From df6a67a62a094f4a07fa64b8477d4c485916000a Mon Sep 17 00:00:00 2001
From: Bill Roberts <bill.c.roberts@gmail.com>
Date: Thu, 7 Dec 2023 16:49:02 -0600
Subject: [PATCH] working load

Signed-off-by: Bill Roberts <bill.c.roberts@gmail.com>
---
 lib/tpm2_options.h                    | 10 ++++++----
 lib/tpm2_util.c                       | 14 ++++++++++++++
 lib/tpm2_util.h                       | 14 ++++++++++++++
 tools/misc/tpm2_certifyX509certutil.c |  2 +-
 tools/misc/tpm2_checkquote.c          |  2 +-
 tools/misc/tpm2_encodeobject.c        |  2 +-
 tools/misc/tpm2_eventlog.c            |  2 +-
 tools/misc/tpm2_print.c               |  2 +-
 tools/misc/tpm2_rc_decode.c           |  2 +-
 tools/misc/tpm2_tr_encode.c           |  2 +-
 tools/tpm2_certify.c                  |  2 +-
 tools/tpm2_certifycreation.c          |  2 +-
 tools/tpm2_changeauth.c               |  2 +-
 tools/tpm2_changeeps.c                |  2 +-
 tools/tpm2_changepps.c                |  2 +-
 tools/tpm2_clear.c                    |  2 +-
 tools/tpm2_clearcontrol.c             |  2 +-
 tools/tpm2_clockrateadjust.c          |  2 +-
 tools/tpm2_commit.c                   |  2 +-
 tools/tpm2_create.c                   |  2 +-
 tools/tpm2_createak.c                 |  2 +-
 tools/tpm2_createek.c                 |  2 +-
 tools/tpm2_createpolicy.c             |  2 +-
 tools/tpm2_createprimary.c            |  2 +-
 tools/tpm2_dictionarylockout.c        |  2 +-
 tools/tpm2_duplicate.c                |  2 +-
 tools/tpm2_ecdhkeygen.c               |  2 +-
 tools/tpm2_ecdhzgen.c                 |  2 +-
 tools/tpm2_ecephemeral.c              |  2 +-
 tools/tpm2_encryptdecrypt.c           |  2 +-
 tools/tpm2_evictcontrol.c             |  2 +-
 tools/tpm2_flushcontext.c             |  2 +-
 tools/tpm2_getcap.c                   |  2 +-
 tools/tpm2_getcommandauditdigest.c    |  2 +-
 tools/tpm2_geteccparameters.c         |  2 +-
 tools/tpm2_getekcertificate.c         |  2 +-
 tools/tpm2_getpolicydigest.c          |  2 +-
 tools/tpm2_getrandom.c                |  2 +-
 tools/tpm2_getsessionauditdigest.c    |  2 +-
 tools/tpm2_gettestresult.c            |  2 +-
 tools/tpm2_gettime.c                  |  2 +-
 tools/tpm2_hash.c                     |  2 +-
 tools/tpm2_hierarchycontrol.c         |  2 +-
 tools/tpm2_hmac.c                     |  2 +-
 tools/tpm2_import.c                   |  2 +-
 tools/tpm2_incrementalselftest.c      |  2 +-
 tools/tpm2_load.c                     | 13 ++++++++++---
 tools/tpm2_loadexternal.c             |  2 +-
 tools/tpm2_makecredential.c           |  2 +-
 tools/tpm2_nvcertify.c                |  2 +-
 tools/tpm2_nvdefine.c                 |  2 +-
 tools/tpm2_nvextend.c                 |  2 +-
 tools/tpm2_nvincrement.c              |  2 +-
 tools/tpm2_nvread.c                   |  2 +-
 tools/tpm2_nvreadlock.c               |  2 +-
 tools/tpm2_nvreadpublic.c             |  2 +-
 tools/tpm2_nvsetbits.c                |  2 +-
 tools/tpm2_nvundefine.c               |  2 +-
 tools/tpm2_nvwrite.c                  |  2 +-
 tools/tpm2_nvwritelock.c              |  2 +-
 tools/tpm2_pcrallocate.c              |  2 +-
 tools/tpm2_pcrevent.c                 |  2 +-
 tools/tpm2_pcrextend.c                |  2 +-
 tools/tpm2_pcrread.c                  |  2 +-
 tools/tpm2_pcrreset.c                 |  2 +-
 tools/tpm2_policyauthorize.c          |  2 +-
 tools/tpm2_policyauthorizenv.c        |  2 +-
 tools/tpm2_policyauthvalue.c          |  2 +-
 tools/tpm2_policycommandcode.c        |  2 +-
 tools/tpm2_policycountertimer.c       |  2 +-
 tools/tpm2_policycphash.c             |  2 +-
 tools/tpm2_policyduplicationselect.c  |  2 +-
 tools/tpm2_policylocality.c           |  2 +-
 tools/tpm2_policynamehash.c           |  2 +-
 tools/tpm2_policynv.c                 |  2 +-
 tools/tpm2_policynvwritten.c          |  2 +-
 tools/tpm2_policyor.c                 |  2 +-
 tools/tpm2_policypassword.c           |  2 +-
 tools/tpm2_policypcr.c                |  2 +-
 tools/tpm2_policyrestart.c            |  2 +-
 tools/tpm2_policysecret.c             |  2 +-
 tools/tpm2_policysigned.c             |  2 +-
 tools/tpm2_policytemplate.c           |  2 +-
 tools/tpm2_policyticket.c             |  2 +-
 tools/tpm2_quote.c                    |  2 +-
 tools/tpm2_readclock.c                |  2 +-
 tools/tpm2_readpublic.c               |  2 +-
 tools/tpm2_rsadecrypt.c               |  2 +-
 tools/tpm2_rsaencrypt.c               |  2 +-
 tools/tpm2_selftest.c                 |  2 +-
 tools/tpm2_send.c                     |  2 +-
 tools/tpm2_sessionconfig.c            |  3 ++-
 tools/tpm2_setclock.c                 |  2 +-
 tools/tpm2_setcommandauditstatus.c    |  2 +-
 tools/tpm2_setprimarypolicy.c         |  2 +-
 tools/tpm2_shutdown.c                 |  2 +-
 tools/tpm2_sign.c                     |  2 +-
 tools/tpm2_startauthsession.c         |  2 +-
 tools/tpm2_startup.c                  |  4 +++-
 tools/tpm2_stirrandom.c               |  2 +-
 tools/tpm2_testparms.c                |  2 +-
 tools/tpm2_tool.c                     | 12 ++++++------
 tools/tpm2_unseal.c                   |  2 +-
 tools/tpm2_verifysignature.c          |  2 +-
 tools/tpm2_zgen2phase.c               |  2 +-
 105 files changed, 153 insertions(+), 113 deletions(-)

diff --git a/lib/tpm2_options.h b/lib/tpm2_options.h
index c553a89df..12ccd855a 100644
--- a/lib/tpm2_options.h
+++ b/lib/tpm2_options.h
@@ -22,7 +22,7 @@ union tpm2_option_flags {
         uint8_t quiet :1;
         uint8_t enable_errata :1;
         uint8_t tcti_none :1;
-        uint8_t no_output :1;
+        //uint8_t no_output :1;
     };
     uint8_t all;
 };
@@ -66,9 +66,11 @@ typedef bool (*tpm2_arg_handler)(int argc, char **argv);
  * TPM2_OPTIONS_NO_SAPI:
  *  Skip SAPI initialization. Removes the "-T" common option.
  */
-#define TPM2_OPTIONS_NO_SAPI 0x1
-#define TPM2_OPTIONS_OPTIONAL_SAPI 0x2
-#define TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI 0x4
+#define TPM2_OPTIONS_NO_SAPI       (1 << 0)
+#define TPM2_OPTIONS_OPTIONAL_SAPI (1 << 1)
+#define TPM2_OPTIONS_NO_OUTPUT     (1 << 2)
+
+#define TPM2_OPTIONS_OPTIONAL_SAPI_AND_FAKE_TCTI (TPM2_OPTIONS_NO_SAPI | TPM2_OPTIONS_OPTIONAL_SAPI)
 
 struct tpm2_options {
     struct {
diff --git a/lib/tpm2_util.c b/lib/tpm2_util.c
index 5026848f6..f2ff818e7 100644
--- a/lib/tpm2_util.c
+++ b/lib/tpm2_util.c
@@ -239,6 +239,20 @@ void tpm2_util_hexdump2(FILE *f, const BYTE *data, size_t len) {
     }
 }
 
+char *tpm2_util_bin2hex(const BYTE *data, size_t len) {
+
+    char *c = calloc(1, len * 2 + 1);
+    if (!c) {
+        return NULL;
+    }
+    size_t i, j;
+    for (i = 0, j = 0; i < len && j < len * 2 + 1; i++, j+=2) {
+        sprintf(&c[j], "%02x", data[i]);
+    }
+
+    return c;
+}
+
 void tpm2_util_hexdump(const BYTE *data, size_t len) {
 
     if (!output_enabled) {
diff --git a/lib/tpm2_util.h b/lib/tpm2_util.h
index fc3f114a2..56dbd12c0 100644
--- a/lib/tpm2_util.h
+++ b/lib/tpm2_util.h
@@ -205,6 +205,20 @@ void tpm2_util_hexdump(const BYTE *data, size_t len);
  */
 void tpm2_util_hexdump2(FILE *f, const BYTE *data, size_t len);
 
+/**
+ * Converts a binary string of bytes into a hex string.
+ *
+ * @param data
+ *  The data to convert to hex
+ *
+ * @param len
+ *   The length of the data in bytes.
+ *
+ * @returns
+ *   A null terminated hex string on sucess or NULL on error (oom).
+ */
+char *tpm2_util_bin2hex(const BYTE *data, size_t len);
+
 /**
  * Read a hex string converting it to binary or a binary file and
  * store into a binary buffer.
diff --git a/tools/misc/tpm2_certifyX509certutil.c b/tools/misc/tpm2_certifyX509certutil.c
index 5eea08e81..8642cef0c 100644
--- a/tools/misc/tpm2_certifyX509certutil.c
+++ b/tools/misc/tpm2_certifyX509certutil.c
@@ -266,7 +266,7 @@ static tool_rc generate_partial_X509() {
 }
 
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
     UNUSED(ectx);
diff --git a/tools/misc/tpm2_checkquote.c b/tools/misc/tpm2_checkquote.c
index 58d7f3a62..4b3a62386 100644
--- a/tools/misc/tpm2_checkquote.c
+++ b/tools/misc/tpm2_checkquote.c
@@ -637,7 +637,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(ectx);
     UNUSED(flags);
diff --git a/tools/misc/tpm2_encodeobject.c b/tools/misc/tpm2_encodeobject.c
index 4fe06ce7c..94efdef25 100644
--- a/tools/misc/tpm2_encodeobject.c
+++ b/tools/misc/tpm2_encodeobject.c
@@ -197,7 +197,7 @@ static int encode(void) {
     return rc;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
     UNUSED(flags);
 
     tool_rc rc = check_opts();
diff --git a/tools/misc/tpm2_eventlog.c b/tools/misc/tpm2_eventlog.c
index 9cf57fdea..8efa609fd 100644
--- a/tools/misc/tpm2_eventlog.c
+++ b/tools/misc/tpm2_eventlog.c
@@ -64,7 +64,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
     UNUSED(ectx);
diff --git a/tools/misc/tpm2_print.c b/tools/misc/tpm2_print.c
index d7c41c29f..a1c9b836a 100644
--- a/tools/misc/tpm2_print.c
+++ b/tools/misc/tpm2_print.c
@@ -547,7 +547,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
     UNUSED(ectx);
     UNUSED(flags);
 
diff --git a/tools/misc/tpm2_rc_decode.c b/tools/misc/tpm2_rc_decode.c
index 439bf6e1c..384ad90f3 100644
--- a/tools/misc/tpm2_rc_decode.c
+++ b/tools/misc/tpm2_rc_decode.c
@@ -49,7 +49,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
     UNUSED(ectx);
diff --git a/tools/misc/tpm2_tr_encode.c b/tools/misc/tpm2_tr_encode.c
index 6df30f5ab..edfe15eb3 100644
--- a/tools/misc/tpm2_tr_encode.c
+++ b/tools/misc/tpm2_tr_encode.c
@@ -157,7 +157,7 @@ static bool check_options(void) {
     return result;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
     UNUSED(ectx);
diff --git a/tools/tpm2_certify.c b/tools/tpm2_certify.c
index ca1e468ad..0e0ec48b6 100644
--- a/tools/tpm2_certify.c
+++ b/tools/tpm2_certify.c
@@ -318,7 +318,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_certifycreation.c b/tools/tpm2_certifycreation.c
index c301aad57..bc38d8422 100644
--- a/tools/tpm2_certifycreation.c
+++ b/tools/tpm2_certifycreation.c
@@ -398,7 +398,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_changeauth.c b/tools/tpm2_changeauth.c
index 4b65ea9e8..295c1b32c 100644
--- a/tools/tpm2_changeauth.c
+++ b/tools/tpm2_changeauth.c
@@ -340,7 +340,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_changeeps.c b/tools/tpm2_changeeps.c
index c3d6f6dfc..8169d2597 100644
--- a/tools/tpm2_changeeps.c
+++ b/tools/tpm2_changeeps.c
@@ -191,7 +191,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_changepps.c b/tools/tpm2_changepps.c
index 343dfc9b0..0acad61ea 100644
--- a/tools/tpm2_changepps.c
+++ b/tools/tpm2_changepps.c
@@ -191,7 +191,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_clear.c b/tools/tpm2_clear.c
index 379d2e49f..95c1ab30f 100644
--- a/tools/tpm2_clear.c
+++ b/tools/tpm2_clear.c
@@ -184,7 +184,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_clearcontrol.c b/tools/tpm2_clearcontrol.c
index 5a78ba412..2a5a254a8 100644
--- a/tools/tpm2_clearcontrol.c
+++ b/tools/tpm2_clearcontrol.c
@@ -218,7 +218,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_clockrateadjust.c b/tools/tpm2_clockrateadjust.c
index 6cddbb702..03b67eb2f 100644
--- a/tools/tpm2_clockrateadjust.c
+++ b/tools/tpm2_clockrateadjust.c
@@ -210,7 +210,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_commit.c b/tools/tpm2_commit.c
index 0a1bfc03a..fba4193a4 100644
--- a/tools/tpm2_commit.c
+++ b/tools/tpm2_commit.c
@@ -257,7 +257,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_create.c b/tools/tpm2_create.c
index 228148ae3..1de865074 100644
--- a/tools/tpm2_create.c
+++ b/tools/tpm2_create.c
@@ -598,7 +598,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_createak.c b/tools/tpm2_createak.c
index 7c779298b..aea22b329 100644
--- a/tools/tpm2_createak.c
+++ b/tools/tpm2_createak.c
@@ -487,7 +487,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_createek.c b/tools/tpm2_createek.c
index 52009bc74..82032efcb 100644
--- a/tools/tpm2_createek.c
+++ b/tools/tpm2_createek.c
@@ -415,7 +415,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_createpolicy.c b/tools/tpm2_createpolicy.c
index 25227d8a5..d04f30bdb 100644
--- a/tools/tpm2_createpolicy.c
+++ b/tools/tpm2_createpolicy.c
@@ -152,7 +152,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_createprimary.c b/tools/tpm2_createprimary.c
index f91e76085..6cde22197 100644
--- a/tools/tpm2_createprimary.c
+++ b/tools/tpm2_createprimary.c
@@ -386,7 +386,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_dictionarylockout.c b/tools/tpm2_dictionarylockout.c
index 35ad010bb..ebcbeb14c 100644
--- a/tools/tpm2_dictionarylockout.c
+++ b/tools/tpm2_dictionarylockout.c
@@ -295,7 +295,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_duplicate.c b/tools/tpm2_duplicate.c
index 1f2fbf75d..f6e65fcd0 100644
--- a/tools/tpm2_duplicate.c
+++ b/tools/tpm2_duplicate.c
@@ -579,7 +579,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_ecdhkeygen.c b/tools/tpm2_ecdhkeygen.c
index 627b4813e..6886b2772 100644
--- a/tools/tpm2_ecdhkeygen.c
+++ b/tools/tpm2_ecdhkeygen.c
@@ -195,7 +195,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_ecdhzgen.c b/tools/tpm2_ecdhzgen.c
index 1d3a96902..99f9d215c 100644
--- a/tools/tpm2_ecdhzgen.c
+++ b/tools/tpm2_ecdhzgen.c
@@ -226,7 +226,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_ecephemeral.c b/tools/tpm2_ecephemeral.c
index 8783db7fe..8a2449ad3 100644
--- a/tools/tpm2_ecephemeral.c
+++ b/tools/tpm2_ecephemeral.c
@@ -216,7 +216,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_encryptdecrypt.c b/tools/tpm2_encryptdecrypt.c
index e9087dc8c..c5d232833 100644
--- a/tools/tpm2_encryptdecrypt.c
+++ b/tools/tpm2_encryptdecrypt.c
@@ -515,7 +515,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_evictcontrol.c b/tools/tpm2_evictcontrol.c
index 898b4ca7f..1b4e7603c 100644
--- a/tools/tpm2_evictcontrol.c
+++ b/tools/tpm2_evictcontrol.c
@@ -279,7 +279,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_flushcontext.c b/tools/tpm2_flushcontext.c
index 53b38e783..024bd5584 100644
--- a/tools/tpm2_flushcontext.c
+++ b/tools/tpm2_flushcontext.c
@@ -319,7 +319,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_getcap.c b/tools/tpm2_getcap.c
index dacc31439..8303ea84a 100644
--- a/tools/tpm2_getcap.c
+++ b/tools/tpm2_getcap.c
@@ -867,7 +867,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_getcommandauditdigest.c b/tools/tpm2_getcommandauditdigest.c
index 31d2f839f..c477d3085 100644
--- a/tools/tpm2_getcommandauditdigest.c
+++ b/tools/tpm2_getcommandauditdigest.c
@@ -203,7 +203,7 @@ static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
     return tool_rc_success;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_geteccparameters.c b/tools/tpm2_geteccparameters.c
index 46f42016e..b7133d797 100644
--- a/tools/tpm2_geteccparameters.c
+++ b/tools/tpm2_geteccparameters.c
@@ -198,7 +198,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_getekcertificate.c b/tools/tpm2_getekcertificate.c
index 082164a2f..bef621c29 100644
--- a/tools/tpm2_getekcertificate.c
+++ b/tools/tpm2_getekcertificate.c
@@ -1020,7 +1020,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(ectx);
 
diff --git a/tools/tpm2_getpolicydigest.c b/tools/tpm2_getpolicydigest.c
index ddb4cd0f9..929c26c8b 100644
--- a/tools/tpm2_getpolicydigest.c
+++ b/tools/tpm2_getpolicydigest.c
@@ -229,7 +229,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_getrandom.c b/tools/tpm2_getrandom.c
index edfc0068e..b791c9d40 100644
--- a/tools/tpm2_getrandom.c
+++ b/tools/tpm2_getrandom.c
@@ -336,7 +336,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_getsessionauditdigest.c b/tools/tpm2_getsessionauditdigest.c
index 7c3b472c8..bf15dea0e 100644
--- a/tools/tpm2_getsessionauditdigest.c
+++ b/tools/tpm2_getsessionauditdigest.c
@@ -225,7 +225,7 @@ static tool_rc process_outputs(ESYS_CONTEXT *ectx) {
     return tool_rc_success;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_gettestresult.c b/tools/tpm2_gettestresult.c
index 24a5caf6d..acc719f11 100644
--- a/tools/tpm2_gettestresult.c
+++ b/tools/tpm2_gettestresult.c
@@ -13,7 +13,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
     UNUSED(flags);
 
     tool_rc rc = tool_rc_general_error;
diff --git a/tools/tpm2_gettime.c b/tools/tpm2_gettime.c
index 023bad5c1..2f92235d9 100644
--- a/tools/tpm2_gettime.c
+++ b/tools/tpm2_gettime.c
@@ -294,7 +294,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_hash.c b/tools/tpm2_hash.c
index 567ec6351..904645e70 100644
--- a/tools/tpm2_hash.c
+++ b/tools/tpm2_hash.c
@@ -152,7 +152,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_hierarchycontrol.c b/tools/tpm2_hierarchycontrol.c
index e0294d6cc..be8a54885 100644
--- a/tools/tpm2_hierarchycontrol.c
+++ b/tools/tpm2_hierarchycontrol.c
@@ -298,7 +298,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_hmac.c b/tools/tpm2_hmac.c
index c5af8ae34..9463e0737 100644
--- a/tools/tpm2_hmac.c
+++ b/tools/tpm2_hmac.c
@@ -383,7 +383,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_import.c b/tools/tpm2_import.c
index f7573e11d..1e7c5786f 100644
--- a/tools/tpm2_import.c
+++ b/tools/tpm2_import.c
@@ -660,7 +660,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_incrementalselftest.c b/tools/tpm2_incrementalselftest.c
index 476e735ba..03705184c 100644
--- a/tools/tpm2_incrementalselftest.c
+++ b/tools/tpm2_incrementalselftest.c
@@ -77,7 +77,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_load.c b/tools/tpm2_load.c
index 8b751f895..ea8266fe3 100644
--- a/tools/tpm2_load.c
+++ b/tools/tpm2_load.c
@@ -66,7 +66,7 @@ static tool_rc load(ESYS_CONTEXT *ectx) {
         &ctx.object.handle, &ctx.cp_hash, ctx.parameter_hash_algorithm);
 }
 
-static tool_rc process_output(ESYS_CONTEXT *ectx) {
+static tool_rc process_output(ESYS_CONTEXT *ectx, yaml_document_t *doc) {
 
     UNUSED(ectx);
     /*
@@ -103,6 +103,13 @@ static tool_rc process_output(ESYS_CONTEXT *ectx) {
             return tool_rc_general_error;
         }
     } else {
+        int root = yaml_document_add_mapping(doc, NULL, YAML_ANY_MAPPING_STYLE);
+        char *h = tpm2_util_bin2hex(name->name, name->size);
+        int key = yaml_document_add_scalar(doc, (yaml_char_t *)YAML_STR_TAG, "name", -1, YAML_ANY_SCALAR_STYLE);
+        int value = yaml_document_add_scalar(doc, (yaml_char_t *)YAML_STR_TAG, h, -1, YAML_ANY_SCALAR_STYLE);
+
+        yaml_document_append_mapping_pair(doc, root, key, value);
+
         tpm2_tool_output("name: ");
         tpm2_util_print_tpm2b(name);
         tpm2_tool_output("\n");
@@ -304,7 +311,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
@@ -335,7 +342,7 @@ static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
     /*
      * 4. Process outputs
      */
-    return process_output(ectx);
+    return process_output(ectx, doc);
 }
 
 static tool_rc tpm2_tool_onstop(ESYS_CONTEXT *ectx) {
diff --git a/tools/tpm2_loadexternal.c b/tools/tpm2_loadexternal.c
index 2371470dd..adb601fc8 100644
--- a/tools/tpm2_loadexternal.c
+++ b/tools/tpm2_loadexternal.c
@@ -434,7 +434,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_makecredential.c b/tools/tpm2_makecredential.c
index ae2af9917..cf440a136 100644
--- a/tools/tpm2_makecredential.c
+++ b/tools/tpm2_makecredential.c
@@ -378,7 +378,7 @@ static tool_rc process_input(tpm2_option_flags flags) {
     return tool_rc_success;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_nvcertify.c b/tools/tpm2_nvcertify.c
index 6b2cc3df3..96923d8b5 100644
--- a/tools/tpm2_nvcertify.c
+++ b/tools/tpm2_nvcertify.c
@@ -540,7 +540,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     /* opts is unused, avoid compiler warning */
     UNUSED(flags);
diff --git a/tools/tpm2_nvdefine.c b/tools/tpm2_nvdefine.c
index 345e389db..85be70c57 100644
--- a/tools/tpm2_nvdefine.c
+++ b/tools/tpm2_nvdefine.c
@@ -499,7 +499,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_nvextend.c b/tools/tpm2_nvextend.c
index fcba07d6b..a8e940612 100644
--- a/tools/tpm2_nvextend.c
+++ b/tools/tpm2_nvextend.c
@@ -287,7 +287,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_nvincrement.c b/tools/tpm2_nvincrement.c
index ec4066b9f..70e6d6cc7 100644
--- a/tools/tpm2_nvincrement.c
+++ b/tools/tpm2_nvincrement.c
@@ -297,7 +297,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     /*
      * 1. Process options
diff --git a/tools/tpm2_nvread.c b/tools/tpm2_nvread.c
index d330c4412..42ab0b224 100644
--- a/tools/tpm2_nvread.c
+++ b/tools/tpm2_nvread.c
@@ -371,7 +371,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     /*
      * 1. Process options
diff --git a/tools/tpm2_nvreadlock.c b/tools/tpm2_nvreadlock.c
index 5b2234ad3..f68b43c97 100644
--- a/tools/tpm2_nvreadlock.c
+++ b/tools/tpm2_nvreadlock.c
@@ -283,7 +283,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_nvreadpublic.c b/tools/tpm2_nvreadpublic.c
index 42db19007..fb09f260d 100644
--- a/tools/tpm2_nvreadpublic.c
+++ b/tools/tpm2_nvreadpublic.c
@@ -386,7 +386,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     /* opts is unused, avoid compiler warning */
     UNUSED(flags);
diff --git a/tools/tpm2_nvsetbits.c b/tools/tpm2_nvsetbits.c
index 8665b1648..f0519e271 100644
--- a/tools/tpm2_nvsetbits.c
+++ b/tools/tpm2_nvsetbits.c
@@ -288,7 +288,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_nvundefine.c b/tools/tpm2_nvundefine.c
index 62086c681..aec4f8eab 100644
--- a/tools/tpm2_nvundefine.c
+++ b/tools/tpm2_nvundefine.c
@@ -418,7 +418,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_nvwrite.c b/tools/tpm2_nvwrite.c
index ec7f23870..713853270 100644
--- a/tools/tpm2_nvwrite.c
+++ b/tools/tpm2_nvwrite.c
@@ -437,7 +437,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     /*
      * 1. Process options
diff --git a/tools/tpm2_nvwritelock.c b/tools/tpm2_nvwritelock.c
index d0591b375..7592ec9a5 100644
--- a/tools/tpm2_nvwritelock.c
+++ b/tools/tpm2_nvwritelock.c
@@ -318,7 +318,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
 
     UNUSED(flags);
diff --git a/tools/tpm2_pcrallocate.c b/tools/tpm2_pcrallocate.c
index 798d43301..1bc0ac664 100644
--- a/tools/tpm2_pcrallocate.c
+++ b/tools/tpm2_pcrallocate.c
@@ -207,7 +207,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_pcrevent.c b/tools/tpm2_pcrevent.c
index c2651928e..f0d1e81af 100644
--- a/tools/tpm2_pcrevent.c
+++ b/tools/tpm2_pcrevent.c
@@ -380,7 +380,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_pcrextend.c b/tools/tpm2_pcrextend.c
index 27990b202..d57e0b0ef 100644
--- a/tools/tpm2_pcrextend.c
+++ b/tools/tpm2_pcrextend.c
@@ -123,7 +123,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_pcrread.c b/tools/tpm2_pcrread.c
index 069e4f412..5b01a5ce8 100644
--- a/tools/tpm2_pcrread.c
+++ b/tools/tpm2_pcrread.c
@@ -226,7 +226,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_pcrreset.c b/tools/tpm2_pcrreset.c
index 7bb9d6f11..b293cfaa7 100644
--- a/tools/tpm2_pcrreset.c
+++ b/tools/tpm2_pcrreset.c
@@ -181,7 +181,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policyauthorize.c b/tools/tpm2_policyauthorize.c
index e211bbb4b..e0be3bb07 100644
--- a/tools/tpm2_policyauthorize.c
+++ b/tools/tpm2_policyauthorize.c
@@ -195,7 +195,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policyauthorizenv.c b/tools/tpm2_policyauthorizenv.c
index 4f89e45eb..8410ac8c6 100644
--- a/tools/tpm2_policyauthorizenv.c
+++ b/tools/tpm2_policyauthorizenv.c
@@ -205,7 +205,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policyauthvalue.c b/tools/tpm2_policyauthvalue.c
index 72d1832b6..198352d03 100644
--- a/tools/tpm2_policyauthvalue.c
+++ b/tools/tpm2_policyauthvalue.c
@@ -168,7 +168,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policycommandcode.c b/tools/tpm2_policycommandcode.c
index 9fee2cdde..c123c5235 100644
--- a/tools/tpm2_policycommandcode.c
+++ b/tools/tpm2_policycommandcode.c
@@ -189,7 +189,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policycountertimer.c b/tools/tpm2_policycountertimer.c
index 210a30046..375c122ff 100644
--- a/tools/tpm2_policycountertimer.c
+++ b/tools/tpm2_policycountertimer.c
@@ -335,7 +335,7 @@ static tool_rc check_options(void) {
     return tool_rc_success;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policycphash.c b/tools/tpm2_policycphash.c
index 022edc644..dc1e2c914 100644
--- a/tools/tpm2_policycphash.c
+++ b/tools/tpm2_policycphash.c
@@ -79,7 +79,7 @@ static bool is_input_option_args_valid(void) {
     return true;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policyduplicationselect.c b/tools/tpm2_policyduplicationselect.c
index b06248688..d7cd75e98 100644
--- a/tools/tpm2_policyduplicationselect.c
+++ b/tools/tpm2_policyduplicationselect.c
@@ -74,7 +74,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policylocality.c b/tools/tpm2_policylocality.c
index cf4915731..cddeeea6d 100644
--- a/tools/tpm2_policylocality.c
+++ b/tools/tpm2_policylocality.c
@@ -196,7 +196,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policynamehash.c b/tools/tpm2_policynamehash.c
index 985d9ff79..6f50f0ff2 100644
--- a/tools/tpm2_policynamehash.c
+++ b/tools/tpm2_policynamehash.c
@@ -81,7 +81,7 @@ static bool is_input_option_args_valid(void) {
     return true;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policynv.c b/tools/tpm2_policynv.c
index 889a2b163..caeac0326 100644
--- a/tools/tpm2_policynv.c
+++ b/tools/tpm2_policynv.c
@@ -308,7 +308,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policynvwritten.c b/tools/tpm2_policynvwritten.c
index af985f737..e6aefa1c4 100644
--- a/tools/tpm2_policynvwritten.c
+++ b/tools/tpm2_policynvwritten.c
@@ -210,7 +210,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policyor.c b/tools/tpm2_policyor.c
index d27fff8b2..1cb635c43 100644
--- a/tools/tpm2_policyor.c
+++ b/tools/tpm2_policyor.c
@@ -91,7 +91,7 @@ static bool is_input_option_args_valid(void) {
     return true;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policypassword.c b/tools/tpm2_policypassword.c
index 43eeaaa7f..380684bde 100644
--- a/tools/tpm2_policypassword.c
+++ b/tools/tpm2_policypassword.c
@@ -168,7 +168,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policypcr.c b/tools/tpm2_policypcr.c
index afb508fdf..fff2649a9 100644
--- a/tools/tpm2_policypcr.c
+++ b/tools/tpm2_policypcr.c
@@ -86,7 +86,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policyrestart.c b/tools/tpm2_policyrestart.c
index 40a1d5286..0d7991f36 100644
--- a/tools/tpm2_policyrestart.c
+++ b/tools/tpm2_policyrestart.c
@@ -154,7 +154,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policysecret.c b/tools/tpm2_policysecret.c
index 8c1d65c27..92116881f 100644
--- a/tools/tpm2_policysecret.c
+++ b/tools/tpm2_policysecret.c
@@ -286,7 +286,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policysigned.c b/tools/tpm2_policysigned.c
index 27ba9b5e8..bc20b7692 100644
--- a/tools/tpm2_policysigned.c
+++ b/tools/tpm2_policysigned.c
@@ -167,7 +167,7 @@ static bool is_input_option_args_valid(void) {
     return true;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policytemplate.c b/tools/tpm2_policytemplate.c
index 0309578d2..d4e825699 100644
--- a/tools/tpm2_policytemplate.c
+++ b/tools/tpm2_policytemplate.c
@@ -81,7 +81,7 @@ static bool is_input_option_args_valid(void) {
     return true;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_policyticket.c b/tools/tpm2_policyticket.c
index e609dc600..6430e4b84 100644
--- a/tools/tpm2_policyticket.c
+++ b/tools/tpm2_policyticket.c
@@ -96,7 +96,7 @@ static bool is_input_option_args_valid(void) {
     return true;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_quote.c b/tools/tpm2_quote.c
index c0758ff77..f425d686a 100644
--- a/tools/tpm2_quote.c
+++ b/tools/tpm2_quote.c
@@ -390,7 +390,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_readclock.c b/tools/tpm2_readclock.c
index 43c663923..2cbb2b884 100644
--- a/tools/tpm2_readclock.c
+++ b/tools/tpm2_readclock.c
@@ -3,7 +3,7 @@
 #include "tpm2_tool.h"
 #include "tpm2_util.h"
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_readpublic.c b/tools/tpm2_readpublic.c
index 1464c3e37..c2a6ae937 100644
--- a/tools/tpm2_readpublic.c
+++ b/tools/tpm2_readpublic.c
@@ -163,7 +163,7 @@ static tool_rc init(ESYS_CONTEXT *context) {
     return tool_rc_success;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_rsadecrypt.c b/tools/tpm2_rsadecrypt.c
index 8e2eed6c3..d36e3bdd8 100644
--- a/tools/tpm2_rsadecrypt.c
+++ b/tools/tpm2_rsadecrypt.c
@@ -260,7 +260,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_rsaencrypt.c b/tools/tpm2_rsaencrypt.c
index 89292eb8c..d8336b4fd 100644
--- a/tools/tpm2_rsaencrypt.c
+++ b/tools/tpm2_rsaencrypt.c
@@ -152,7 +152,7 @@ static tool_rc init(ESYS_CONTEXT *context) {
     return rc;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_selftest.c b/tools/tpm2_selftest.c
index ca2fd7537..b97eee145 100644
--- a/tools/tpm2_selftest.c
+++ b/tools/tpm2_selftest.c
@@ -42,7 +42,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_send.c b/tools/tpm2_send.c
index 94936a0a8..ac91ba0a9 100644
--- a/tools/tpm2_send.c
+++ b/tools/tpm2_send.c
@@ -166,7 +166,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
  * in network byte order (big-endian). We output the response in the same
  * form.
  */
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_sessionconfig.c b/tools/tpm2_sessionconfig.c
index ae190ed11..75112dc47 100644
--- a/tools/tpm2_sessionconfig.c
+++ b/tools/tpm2_sessionconfig.c
@@ -207,7 +207,8 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
 }
 
 static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *esys_context,
-tpm2_option_flags flags) {
+        yaml_document_t *doc,
+        tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_setclock.c b/tools/tpm2_setclock.c
index d56a23307..95643c282 100644
--- a/tools/tpm2_setclock.c
+++ b/tools/tpm2_setclock.c
@@ -189,7 +189,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_setcommandauditstatus.c b/tools/tpm2_setcommandauditstatus.c
index 223df14d3..22a347834 100644
--- a/tools/tpm2_setcommandauditstatus.c
+++ b/tools/tpm2_setcommandauditstatus.c
@@ -93,7 +93,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_setprimarypolicy.c b/tools/tpm2_setprimarypolicy.c
index cdabcd9e3..9ec5dba2c 100644
--- a/tools/tpm2_setprimarypolicy.c
+++ b/tools/tpm2_setprimarypolicy.c
@@ -216,7 +216,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
 
     UNUSED(flags);
diff --git a/tools/tpm2_shutdown.c b/tools/tpm2_shutdown.c
index 01c98c027..b864a341e 100644
--- a/tools/tpm2_shutdown.c
+++ b/tools/tpm2_shutdown.c
@@ -43,7 +43,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_sign.c b/tools/tpm2_sign.c
index 77d7c2a8b..f0ffcf5b6 100644
--- a/tools/tpm2_sign.c
+++ b/tools/tpm2_sign.c
@@ -365,7 +365,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != 0;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_startauthsession.c b/tools/tpm2_startauthsession.c
index 10894559f..2646e804e 100644
--- a/tools/tpm2_startauthsession.c
+++ b/tools/tpm2_startauthsession.c
@@ -354,7 +354,7 @@ static tool_rc process_input_data(ESYS_CONTEXT *ectx) {
     return setup_session_data();
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_startup.c b/tools/tpm2_startup.c
index 7d532aa62..c5391730f 100644
--- a/tools/tpm2_startup.c
+++ b/tools/tpm2_startup.c
@@ -40,13 +40,15 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     };
 
     *opts = tpm2_options_new("c", ARRAY_LEN(topts), topts, on_option, NULL, 0);
+    (*opts)->flags = TPM2_OPTIONS_NO_OUTPUT;
 
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
+    UNUSED(doc);
 
     TPM2_SU startup_type = ctx.clear ? TPM2_SU_CLEAR : TPM2_SU_STATE;
 
diff --git a/tools/tpm2_stirrandom.c b/tools/tpm2_stirrandom.c
index b0cabb1d5..014588a51 100644
--- a/tools/tpm2_stirrandom.c
+++ b/tools/tpm2_stirrandom.c
@@ -57,7 +57,7 @@ static bool load_sensitive(void) {
     return true;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_testparms.c b/tools/tpm2_testparms.c
index e6250bf94..2c6ad074b 100644
--- a/tools/tpm2_testparms.c
+++ b/tools/tpm2_testparms.c
@@ -96,7 +96,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_tool.c b/tools/tpm2_tool.c
index 64d7a5954..195ba39bc 100644
--- a/tools/tpm2_tool.c
+++ b/tools/tpm2_tool.c
@@ -157,7 +157,7 @@ static tool_rc yaml_dump(yaml_document_t *doc) {
     }
 
     yaml_emitter_set_output_file(&emitter, stdout);
-    yaml_emitter_set_canonical(&emitter, 1);
+    //yaml_emitter_set_canonical(&emitter, 1);
 
     r = yaml_emitter_dump(&emitter, doc);
     if (!r) {
@@ -295,14 +295,15 @@ int main(int argc, char **argv) {
      * It seems like you would want to add quiet flag to this, but callers expect the yaml
      * doc to be non-null, just use quiet to not emit it at the end for simplicity.
      */
-    if (!flags.no_output) {
+    bool output = !((ctx.tool_opts->flags & TPM2_OPTIONS_NO_OUTPUT) || flags.quiet);
+    if (output) {
     	int rc = yaml_document_initialize(
     			&ctx.doc,
     			NULL, /* version */
 				NULL, /* start */
 				NULL, /* end */
-				0, /* implicit start */
-				0 /* implicit end */);
+				1, /* implicit start */
+				1 /* implicit end */);
     	if (!rc) {
     		LOG_ERR("Could not initialize YAML document");
     		exit(tool_rc_general_error);
@@ -331,8 +332,7 @@ int main(int argc, char **argv) {
         LOG_ERR("Unable to run %s", argv[0]);
     }
 
-    /* if the tool needs output OR we were told to be quiet don't dump YAML to stdout */
-    if (!(flags.no_output && flags.quiet)) {
+    if (output) {
     	ret = yaml_dump(&ctx.doc);
     }
 
diff --git a/tools/tpm2_unseal.c b/tools/tpm2_unseal.c
index 0029341cb..5bfdae009 100644
--- a/tools/tpm2_unseal.c
+++ b/tools/tpm2_unseal.c
@@ -230,7 +230,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_verifysignature.c b/tools/tpm2_verifysignature.c
index 240165d63..5191cc155 100644
--- a/tools/tpm2_verifysignature.c
+++ b/tools/tpm2_verifysignature.c
@@ -251,7 +251,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
     return *opts != NULL;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *context, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);
 
diff --git a/tools/tpm2_zgen2phase.c b/tools/tpm2_zgen2phase.c
index 44df59ff5..015fb17fd 100644
--- a/tools/tpm2_zgen2phase.c
+++ b/tools/tpm2_zgen2phase.c
@@ -172,7 +172,7 @@ static tool_rc process_outputs(void) {
     return tool_rc_success;
 }
 
-static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
+static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, yaml_document_t *doc, tpm2_option_flags flags) {
 
     UNUSED(flags);