:
+        ctx.rp_hash_path = value;
+        break;
+    case 'S':
+        ctx.aux_session_pathctx.aux_session_cnt = value;
+        if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
+            ctx.aux_session_cnt++;
+        } else {
+            return false;
+        }
+        break;
     }
 
     return true;
@@ -116,11 +219,13 @@
       { "auth",             required_argument, NULL, 'p' },
       { "output",           required_argument, NULL, 'o' },
       { "object-context",   required_argument, NULL, 'c' },
-      { "cphash",            required_argument, NULL, 0  },
+      { "cphash",           required_argument, NULL,  0  },
+      { "rphash",           required_argument, NULL,  1  },
+      { "session",          required_argument, NULL, 'S' },
     };
 
-    *opts = tpm2_options_new("p:o:c:", ARRAY_LEN(topts), topts, on_option, NULL,
-            0);
+    *opts = tpm2_options_new("S:p:o:c:", ARRAY_LEN(topts), topts, on_option,
+        NULL, 0);
 
     return *opts != NULL;
 }
@@ -129,18 +234,72 @@
 
     UNUSED(flags);
 
-    tool_rc rc = init(ectx);
+    /*
+     * 1. Process options
+     */
+    tool_rc rc = check_options();
     if (rc != tool_rc_success) {
         return rc;
     }
 
-    return unseal_and_save(ectx);
+    /*
+     * 2. Process inputs
+     */
+    rc = process_inputs(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 3. TPM2_CC_<command> call
+     */
+    rc = unseal(ectx);
+    if (rc != tool_rc_success) {
+        return rc;
+    }
+
+    /*
+     * 4. Process outputs
+     */
+    return process_output(ectx);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
+
     UNUSED(ectx);
-    return tpm2_session_close(&ctx.sealkey.object.session);
+    /*
+     * 1. Free objects
+     */
+    free(ctx.output_data);
+
+    /*
+     * 2. Close authorization sessions
+     */
+    tool_rc rc = tool_rc_success;
+    tool_rc tmp_rc = tool_rc_success;
+    if (!ctx.cp_hash_path) {
+        tmp_rc = tpm2_session_close(&ctx.sealkey.object.session);
+        if (tmp_rc != tool_rc_success) {
+            rc = tmp_rc;
+        }
+    }
+
+    /*
+     * 3. Close auxiliary sessions
+     */
+    uint8_t i = 0;
+    for(i = 0; i < ctx.aux_session_cnt; i++) {
+        if (ctx.aux_session_pathi) {
+            tmp_rc = tpm2_session_close(&ctx.aux_sessioni);
+        }
+        if (tmp_rc != tool_rc_success) {
+            rc = tmp_rc;
+        }
+    }
+
+    return rc;
 }
 
 // Register this tool with tpm2_tool.c
-TPM2_TOOL_REGISTER("unseal", tpm2_tool_onstart, tpm2_tool_onrun, tpm2_tool_onstop, NULL)
+TPM2_TOOL_REGISTER("unseal", tpm2_tool_onstart, tpm2_tool_onrun,
+    tpm2_tool_onstop, NULL)

_service:tar_scm:tpm2-tools-5.0.tar.gz/tools/tpm2_verifysignature.c -> _service:tar_scm:tpm2-tools-5.4.tar.gz/tools/tpm2_verifysignature.c Changed

@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: BSD-3-Clause */
 
 #include <stdlib.h>
+#include <string.h>
 
 #include "files.h"
 #include "log.h"
@@ -126,6 +127,7 @@
 
     if (ctx.flags.msg) {
         msg = message_from_file(ctx.msg_file_path);
+
         if (!msg) {
             /* message_from_file() logs specific error no need to here */
             return tool_rc_general_error;
@@ -155,8 +157,21 @@
                     "compute message hash!");
             goto err;
         }
-        tmp_rc = tpm2_hash_compute_data(context, ctx.halg, TPM2_RH_NULL,
-                msg->buffer, msg->size, &ctx.msg_hash, NULL);
+
+        if (ctx.signature.sigAlg == TPM2_ALG_SM2 && ctx.halg == TPM2_ALG_SM3_256) {
+            TPM2B_DIGEST z_digest;
+            tmp_rc = tpm2_alg_util_sm2_compute_id_digest(context, ctx.key_context_object.tr_handle,
+                    SM2_DEFAULT_ID, SM2_DEFAULT_ID_LENGTH, &z_digest);
+            if (tmp_rc != tool_rc_success) {
+                LOG_ERR("Verify could not compute id digest");
+            } else {
+                tmp_rc = tpm2_sm2_compute_msg_digest_data(context, ctx.halg, TPM2_RH_NULL,
+                        msg->buffer, msg->size, &z_digest, &ctx.msg_hash, NULL);
+            }
+        } else {
+            tmp_rc = tpm2_hash_compute_data(context, ctx.halg, TPM2_RH_NULL,
+                    msg->buffer, msg->size, &ctx.msg_hash, NULL);
+        }
         if (tmp_rc != tool_rc_success) {
             rc = tmp_rc;
             LOG_ERR("Compute message hash failed!");