From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id AEFF3C83F1B for ; Thu, 17 Jul 2025 06:55:34 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ucIWW-0006PG-I2; Thu, 17 Jul 2025 02:55:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ucIWT-0006KF-HS for grub-devel@gnu.org; Thu, 17 Jul 2025 02:55:17 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ucIWQ-0003d8-N9 for grub-devel@gnu.org; Thu, 17 Jul 2025 02:55:17 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 56GI2ueN000345; Thu, 17 Jul 2025 06:55:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to; s=pp1; bh=SragsGcKw7IreBPXu2m5HQsasKjMs8 9cMlptVJFWJg8=; b=VlYH8BbMUUIs+Nus+xUf3WAGrqGpfF9sHJQ+tHRosfei/V 8TQJ8TtOROlyInQLEGlGsBVdxOppm/0EoCL7/071gngO4xrb/ubnVnP8L8SCJtYU h9KmFFNd35PLR2LNruRMC1tHJGrZvJjrwhssNPtucWkIlf2pUThW+wfdhkBawPF8 qxMKDfYwpROr3z99PjXL74W3yPobNGTWSVnDOwgiJ8HeYJesfW1OuaG/Mwf3uPx8 kitfRrXhEgs6GsaOdbfvCDP62t2d7vXTZ0vN9FEkflTY9DRRP/RAhklZXk1nnpD2 GPbaVF5DM7hfUDTSDE7ri0HixiOMQibaV1UH49SQ== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 47ufc794a4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 17 Jul 2025 06:55:11 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 56H3KHLs031922; Thu, 17 Jul 2025 06:55:10 GMT Received: from smtprelay04.fra02v.mail.ibm.com ([9.218.2.228]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 47v21ub8jr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 17 Jul 2025 06:55:10 +0000 Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay04.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 56H6t9UW19595746 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 17 Jul 2025 06:55:09 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0712920049; Thu, 17 Jul 2025 06:55:09 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 582152004F; Thu, 17 Jul 2025 06:55:07 +0000 (GMT) Received: from smtpclient.apple (unknown [9.124.219.74]) by smtpav06.fra02v.mail.ibm.com (Postfix) with ESMTPS; Thu, 17 Jul 2025 06:55:07 +0000 (GMT) From: Sudhakar Kuppusamy Message-Id: <8DB4DF01-45C1-4647-A714-4C2CE4B56C22@linux.ibm.com> Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.600.51.1.1\)) Subject: Re: [PATCH v2 1/7] tss2: Add TPM2_PCR_Event command Date: Thu, 17 Jul 2025 12:24:55 +0530 In-Reply-To: <20250715053634.20799-2-glin@suse.com> Cc: The development of GNU GRUB , Daniel Kiper , mchang@suse.com, patrick.colp@oracle.com, Stefan Berger To: Gary Lin References: <20250715053634.20799-1-glin@suse.com> <20250715053634.20799-2-glin@suse.com> X-Mailer: Apple Mail (2.3826.600.51.1.1) X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=Je68rVKV c=1 sm=1 tr=0 ts=68789e4f cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=Wb1JkmetP80A:10 a=iox4zFpeAAAA:8 a=VnNF1IyMAAAA:8 a=in-480c0_NNRhsAiMysA:9 a=QEXdDO2ut3YA:10 a=t31v26w1iPsBoAEVoSgA:9 a=alsw8D9SO3EhbGlY:21 a=_W_S_7VecoQA:10 a=lqcHg5cX4UMA:10 a=WzC6qhA0u3u7Ye7llzcV:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNzE3MDA1NyBTYWx0ZWRfX3LjvA4omLOVi HO1x4fROaLeiavAlNogpTx5xB2Pt2HMTEVrZmAP0QPa2tsltqT5/FoMzNbu9OStTkdwH+HI0Gbp Nl92xxIIyJvfb+erh519Tm/BN45dikoegN60D4lrwRfysf7iWCQhXjeKRR1uMEvPcPUZERuSz+b 07iH18f9Am6BLQD0x7Fyf7iASDG0igs+tw/Y2zBTbNGGur1DoeKiKw1gJ56EcFX9mse4HDciXvy z+xil4HeCPsd+SsGnv1ILmGJrEHD/eiKnu96soOGigHsmKh6XUKoa3kRkZV2SxZmM6slZPhZdk+ IKo9zlxo/CrbBfYANMPD7D4aOvpJ18otx8zzpYxEKn9nhWhOqGaXtTCkkl2wLOTUsdA60tQVZey Qtqn8kPBvvmBmQNfH0AsiECdcO2UIZt4ZeZFuISzNDUF+s6raAEOYj73iZVoPf2EEgHPdTTm X-Proofpoint-GUID: ATaMr27L_ao9jSh7k0lGo1HSopvwO8z6 X-Proofpoint-ORIG-GUID: ATaMr27L_ao9jSh7k0lGo1HSopvwO8z6 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-07-17_01,2025-07-16_02,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 malwarescore=0 lowpriorityscore=0 suspectscore=0 adultscore=0 priorityscore=1501 clxscore=1015 bulkscore=0 phishscore=0 spamscore=0 mlxlogscore=999 mlxscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2505280000 definitions=main-2507170057 Received-SPF: pass client-ip=148.163.158.5; envelope-from=sudhakar@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: The development of GNU GRUB Content-Type: multipart/mixed; boundary="===============0993278984098369978==" Errors-To: grub-devel-bounces+grub-devel=archiver.kernel.org@gnu.org Sender: grub-devel-bounces+grub-devel=archiver.kernel.org@gnu.org --===============0993278984098369978== Content-Type: multipart/alternative; boundary="Apple-Mail=_1E7C5944-76B4-4748-A715-D34D84B339C4" --Apple-Mail=_1E7C5944-76B4-4748-A715-D34D84B339C4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 15 Jul 2025, at 11:06=E2=80=AFAM, Gary Lin wrote: >=20 > The TPM2_PCR_Event command is introduced to tss2 to allow the user to > extend a specific PCR. The related data structure and unmarshal = function > are also introduced. >=20 > However, simply invoking TPM2_PCR_Event does not automatically record > the event into the TPM event log. The TPM event log is primarily > maintained by the system firmware (e.g., BIOS/UEFI). Therefore, for = most > standard use cases, the recommended method for extending PCRs and > ensuring proper event logging is to utilize the system firmware > functions. >=20 > There are specific scenarios where direct use of TPM2_PCR_Event = becomes > necessary. For instance, in environments lacking system firmware = support > for PCR extension, such as the grub-emu, TPM2_PCR_Event serves as the > only available method to extend PCRs. >=20 > Signed-off-by: Gary Lin Reviewed-by: Sudhakar Kuppusamy > > --- > grub-core/lib/tss2/tpm2_cmd.c | 51 +++++++++++++++++++++++++++++++ > grub-core/lib/tss2/tpm2_cmd.h | 7 +++++ > grub-core/lib/tss2/tss2_mu.c | 18 +++++++++++ > grub-core/lib/tss2/tss2_mu.h | 4 +++ > grub-core/lib/tss2/tss2_structs.h | 7 +++++ > grub-core/lib/tss2/tss2_types.h | 1 + > 6 files changed, 88 insertions(+) >=20 > diff --git a/grub-core/lib/tss2/tpm2_cmd.c = b/grub-core/lib/tss2/tpm2_cmd.c > index 6d25db1ab..b682eb431 100644 > --- a/grub-core/lib/tss2/tpm2_cmd.c > +++ b/grub-core/lib/tss2/tpm2_cmd.c > @@ -575,6 +575,57 @@ grub_tpm2_flushcontext (const TPMI_DH_CONTEXT_t = handle) > return TPM_RC_SUCCESS; > } >=20 > +TPM_RC_t > +grub_tpm2_pcr_event (const TPMI_DH_PCR_t pcrHandle, > + const TPMS_AUTH_COMMAND_t *authCommand, > + const TPM2B_EVENT_t *eventData, > + TPML_DIGEST_VALUES_t *digests, > + TPMS_AUTH_RESPONSE_t *authResponse) > +{ > + TPM_RC_t rc; > + struct grub_tpm2_buffer in; > + struct grub_tpm2_buffer out; > + TPML_DIGEST_VALUES_t digestsTmp; > + TPMS_AUTH_RESPONSE_t authResponseTmp; > + TPM_RC_t responseCode; > + grub_uint32_t parameterSize; > + > + if (eventData =3D=3D NULL) > + return TPM_RC_VALUE; > + if (authCommand =3D=3D NULL) > + return TPM_RC_VALUE; > + > + if (digests =3D=3D NULL) > + digests =3D &digestsTmp; > + if (authResponse =3D=3D NULL) > + authResponse =3D &authResponseTmp; > + > + /* Marshal */ > + grub_tpm2_buffer_init (&in); > + grub_tpm2_buffer_pack_u32 (&in, pcrHandle); > + grub_Tss2_MU_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); > + grub_Tss2_MU_TPM2B_Marshal (&in, eventData->size, = eventData->buffer); > + if (in.error =3D=3D true) > + return TPM_RC_FAILURE; > + > + /* Submit */ > + grub_tpm2_buffer_init (&out); > + rc =3D tpm2_submit_command (TPM_ST_SESSIONS, TPM_CC_PCR_Event, = &responseCode, &in, &out); > + if (rc !=3D TPM_RC_SUCCESS) > + return rc; > + if (responseCode !=3D TPM_RC_SUCCESS) > + return responseCode; > + > + /* Unmarshal */ > + grub_tpm2_buffer_unpack_u32 (&out, ¶meterSize); > + grub_Tss2_MU_TPML_DIGEST_VALUE_Unmarshal (&out, digests); > + grub_Tss2_MU_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse); > + if (out.error =3D=3D true) > + return TPM_RC_FAILURE; > + > + return TPM_RC_SUCCESS; > +} > + > TPM_RC_t > grub_tpm2_pcr_read (const TPMS_AUTH_COMMAND_t *authCommand, > const TPML_PCR_SELECTION_t *pcrSelectionIn, > diff --git a/grub-core/lib/tss2/tpm2_cmd.h = b/grub-core/lib/tss2/tpm2_cmd.h > index 90b42efec..d7ad962ab 100644 > --- a/grub-core/lib/tss2/tpm2_cmd.h > +++ b/grub-core/lib/tss2/tpm2_cmd.h > @@ -89,6 +89,13 @@ grub_tpm2_unseal (const TPMI_DH_OBJECT_t = item_handle, > extern TPM_RC_t > grub_tpm2_flushcontext (const TPMI_DH_CONTEXT_t handle); >=20 > +extern TPM_RC_t > +grub_tpm2_pcr_event (const TPMI_DH_PCR_t pcrHandle, > + const TPMS_AUTH_COMMAND_t *authCommand, > + const TPM2B_EVENT_t *eventData, > + TPML_DIGEST_VALUES_t *digests, > + TPMS_AUTH_RESPONSE_t *authResponse); > + > extern TPM_RC_t > grub_tpm2_pcr_read (const TPMS_AUTH_COMMAND_t *authCommand, > const TPML_PCR_SELECTION_t *pcrSelectionIn, > diff --git a/grub-core/lib/tss2/tss2_mu.c = b/grub-core/lib/tss2/tss2_mu.c > index 816e5b37f..e544e62f9 100644 > --- a/grub-core/lib/tss2/tss2_mu.c > +++ b/grub-core/lib/tss2/tss2_mu.c > @@ -1118,6 +1118,24 @@ grub_Tss2_MU_TPML_DIGEST_Unmarshal = (grub_tpm2_buffer_t buffer, > grub_Tss2_MU_TPM2B_DIGEST_Unmarshal (buffer, &digest->digests[i]); > } >=20 > +void > +grub_Tss2_MU_TPML_DIGEST_VALUE_Unmarshal (grub_tpm2_buffer_t buffer, > + TPML_DIGEST_VALUES_t *digests) > +{ > + grub_uint32_t i; > + > + grub_tpm2_buffer_unpack_u32 (buffer, &digests->count); > + > + if (digests->count > TPM_NUM_PCR_BANKS) > + { > + buffer->error =3D true; > + return; > + } > + > + for (i =3D 0; i < digests->count; i++) > + grub_Tss2_MU_TPMT_HA_Unmarshal (buffer, &digests->digests[i]); > +} > + > void > grub_Tss2_MU_TPMS_SIGNATURE_RSA_Unmarshal (grub_tpm2_buffer_t buffer, > TPMS_SIGNATURE_RSA_t *rsa) > diff --git a/grub-core/lib/tss2/tss2_mu.h = b/grub-core/lib/tss2/tss2_mu.h > index 6440de57c..76eebc994 100644 > --- a/grub-core/lib/tss2/tss2_mu.h > +++ b/grub-core/lib/tss2/tss2_mu.h > @@ -380,6 +380,10 @@ extern void > grub_Tss2_MU_TPML_DIGEST_Unmarshal (grub_tpm2_buffer_t buffer, > TPML_DIGEST_t *digest); >=20 > +extern void > +grub_Tss2_MU_TPML_DIGEST_VALUE_Unmarshal (grub_tpm2_buffer_t buffer, > + TPML_DIGEST_VALUES_t = *digests); > + > extern void > grub_Tss2_MU_TPMS_SIGNATURE_RSA_Unmarshal (grub_tpm2_buffer_t buffer, > TPMS_SIGNATURE_RSA_t *p); > diff --git a/grub-core/lib/tss2/tss2_structs.h = b/grub-core/lib/tss2/tss2_structs.h > index 2eefba87c..0ac09f50f 100644 > --- a/grub-core/lib/tss2/tss2_structs.h > +++ b/grub-core/lib/tss2/tss2_structs.h > @@ -144,6 +144,13 @@ typedef struct TPML_DIGEST TPML_DIGEST_t; > /* TPM2B_NONCE Type */ > typedef TPM2B_DIGEST_t TPM2B_NONCE_t; >=20 > +/* TPM2B_EVENT Structure */ > +struct TPM2B_EVENT { > + grub_uint16_t size; > + grub_uint8_t buffer[1024]; > +}; > +typedef struct TPM2B_EVENT TPM2B_EVENT_t; > + > /* TPMA_SESSION Structure */ > struct TPMA_SESSION > { > diff --git a/grub-core/lib/tss2/tss2_types.h = b/grub-core/lib/tss2/tss2_types.h > index bddde7191..52d304b90 100644 > --- a/grub-core/lib/tss2/tss2_types.h > +++ b/grub-core/lib/tss2/tss2_types.h > @@ -343,6 +343,7 @@ typedef grub_uint32_t TPM_CC_t; > #define TPM_CC_NV_Write ((TPM_CC_t) 0x00000137) > #define TPM_CC_NV_UndefineSpace ((TPM_CC_t) 0x00000122) > #define TPM_CC_GetCapability ((TPM_CC_t) 0x0000017a) > +#define TPM_CC_PCR_Event ((TPM_CC_t) 0x0000013c) > #define TPM_CC_PCR_Read ((TPM_CC_t) 0x0000017e) > #define TPM_CC_Load ((TPM_CC_t) 0x00000157) > #define TPM_CC_LoadExternal ((TPM_CC_t) 0x00000167) > --=20 > 2.43.0 >=20 --Apple-Mail=_1E7C5944-76B4-4748-A715-D34D84B339C4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On 15 Jul 2025, at 11:06=E2=80=AFAM, Gary Lin = <glin@suse.com> wrote:

The TPM2_PCR_Event command = is introduced to tss2 to allow the user to
extend a specific PCR. The = related data structure and unmarshal function
are also = introduced.

However, simply invoking TPM2_PCR_Event does not = automatically record
the event into the TPM event log. The TPM event = log is primarily
maintained by the system firmware (e.g., BIOS/UEFI). = Therefore, for most
standard use cases, the recommended method for = extending PCRs and
ensuring proper event logging is to utilize the = system firmware
functions.

There are specific scenarios where = direct use of TPM2_PCR_Event becomes
necessary. For instance, in = environments lacking system firmware support
for PCR extension, such = as the grub-emu, TPM2_PCR_Event serves as the
only available method = to extend PCRs.

Signed-off-by: Gary Lin = <glin@suse.com>

Reviewed-by: Sudhakar Kuppusamy = <sudhakar@linux.ibm.com>

---
grub-core/lib/tss2/tpm2_cmd.c =     | 51 +++++++++++++++++++++++++++++++
= grub-core/lib/tss2/tpm2_cmd.h     |  7 = +++++
grub-core/lib/tss2/tss2_mu.c      | = 18 +++++++++++
grub-core/lib/tss2/tss2_mu.h =      |  4 +++
= grub-core/lib/tss2/tss2_structs.h |  7 +++++
= grub-core/lib/tss2/tss2_types.h   |  1 +
6 files = changed, 88 insertions(+)

diff --git = a/grub-core/lib/tss2/tpm2_cmd.c b/grub-core/lib/tss2/tpm2_cmd.c
index = 6d25db1ab..b682eb431 100644
--- = a/grub-core/lib/tss2/tpm2_cmd.c
+++ = b/grub-core/lib/tss2/tpm2_cmd.c
@@ -575,6 +575,57 @@ = grub_tpm2_flushcontext (const TPMI_DH_CONTEXT_t handle)
=   return TPM_RC_SUCCESS;
= }

+TPM_RC_t
+grub_tpm2_pcr_event (const TPMI_DH_PCR_t = pcrHandle,
+ = =     const TPMS_AUTH_COMMAND_t = *authCommand,
+     const = TPM2B_EVENT_t *eventData,
+ =     TPML_DIGEST_VALUES_t *digests,
+ =     TPMS_AUTH_RESPONSE_t *authResponse)
+{
+ =  TPM_RC_t rc;
+  struct grub_tpm2_buffer in;
+ =  struct grub_tpm2_buffer out;
+  TPML_DIGEST_VALUES_t = digestsTmp;
+  TPMS_AUTH_RESPONSE_t authResponseTmp;
+ =  TPM_RC_t responseCode;
+  grub_uint32_t = parameterSize;
+
+  if (eventData =3D=3D NULL)
+ =    return TPM_RC_VALUE;
+  if (authCommand =3D=3D = NULL)
+    return TPM_RC_VALUE;
+
+  if = (digests =3D=3D NULL)
+    digests =3D = &digestsTmp;
+  if (authResponse =3D=3D NULL)
+ =    authResponse =3D &authResponseTmp;
+
+ =  /* Marshal */
+  grub_tpm2_buffer_init (&in);
+ =  grub_tpm2_buffer_pack_u32 (&in, pcrHandle);
+ =  grub_Tss2_MU_TPMS_AUTH_COMMAND_Marshal (&in, = authCommand);
+  grub_Tss2_MU_TPM2B_Marshal (&in, = eventData->size, eventData->buffer);
+  if (in.error =3D=3D = true)
+    return TPM_RC_FAILURE;
+
+  /* = Submit */
+  grub_tpm2_buffer_init (&out);
+  rc =3D = tpm2_submit_command (TPM_ST_SESSIONS, TPM_CC_PCR_Event, = &responseCode, &in, &out);
+  if (rc !=3D = TPM_RC_SUCCESS)
+    return rc;
+  if = (responseCode !=3D TPM_RC_SUCCESS)
+    return = responseCode;
+
+  /* Unmarshal */
+ =  grub_tpm2_buffer_unpack_u32 (&out, &parameterSize);
+ =  grub_Tss2_MU_TPML_DIGEST_VALUE_Unmarshal (&out, digests);
+ =  grub_Tss2_MU_TPMS_AUTH_RESPONSE_Unmarshal (&out, = authResponse);
+  if (out.error =3D=3D true)
+ =    return TPM_RC_FAILURE;
+
+  return = TPM_RC_SUCCESS;
+}
+
TPM_RC_t
grub_tpm2_pcr_read (const = TPMS_AUTH_COMMAND_t *authCommand,
   const = TPML_PCR_SELECTION_t *pcrSelectionIn,
diff --git = a/grub-core/lib/tss2/tpm2_cmd.h b/grub-core/lib/tss2/tpm2_cmd.h
index = 90b42efec..d7ad962ab 100644
--- = a/grub-core/lib/tss2/tpm2_cmd.h
+++ = b/grub-core/lib/tss2/tpm2_cmd.h
@@ -89,6 +89,13 @@ grub_tpm2_unseal = (const TPMI_DH_OBJECT_t item_handle,
extern TPM_RC_t
= grub_tpm2_flushcontext (const TPMI_DH_CONTEXT_t handle);

+extern = TPM_RC_t
+grub_tpm2_pcr_event (const TPMI_DH_PCR_t = pcrHandle,
+ = =     const TPMS_AUTH_COMMAND_t = *authCommand,
+     const = TPM2B_EVENT_t *eventData,
+ =     TPML_DIGEST_VALUES_t *digests,
+ =     TPMS_AUTH_RESPONSE_t *authResponse);
+
= extern TPM_RC_t
grub_tpm2_pcr_read (const TPMS_AUTH_COMMAND_t = *authCommand,
   const = TPML_PCR_SELECTION_t *pcrSelectionIn,
diff --git = a/grub-core/lib/tss2/tss2_mu.c b/grub-core/lib/tss2/tss2_mu.c
index = 816e5b37f..e544e62f9 100644
--- a/grub-core/lib/tss2/tss2_mu.c
+++ = b/grub-core/lib/tss2/tss2_mu.c
@@ -1118,6 +1118,24 @@ = grub_Tss2_MU_TPML_DIGEST_Unmarshal (grub_tpm2_buffer_t buffer,
=     grub_Tss2_MU_TPM2B_DIGEST_Unmarshal (buffer, = &digest->digests[i]);
= }

+void
+grub_Tss2_MU_TPML_DIGEST_VALUE_Unmarshal = (grub_tpm2_buffer_t buffer,
+  TPML_DIGEST_VALUES_t = *digests)
+{
+  grub_uint32_t i;
+
+ =  grub_tpm2_buffer_unpack_u32 (buffer, = &digests->count);
+
+  if (digests->count > = TPM_NUM_PCR_BANKS)
+    {
+ =      buffer->error =3D true;
+ =      return;
+    }
+
+ =  for (i =3D 0; i < digests->count; i++)
+ =    grub_Tss2_MU_TPMT_HA_Unmarshal (buffer, = &digests->digests[i]);
+}
+
void
= grub_Tss2_MU_TPMS_SIGNATURE_RSA_Unmarshal (grub_tpm2_buffer_t = buffer,
=             &n= bsp;           &nbs= p;            =       TPMS_SIGNATURE_RSA_t *rsa)
diff = --git a/grub-core/lib/tss2/tss2_mu.h = b/grub-core/lib/tss2/tss2_mu.h
index 6440de57c..76eebc994 = 100644
--- a/grub-core/lib/tss2/tss2_mu.h
+++ = b/grub-core/lib/tss2/tss2_mu.h
@@ -380,6 +380,10 @@ extern void
= grub_Tss2_MU_TPML_DIGEST_Unmarshal (grub_tpm2_buffer_t buffer,
=    TPML_DIGEST_t *digest);

+extern = void
+grub_Tss2_MU_TPML_DIGEST_VALUE_Unmarshal (grub_tpm2_buffer_t = buffer,
+ = = = = =  TPML_DIGEST_VALUES_t *digests);
+
extern void
= grub_Tss2_MU_TPMS_SIGNATURE_RSA_Unmarshal (grub_tpm2_buffer_t = buffer,
=             &n= bsp;           &nbs= p;            =       TPMS_SIGNATURE_RSA_t *p);
diff = --git a/grub-core/lib/tss2/tss2_structs.h = b/grub-core/lib/tss2/tss2_structs.h
index 2eefba87c..0ac09f50f = 100644
--- a/grub-core/lib/tss2/tss2_structs.h
+++ = b/grub-core/lib/tss2/tss2_structs.h
@@ -144,6 +144,13 @@ typedef = struct TPML_DIGEST TPML_DIGEST_t;
/* TPM2B_NONCE Type */
typedef = TPM2B_DIGEST_t TPM2B_NONCE_t;

+/* TPM2B_EVENT Structure = */
+struct TPM2B_EVENT {
+    grub_uint16_t = size;
+    grub_uint8_t = buffer[1024];
+};
+typedef struct TPM2B_EVENT = TPM2B_EVENT_t;
+
/* TPMA_SESSION Structure */
struct = TPMA_SESSION
{
diff --git a/grub-core/lib/tss2/tss2_types.h = b/grub-core/lib/tss2/tss2_types.h
index bddde7191..52d304b90 = 100644
--- a/grub-core/lib/tss2/tss2_types.h
+++ = b/grub-core/lib/tss2/tss2_types.h
@@ -343,6 +343,7 @@ typedef = grub_uint32_t TPM_CC_t;
#define TPM_CC_NV_Write =         ((TPM_CC_t) = 0x00000137)
#define TPM_CC_NV_UndefineSpace ((TPM_CC_t) = 0x00000122)
#define TPM_CC_GetCapability =    ((TPM_CC_t) 0x0000017a)
+#define TPM_CC_PCR_Event =        ((TPM_CC_t) 0x0000013c)
= #define TPM_CC_PCR_Read =         ((TPM_CC_t) = 0x0000017e)
#define TPM_CC_Load =             ((= TPM_CC_t) 0x00000157)
#define TPM_CC_LoadExternal =     ((TPM_CC_t) 0x00000167)
-- =
2.43.0


= --Apple-Mail=_1E7C5944-76B4-4748-A715-D34D84B339C4-- --===============0993278984098369978== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KR3J1Yi1kZXZl bCBtYWlsaW5nIGxpc3QKR3J1Yi1kZXZlbEBnbnUub3JnCmh0dHBzOi8vbGlzdHMuZ251Lm9yZy9t YWlsbWFuL2xpc3RpbmZvL2dydWItZGV2ZWwK --===============0993278984098369978==--