From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B7594C3ABD8 for ; Wed, 14 May 2025 12:13:44 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uFAyu-0003JG-4h; Wed, 14 May 2025 08:13:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uFAyq-0003GF-0P for grub-devel@gnu.org; Wed, 14 May 2025 08:13:00 -0400 Received: from mail-pf1-x42a.google.com ([2607:f8b0:4864:20::42a]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1uFAym-0002HW-0A for grub-devel@gnu.org; Wed, 14 May 2025 08:12:59 -0400 Received: by mail-pf1-x42a.google.com with SMTP id d2e1a72fcca58-7399838db7fso770787b3a.0 for ; Wed, 14 May 2025 05:12:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1747224773; x=1747829573; darn=gnu.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=JOW8+THfuw4IyRB4McR7asgJk2gbLZTAkLioR45db78=; b=Loe3WE33LdOzEEJ3mCF0eHaZCVwZ678AjRgFh/3rmzRBofctNio9CGoxCBVlceNRCk gP6N88XNU0Uj1YrkKAVzSmV6QIy7mDMV6B7jxyR9GnMwFISnxxlZhKXCzdJGkUQexrFr fzljEiSKTOnW3vvqX/W6/ppigrLXyS3puKWmwV7d3I0oblTbGDAN5hNlLYp5hEtaZ/tq aeqDZ1FLp9cRjDXTSeqqMC2Qnvrge+51ADi0rDe/n4GA68gYgwWf/IPC3A4VLZ/LzkDE V7WoliVYaZV/nOEEbJTZOD5qjwUT6Pf7Zs5Nz/ZxslUWO6sy3jiueFVdQ2eJkIkc6V76 tHbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747224773; x=1747829573; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=JOW8+THfuw4IyRB4McR7asgJk2gbLZTAkLioR45db78=; b=VYcSJZIhB1XA1itdZDZagZJ0Wwnl9Y0PFn2EvzJT55X15k4GTdqO2/Th5hNRAO6KEm w3m1ZfwLDIX9xxjtMvvtNkiHOoQ8m5BGZmcGJ9dXYn5a2+lDNupd18Q+38elkqA3R+tt ksGKjDAiGnGZboVuCLAjk7lsfqGEnGBHuzO8+LpXvb8zhK7QRz7I2C5JiAgNwgVUZqVn jHQziZ6mZMPQxJkTarpuaE5VFtIiUv4OQTsW49n0QppssFE+WZmekTdrJe2J3wdLimE6 AUPjiu5L41eacZgpxKRu5a8bZSml826f/rheQGaSDoubiwkFjnGYkA9PqEGt1Vp/twzV 1QWg== X-Gm-Message-State: AOJu0YxZCf/B78Ww1IrKtbbaC6jdgQ2fxkPw7Dp+49DofuRPkFxXXy/L 7CqBnQMFveuIa1HkETrUqIQJb3rfGF8l6ublXpEq9DFG1X+ObkFrQtTKQvt/lgGG+KsiJ9QW91Q MiKmNNsjvLteErlSZqvtkMEJ4LyhC3wioTS8= X-Gm-Gg: ASbGncsJzQx2jx9vd4Xj+j6jEmcuSksccscdEDXRrKSqoTxYftj8JIHMJnDmAYmByEG t/mTEy+tYo43Jm7NREYP7qrE8WtST9Y7He9Z6+E7ZU3IDqdcJqowT3GwxgKRFcMibtEqFpyqsIf WFP9cmaeVWfYxEbGp5vg898L627XZ2Iw== X-Google-Smtp-Source: AGHT+IGNbXv0ntiYa2Q6HHBuRcUdSO5O5UsWUUvDVhU0hoqfwBvwNzYXtSWxn3ZRTLCHMYwWjLvWiS5aP+cH8BvPpPc= X-Received: by 2002:a05:6a00:1787:b0:736:3ea8:4813 with SMTP id d2e1a72fcca58-74288f85a5cmr5192712b3a.2.1747224773014; Wed, 14 May 2025 05:12:53 -0700 (PDT) MIME-Version: 1.0 References: <20241031113458.12111-1-chench246@gmail.com> In-Reply-To: <20241031113458.12111-1-chench246@gmail.com> From: hao chen Date: Wed, 14 May 2025 20:12:41 +0800 X-Gm-Features: AX0GCFvmbLl-l1QiI06mqNehk0Z4YodTsNTO7j3estu6S26yW3m2Z4noTjkwbJo Message-ID: Subject: Fwd: [PATCH] efi/tpcm: Add TPCM module support To: grub-devel@gnu.org Cc: daniel.kiper@oracle.com Received-SPF: pass client-ip=2607:f8b0:4864:20::42a; envelope-from=chench246@gmail.com; helo=mail-pf1-x42a.google.com X-Spam_score_int: -17 X-Spam_score: -1.8 X-Spam_bar: - X-Spam_report: (-1.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: The development of GNU GRUB Content-Type: multipart/mixed; boundary="===============2111356330335925075==" Errors-To: grub-devel-bounces+grub-devel=archiver.kernel.org@gnu.org Sender: grub-devel-bounces+grub-devel=archiver.kernel.org@gnu.org --===============2111356330335925075== Content-Type: multipart/alternative; boundary="000000000000f03bcb063517776a" --000000000000f03bcb063517776a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable [PATCH RESEND] efi/tpcm: Add TPCM module support Hi GRUB maintainers, I submitted the following patch a few months ago, but haven't yet received any feedback. Could someone kindly review it? Please let me know if there's anything I can improve or clarify. Thank you very much for your time! Best regards, chench ---------- Forwarded message --------- =E5=8F=91=E4=BB=B6=E4=BA=BA=EF=BC=9A chench246 Date: 2024=E5=B9=B410=E6=9C=8831=E6=97=A5=E5=91=A8=E5=9B=9B 19:35 Subject: [PATCH] efi/tpcm: Add TPCM module support To: Cc: chench246 , hao chen From: chench246 TPCM(Trusted Platform Control Module) is a Chinese standard and has similar function to tpm, but tpcm adds the function of active monitoring and control to the system. It can realize active startup measurement when the system starts,as well as dynamic measurement and monitoring when the program is running, further enhance the security of the system. Signed-off-by: hao chen --- grub-core/Makefile.core.def | 7 ++ grub-core/commands/efi/tpcm.c | 163 ++++++++++++++++++++++++++++++++++ grub-core/commands/tpcm.c | 99 +++++++++++++++++++++ include/grub/efi/tpcm.h | 60 +++++++++++++ include/grub/err.h | 3 +- 5 files changed, 331 insertions(+), 1 deletion(-) create mode 100755 grub-core/commands/efi/tpcm.c create mode 100755 grub-core/commands/tpcm.c create mode 100644 include/grub/efi/tpcm.h diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def index 063ef5dd7..f1250601b 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def @@ -2562,6 +2562,13 @@ module =3D { enable =3D efi; }; +module =3D { + name =3D tpcm; + common =3D commands/tpcm.c; + efi =3D commands/efi/tpcm.c; + enable =3D x86_64_efi; +}; + module =3D { name =3D tr; common =3D commands/tr.c; diff --git a/grub-core/commands/efi/tpcm.c b/grub-core/commands/efi/tpcm.c new file mode 100755 index 000000000..bc97e800c --- /dev/null +++ b/grub-core/commands/efi/tpcm.c @@ -0,0 +1,163 @@ +/* + * GRUB -- GRand Unified Bootloader + * Copyright (C) 2018 Free Software Foundation, Inc. + * + * GRUB is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * GRUB is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GRUB. If not, see . + * + * EFI TPCM support code. + */ + +#include +#include + + +static grub_uint32_t g_measured_id =3D STAGE_START; + +/* + get_tpcm_stage: + TPCM does not make a distinction with the type of + measured target, so we use g_measured_id directly + for the stage. + */ +static grub_uint32_t get_tpcm_stage(void) +{ + grub_uint32_t stage =3D STAGE_INVALID; + + stage =3D g_measured_id; + + if (stage < STAGE_START || stage > STAGE_END) + stage =3D STAGE_INVALID; + + return stage; +} + +/* + update_measured_id: + update g_measured_id +1 every time measured, and g_measured_id + will never be decreased. + */ +static void update_measured_id(void) +{ + g_measured_id++; +} + +/* + measure_memory: + measure the memery region--(addr, size) through the TPCM protocol. + if TPCM protocol is not exist in BIOS, it will return SUCC to keep + compatible with non-measurement-support bios; if TPCM protocol is + exist but not enabled, it will also return SUCC. + */ +static grub_err_t measure_memory(enum grub_file_type type __attribute__((unused)), + char *desc, + grub_addr_t addr, + grub_size_t size) +{ + grub_efi_handle_t *handles =3D 0; + grub_efi_uintn_t num_handles; + grub_efi_handle_t grub_c2p_handle =3D 0; + grub_err_t test_c2p_err =3D GRUB_ERR_BAD_OS; + grub_guid_t c2p_guid =3D C2PGUID; + grub_uint32_t measure_result =3D 0; + grub_uint32_t control_result =3D 0; + grub_efi_boolean_t verify_enable =3D 0; + grub_size_t desc_len =3D 0; + + handles =3D grub_efi_locate_handle(GRUB_EFI_BY_PROTOCOL, &c2p_guid, NULL, &num_handles); + if (handles && (num_handles > 0)) + { + struct c2p_protocol *c2p; + + grub_c2p_handle =3D handles[0]; + grub_dprintf ("tpcm", "measue memory addr 0x%lx size 0x%lx \n", addr, size); + c2p =3D grub_efi_open_protocol(grub_c2p_handle, &c2p_guid, + GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL)= ; + if (c2p) + { + verify_enable =3D c2p->verify_is_enabled (c2p); + if (verify_enable) + { + struct addr_range range; + grub_efi_status_t status =3D 0; + grub_uint32_t stage =3D STAGE_INVALID; + + range.start =3D addr; + range.length =3D size; + + stage =3D get_tpcm_stage(); + if (stage !=3D STAGE_INVALID) + { + desc_len =3D grub_strlen(desc) + 1; + status =3D c2p->verify_raw (c2p, stage, (grub_uint64_t)desc, desc_len, 1, &range, &measure_result, &control_result)= ; + if ((!status) && ((control_result & MEASURE_ACTION_MASK) =3D=3D 0) ) + { + grub_dprintf ("tpcm", "verify_raw success. stage[%d]desc:[%s]\n", stage, desc); + test_c2p_err =3D GRUB_ERR_NONE; + } + else + { + grub_dprintf ("tpcm", "verify_raw error\n"); + while(1) + { + grub_error (GRUB_ERR_TPCM_VERIFY, "tpcm verify error. stage[%d]desc[%s]\n", stage, desc); + asm volatile ("hlt"); + } + } + } + else { + grub_dprintf ("tpcm", "invalid stage\n"); + } + + update_measured_id(); + + } + else { + grub_dprintf ("tpcm", "image verify not enabled\n"); + test_c2p_err =3D GRUB_ERR_NONE; + } + } + else + grub_dprintf ("tpcm", "open c2p protocol failed\n"); + } + else + { + /* keep compatible with non-measurement-support bios. */ + grub_dprintf ("tpcm", "not found C2P protocol\n"); + test_c2p_err =3D GRUB_ERR_NONE; + } + + return test_c2p_err; +} + +/* + grub_tpcm_measure_memory: + */ +grub_err_t grub_tpcm_measure_memory(void *context, grub_addr_t buf, grub_size_t size) +{ + char *p_context =3D (char *)context; + char *p, *p_desc; + char tmp[TPCM_MAX_BUF_SIZE] =3D {'0'}; + enum grub_file_type type; + + if (!p_context) + return GRUB_ERR_BUG; + + p =3D grub_strchr(p_context, '|'); + p_desc =3D p + 1; + grub_memcpy(tmp, p_context, (p-p_context)); + type =3D grub_strtoul(tmp, 0, 10); + + return measure_memory(type, p_desc, buf, size); +} + diff --git a/grub-core/commands/tpcm.c b/grub-core/commands/tpcm.c new file mode 100755 index 000000000..1c8bd77ce --- /dev/null +++ b/grub-core/commands/tpcm.c @@ -0,0 +1,99 @@ +/* + * GRUB -- GRand Unified Bootloader + * Copyright (C) 2018 Free Software Foundation, Inc. + * + * GRUB is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * GRUB is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GRUB. If not, see . + * + * Core TPCM support code. + */ + +#include +#include +#include +#include + +GRUB_MOD_LICENSE ("GPLv3+"); + +static char context_buf[TPCM_MAX_BUF_SIZE]; + +static grub_err_t grub_tpcm_verify_init(grub_file_t io, + enum grub_file_type type, + void **context, + enum grub_verify_flags *flags) +{ + grub_memset(context_buf, 0, TPCM_MAX_BUF_SIZE); + grub_snprintf(context_buf, TPCM_MAX_BUF_SIZE, "%d|%s", (type & GRUB_FILE_TYPE_MASK), io->name); + *context =3D context_buf; + *flags |=3D GRUB_VERIFY_FLAGS_SINGLE_CHUNK; + + return GRUB_ERR_NONE; +} + +static grub_err_t grub_tpcm_verify_write(void *context, void *buf , grub_size_t size ) +{ + return grub_tpcm_measure_memory(context, (grub_addr_t)buf, size); +} + +static grub_err_t grub_tpcm_verify_string (char *str, enum grub_verify_string_type type) +{ + const char *prefix =3D NULL; + char *description, *context; + grub_err_t status; + + switch (type) + { + case GRUB_VERIFY_KERNEL_CMDLINE: + prefix =3D "kernel_cmdline: "; + break; + case GRUB_VERIFY_MODULE_CMDLINE: + prefix =3D "module_cmdline: "; + break; + case GRUB_VERIFY_COMMAND: + prefix =3D "grub_cmd: "; + break; + } + + context =3D grub_zalloc(grub_strlen (str) + grub_strlen (prefix) + 1 + 4); /* 4 for type */ + if (!context) + return grub_errno; + + grub_snprintf(context, 4, "%d|", (type & GRUB_FILE_TYPE_MASK)); + description =3D context + grub_strlen(context); + grub_memcpy(description, prefix, grub_strlen (prefix)); + grub_memcpy(description + grub_strlen (prefix), str, grub_strlen (str) + 1); + + status =3D grub_tpcm_measure_memory(context, (grub_addr_t)str, grub_strlen(str)); + + grub_free(context); + + return status; +} + +struct grub_file_verifier grub_tpcm_verifier =3D { + .name =3D "tpcm", + .init =3D grub_tpcm_verify_init, + .write =3D grub_tpcm_verify_write, + .verify_string =3D grub_tpcm_verify_string, +}; + +GRUB_MOD_INIT (tpcm) +{ + grub_verifier_register(&grub_tpcm_verifier); +} + +GRUB_MOD_FINI (tpcm) +{ + grub_verifier_unregister(&grub_tpcm_verifier); +} + diff --git a/include/grub/efi/tpcm.h b/include/grub/efi/tpcm.h new file mode 100644 index 000000000..a4e0c765a --- /dev/null +++ b/include/grub/efi/tpcm.h @@ -0,0 +1,60 @@ +/* + * GRUB -- GRand Unified Bootloader + * Copyright (C) 2018 Free Software Foundation, Inc. + * + * GRUB is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * GRUB is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GRUB. If not, see . + */ + +#ifndef GRUB_EFI_TPCM_HEADER +#define GRUB_EFI_TPCM_HEADER 1 + +#include +#include +#include + +#define C2PGUID {0xf89ab5cd, 0x2829, 0x422f, {0xa5, 0xf3, 0x03, 0x28, 0xe0, 0x6c, 0xfc, 0xbb}} +#define MEASURE_RESULT_MASK (0xff00) +#define MEASURE_RESULT_SHIFT (16) +#define MEASURE_ACTION_MASK (0x1) +#define TPCM_MAX_BUF_SIZE 128 + +/* + stage layout: + 2000~2999: +1 every time +*/ + +#define STAGE_START 2000 +#define STAGE_END 2999 +#define STAGE_INVALID 3000 + +struct addr_range { + grub_uint64_t start; + grub_uint64_t length; +}; +struct c2p_protocol { + grub_efi_status_t (__grub_efi_api *verify_raw) (struct c2p_protocol *this, + grub_uint32_t measure_stage, + grub_uint64_t image_info, + grub_uint32_t image_info_size, + grub_uint32_t num_addr_range, + struct addr_range ranges[], + grub_uint32_t *measure_result, + grub_uint32_t *control_result); + grub_efi_boolean_t (__grub_efi_api *verify_is_enabled)(struct c2p_protocol *this); +}; +typedef struct c2p_protocol c2p_protocol_t; + +grub_err_t grub_tpcm_measure_memory(void *context, grub_addr_t buf, grub_size_t size); + +#endif diff --git a/include/grub/err.h b/include/grub/err.h index 1c07034cd..f5268dd47 100644 --- a/include/grub/err.h +++ b/include/grub/err.h @@ -73,7 +73,8 @@ typedef enum GRUB_ERR_NET_NO_DOMAIN, GRUB_ERR_EOF, GRUB_ERR_BAD_SIGNATURE, - GRUB_ERR_BAD_FIRMWARE + GRUB_ERR_BAD_FIRMWARE, + GRUB_ERR_TPCM_VERIFY } grub_err_t; --=20 2.17.1 --000000000000f03bcb063517776a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

[PATCH RESEND]=C2=A0=C2=A0 efi/tpcm: Add TPCM module support

Hi GRUB maintainers,

I submitted the following patch a few months ago, b= ut haven't yet received any feedback.

Could so= meone kindly review it? Please let me know if there's anything I can im= prove or clarify.

Thank you very much for your time!

Best reg= ards,
chench



---------- Forward= ed message ---------
=E5=8F=91=E4=BB=B6=E4=BA=BA=EF=BC=9A chench246 &l= t;chench246@gmail.= com>
Date: 2024=E5=B9=B410=E6=9C=8831=E6=97=A5=E5=91=A8=E5= =9B=9B 19:35
Subject: [PATCH] efi/tpcm: Add TPCM module support
To: = <grub-devel@gnu.= org>
Cc: chench246 <chench246@hotmail.com>, hao chen <chench246@gmail.com>
<= /div>

From: chench246 <chench246@hotmail.com>

TPCM(Trusted Platform Control Module) is a Chinese standard and has similar= function
to tpm, but tpcm adds the function of active monitoring and control to the = system.
It can realize active startup measurement when the system starts,as well as= dynamic
measurement and monitoring when the program is running, further enhance the= security
of the system.

Signed-off-by: hao chen <chench246@gmail.com>
---
=C2=A0grub-core/Makefile.core.def=C2=A0 =C2=A0|=C2=A0 =C2=A07 ++
=C2=A0grub-core/commands/efi/tpcm.c | 163 +++++++++++++++++++++++++++++++++= +
=C2=A0grub-core/commands/tpcm.c=C2=A0 =C2=A0 =C2=A0|=C2=A0 99 +++++++++++++= ++++++++
=C2=A0include/grub/efi/tpcm.h=C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 60 ++++++++= +++++
=C2=A0include/grub/err.h=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 |=C2=A0 = =C2=A03 +-
=C2=A05 files changed, 331 insertions(+), 1 deletion(-)
=C2=A0create mode 100755 grub-core/commands/efi/tpcm.c
=C2=A0create mode 100755 grub-core/commands/tpcm.c
=C2=A0create mode 100644 include/grub/efi/tpcm.h

diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
index 063ef5dd7..f1250601b 100644
--- a/grub-core/Makefile.core.def
+++ b/grub-core/Makefile.core.def
@@ -2562,6 +2562,13 @@ module =3D {
=C2=A0 =C2=A0enable =3D efi;
=C2=A0};

+module =3D {
+=C2=A0 name =3D tpcm;
+=C2=A0 common =3D commands/tpcm.c;
+=C2=A0 efi =3D commands/efi/tpcm.c;
+=C2=A0 enable =3D x86_64_efi;
+};
+
=C2=A0module =3D {
=C2=A0 =C2=A0name =3D tr;
=C2=A0 =C2=A0common =3D commands/tr.c;
diff --git a/grub-core/commands/efi/tpcm.c b/grub-core/commands/efi/tpcm.c<= br> new file mode 100755
index 000000000..bc97e800c
--- /dev/null
+++ b/grub-core/commands/efi/tpcm.c
@@ -0,0 +1,163 @@
+/*
+ *=C2=A0 GRUB=C2=A0 --=C2=A0 GRand Unified Bootloader
+ *=C2=A0 Copyright (C) 2018=C2=A0 Free Software Foundation, Inc.
+ *
+ *=C2=A0 GRUB is free software: you can redistribute it and/or modify
+ *=C2=A0 it under the terms of the GNU General Public License as published= by
+ *=C2=A0 the Free Software Foundation, either version 3 of the License, or=
+ *=C2=A0 (at your option) any later version.
+ *
+ *=C2=A0 GRUB is distributed in the hope that it will be useful,
+ *=C2=A0 but WITHOUT ANY WARRANTY; without even the implied warranty of + *=C2=A0 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.=C2=A0 See th= e
+ *=C2=A0 GNU General Public License for more details.
+ *
+ *=C2=A0 You should have received a copy of the GNU General Public License=
+ *=C2=A0 along with GRUB.=C2=A0 If not, see <http://www.gnu.org/lice= nses/>.
+ *
+ *=C2=A0 EFI TPCM support code.
+ */
+
+#include <grub/err.h>
+#include <grub/efi/tpcm.h>
+
+
+static grub_uint32_t g_measured_id =3D STAGE_START;
+
+/*
+=C2=A0 =C2=A0 get_tpcm_stage:
+=C2=A0 =C2=A0 =C2=A0 TPCM does not make a distinction with the type of
+=C2=A0 =C2=A0 measured target, so we use g_measured_id directly
+=C2=A0 =C2=A0 for the stage.
+ */
+static grub_uint32_t get_tpcm_stage(void)
+{
+=C2=A0 =C2=A0 grub_uint32_t stage =3D STAGE_INVALID;
+
+=C2=A0 =C2=A0 stage =3D g_measured_id;
+
+=C2=A0 =C2=A0 if (stage < STAGE_START || stage > STAGE_END)
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 stage =3D STAGE_INVALID;
+
+=C2=A0 =C2=A0 return stage;
+}
+
+/*
+=C2=A0 =C2=A0 update_measured_id:
+=C2=A0 =C2=A0 =C2=A0 update g_measured_id +1 every time measured, and g_me= asured_id
+=C2=A0 =C2=A0 will never be decreased.
+ */
+static void update_measured_id(void)
+{
+=C2=A0 =C2=A0 g_measured_id++;
+}
+
+/*
+=C2=A0 =C2=A0 measure_memory:
+=C2=A0 =C2=A0 =C2=A0 measure the memery region--(addr, size) through the T= PCM protocol.
+=C2=A0 =C2=A0 if TPCM protocol is not exist in BIOS, it will return SUCC t= o keep
+=C2=A0 =C2=A0 compatible with non-measurement-support bios; if TPCM protoc= ol is
+=C2=A0 =C2=A0 exist but not enabled, it will also return SUCC.
+ */
+static grub_err_t measure_memory(enum grub_file_type type __attribute__((u= nused)),
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0char *desc,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0grub_addr_t addr,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0grub_size_t size)
+{
+=C2=A0 =C2=A0 grub_efi_handle_t=C2=A0 =C2=A0*handles =3D 0;
+=C2=A0 =C2=A0 grub_efi_uintn_t=C2=A0 =C2=A0 num_handles;
+=C2=A0 =C2=A0 grub_efi_handle_t=C2=A0 =C2=A0grub_c2p_handle =3D 0;
+=C2=A0 =C2=A0 grub_err_t=C2=A0 test_c2p_err =3D GRUB_ERR_BAD_OS;
+=C2=A0 =C2=A0 grub_guid_t=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0c2p_guid =3D C2= PGUID;
+=C2=A0 =C2=A0 grub_uint32_t=C2=A0 =C2=A0 =C2=A0 =C2=A0measure_result =3D 0= ;
+=C2=A0 =C2=A0 grub_uint32_t=C2=A0 =C2=A0 =C2=A0 =C2=A0control_result =3D 0= ;
+=C2=A0 =C2=A0 grub_efi_boolean_t=C2=A0 =C2=A0 verify_enable =3D 0;
+=C2=A0 =C2=A0 grub_size_t=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0desc_len =3D 0;=
+
+=C2=A0 =C2=A0 handles =3D grub_efi_locate_handle(GRUB_EFI_BY_PROTOCOL, &am= p;c2p_guid, NULL, &num_handles);
+=C2=A0 =C2=A0 if (handles && (num_handles > 0))
+=C2=A0 =C2=A0 {
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 struct c2p_protocol *c2p;
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_c2p_handle =3D handles[0];
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_dprintf ("tpcm", "measue m= emory addr 0x%lx size 0x%lx=C2=A0 \n", addr, size);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 c2p =3D grub_efi_open_protocol(grub_c2p_handle= , &c2p_guid,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 GRUB_EFI_OPEN_P= ROTOCOL_GET_PROTOCOL);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 if (c2p)
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 {
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 verify_enable =3D c2p->verify= _is_enabled (c2p);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (verify_enable)
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 {
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 struct addr_range = range;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_efi_status_t = status =3D 0;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_uint32_t stag= e =3D STAGE_INVALID;
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 range.start=C2=A0 = =3D addr;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 range.length =3D s= ize;
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 stage =3D get_tpcm= _stage();
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (stage !=3D STA= GE_INVALID)
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 {
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 desc= _len =3D grub_strlen(desc) + 1;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 stat= us =3D c2p->verify_raw (c2p, stage, (grub_uint64_t)desc, desc_len, 1, &a= mp;range, &measure_result, &control_result);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (= (!status) && ((control_result & MEASURE_ACTION_MASK) =3D=3D 0) = )
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 { +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 grub_dprintf ("tpcm", "verify_raw success. stage[= %d]desc:[%s]\n", stage, desc);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 test_c2p_err =3D GRUB_ERR_NONE;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 } +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 else=
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 { +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 grub_dprintf ("tpcm", "verify_raw error\n");=
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 while(1)
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 {
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 grub_error (GRUB_ERR_TPCM_VERIFY, "tpcm verif= y error. stage[%d]desc[%s]\n", stage, desc);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 asm volatile ("hlt");
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 }
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 } +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 }
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 else {
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 grub= _dprintf ("tpcm", "invalid stage\n");
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 }
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 update_measured_id= ();
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 }
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 else {
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_dprintf (&quo= t;tpcm", "image verify not enabled\n");
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 test_c2p_err =3D G= RUB_ERR_NONE;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 }
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 }
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 else
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_dprintf ("tpcm", = "open c2p protocol failed\n");
+=C2=A0 =C2=A0 }
+=C2=A0 =C2=A0 else
+=C2=A0 =C2=A0 {
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 /* keep compatible with non-measurement-suppor= t bios. */
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_dprintf ("tpcm", "not foun= d C2P protocol\n");
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 test_c2p_err =3D GRUB_ERR_NONE;
+=C2=A0 =C2=A0 }
+
+=C2=A0 =C2=A0 return test_c2p_err;
+}
+
+/*
+=C2=A0 =C2=A0 grub_tpcm_measure_memory:
+ */
+grub_err_t grub_tpcm_measure_memory(void *context, grub_addr_t buf, grub_s= ize_t size)
+{
+=C2=A0 =C2=A0 char *p_context =3D (char *)context;
+=C2=A0 =C2=A0 char *p, *p_desc;
+=C2=A0 =C2=A0 char tmp[TPCM_MAX_BUF_SIZE] =3D {'0'};
+=C2=A0 =C2=A0 enum grub_file_type type;
+
+=C2=A0 =C2=A0 if (!p_context)
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 return GRUB_ERR_BUG;
+
+=C2=A0 =C2=A0 p =3D grub_strchr(p_context, '|');
+=C2=A0 =C2=A0 p_desc =3D p + 1;
+=C2=A0 =C2=A0 grub_memcpy(tmp, p_context, (p-p_context));
+=C2=A0 =C2=A0 type =3D grub_strtoul(tmp, 0, 10);
+
+=C2=A0 =C2=A0 return measure_memory(type, p_desc, buf, size);
+}
+
diff --git a/grub-core/commands/tpcm.c b/grub-core/commands/tpcm.c
new file mode 100755
index 000000000..1c8bd77ce
--- /dev/null
+++ b/grub-core/commands/tpcm.c
@@ -0,0 +1,99 @@
+/*
+ *=C2=A0 GRUB=C2=A0 --=C2=A0 GRand Unified Bootloader
+ *=C2=A0 Copyright (C) 2018=C2=A0 Free Software Foundation, Inc.
+ *
+ *=C2=A0 GRUB is free software: you can redistribute it and/or modify
+ *=C2=A0 it under the terms of the GNU General Public License as published= by
+ *=C2=A0 the Free Software Foundation, either version 3 of the License, or=
+ *=C2=A0 (at your option) any later version.
+ *
+ *=C2=A0 GRUB is distributed in the hope that it will be useful,
+ *=C2=A0 but WITHOUT ANY WARRANTY; without even the implied warranty of + *=C2=A0 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.=C2=A0 See th= e
+ *=C2=A0 GNU General Public License for more details.
+ *
+ *=C2=A0 You should have received a copy of the GNU General Public License=
+ *=C2=A0 along with GRUB.=C2=A0 If not, see <http://www.gnu.org/lice= nses/>.
+ *
+ *=C2=A0 Core TPCM support code.
+ */
+
+#include <grub/err.h>
+#include <grub/verify.h>
+#include <grub/dl.h>
+#include <grub/efi/tpcm.h>
+
+GRUB_MOD_LICENSE ("GPLv3+");
+
+static char context_buf[TPCM_MAX_BUF_SIZE];
+
+static grub_err_t grub_tpcm_verify_init(grub_file_t io,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 enum grub_file_type type,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 void **context,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 enum grub_verify_flags *flags)
+{
+=C2=A0 =C2=A0 grub_memset(context_buf, 0, TPCM_MAX_BUF_SIZE);
+=C2=A0 =C2=A0 grub_snprintf(context_buf, TPCM_MAX_BUF_SIZE, "%d|%s&qu= ot;, (type & GRUB_FILE_TYPE_MASK), io->name);
+=C2=A0 =C2=A0 *context =3D context_buf;
+=C2=A0 =C2=A0 *flags |=3D GRUB_VERIFY_FLAGS_SINGLE_CHUNK;
+
+=C2=A0 =C2=A0 return GRUB_ERR_NONE;
+}
+
+static grub_err_t grub_tpcm_verify_write(void *context, void *buf , grub_s= ize_t size )
+{
+=C2=A0 =C2=A0 return grub_tpcm_measure_memory(context, (grub_addr_t)buf, s= ize);
+}
+
+static grub_err_t grub_tpcm_verify_string (char *str, enum grub_verify_str= ing_type type)
+{
+=C2=A0 =C2=A0 const char *prefix =3D NULL;
+=C2=A0 =C2=A0 char *description, *context;
+=C2=A0 =C2=A0 grub_err_t status;
+
+=C2=A0 =C2=A0 switch (type)
+=C2=A0 =C2=A0 {
+=C2=A0 =C2=A0 case GRUB_VERIFY_KERNEL_CMDLINE:
+=C2=A0 =C2=A0 =C2=A0 prefix =3D "kernel_cmdline: ";
+=C2=A0 =C2=A0 =C2=A0 break;
+=C2=A0 =C2=A0 case GRUB_VERIFY_MODULE_CMDLINE:
+=C2=A0 =C2=A0 =C2=A0 prefix =3D "module_cmdline: ";
+=C2=A0 =C2=A0 =C2=A0 break;
+=C2=A0 =C2=A0 case GRUB_VERIFY_COMMAND:
+=C2=A0 =C2=A0 =C2=A0 prefix =3D "grub_cmd: ";
+=C2=A0 =C2=A0 =C2=A0 break;
+=C2=A0 =C2=A0 }
+
+=C2=A0 =C2=A0 context =3D grub_zalloc(grub_strlen (str) + grub_strlen (pre= fix) + 1 + 4);=C2=A0 /* 4 for type */
+=C2=A0 =C2=A0 if (!context)
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 return grub_errno;
+
+=C2=A0 =C2=A0 grub_snprintf(context, 4, "%d|", (type & GRUB_= FILE_TYPE_MASK));
+=C2=A0 =C2=A0 description =3D context + grub_strlen(context);
+=C2=A0 =C2=A0 grub_memcpy(description, prefix, grub_strlen (prefix));
+=C2=A0 =C2=A0 grub_memcpy(description + grub_strlen (prefix), str, grub_st= rlen (str) + 1);
+
+=C2=A0 =C2=A0 status =3D grub_tpcm_measure_memory(context, (grub_addr_t)st= r, grub_strlen(str));
+
+=C2=A0 =C2=A0 grub_free(context);
+
+=C2=A0 =C2=A0 return status;
+}
+
+struct grub_file_verifier grub_tpcm_verifier =3D {
+=C2=A0 =C2=A0 .name =3D "tpcm",
+=C2=A0 =C2=A0 .init=C2=A0 =3D grub_tpcm_verify_init,
+=C2=A0 =C2=A0 .write =3D grub_tpcm_verify_write,
+=C2=A0 =C2=A0 .verify_string =3D grub_tpcm_verify_string,
+};
+
+GRUB_MOD_INIT (tpcm)
+{
+=C2=A0 =C2=A0 grub_verifier_register(&grub_tpcm_verifier);
+}
+
+GRUB_MOD_FINI (tpcm)
+{
+=C2=A0 =C2=A0 grub_verifier_unregister(&grub_tpcm_verifier);
+}
+
diff --git a/include/grub/efi/tpcm.h b/include/grub/efi/tpcm.h
new file mode 100644
index 000000000..a4e0c765a
--- /dev/null
+++ b/include/grub/efi/tpcm.h
@@ -0,0 +1,60 @@
+/*
+ *=C2=A0 GRUB=C2=A0 --=C2=A0 GRand Unified Bootloader
+ *=C2=A0 Copyright (C) 2018=C2=A0 Free Software Foundation, Inc.
+ *
+ *=C2=A0 GRUB is free software: you can redistribute it and/or modify
+ *=C2=A0 it under the terms of the GNU General Public License as published= by
+ *=C2=A0 the Free Software Foundation, either version 3 of the License, or=
+ *=C2=A0 (at your option) any later version.
+ *
+ *=C2=A0 GRUB is distributed in the hope that it will be useful,
+ *=C2=A0 but WITHOUT ANY WARRANTY; without even the implied warranty of + *=C2=A0 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.=C2=A0 See th= e
+ *=C2=A0 GNU General Public License for more details.
+ *
+ *=C2=A0 You should have received a copy of the GNU General Public License=
+ *=C2=A0 along with GRUB.=C2=A0 If not, see <http://www.gnu.org/lice= nses/>.
+ */
+
+#ifndef GRUB_EFI_TPCM_HEADER
+#define GRUB_EFI_TPCM_HEADER 1
+
+#include <grub/file.h>
+#include <grub/efi/api.h>
+#include <grub/efi/efi.h>
+
+#define C2PGUID=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0{0xf89ab5cd, 0x2829, 0x42= 2f, {0xa5, 0xf3, 0x03, 0x28, 0xe0, 0x6c, 0xfc, 0xbb}}
+#define MEASURE_RESULT_MASK=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 (0xff00)
+#define MEASURE_RESULT_SHIFT=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(16)
+#define MEASURE_ACTION_MASK=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 (0x1)
+#define TPCM_MAX_BUF_SIZE=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 128
+
+/*
+=C2=A0 =C2=A0stage layout:
+=C2=A0 =C2=A0 =C2=A02000~2999: +1 every time
+*/
+
+#define STAGE_START=C2=A0 =C2=A0 =C2=A0 2000
+#define STAGE_END=C2=A0 =C2=A0 =C2=A0 =C2=A0 2999
+#define STAGE_INVALID=C2=A0 =C2=A0 3000
+
+struct addr_range {
+=C2=A0 =C2=A0 grub_uint64_t start;
+=C2=A0 =C2=A0 grub_uint64_t length;
+};
+struct c2p_protocol {
+=C2=A0 =C2=A0 grub_efi_status_t (__grub_efi_api *verify_raw) (struct c2p_p= rotocol *this,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_uint32_t measure_= stage,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_uint64_t image_in= fo,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_uint32_t image_in= fo_size,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_uint32_t num_addr= _range,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 struct addr_range rang= es[],
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_uint32_t *measure= _result,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 grub_uint32_t *control= _result);
+=C2=A0 =C2=A0 grub_efi_boolean_t (__grub_efi_api *verify_is_enabled)(struc= t c2p_protocol *this);
+};
+typedef struct c2p_protocol c2p_protocol_t;
+
+grub_err_t grub_tpcm_measure_memory(void *context, grub_addr_t buf, grub_s= ize_t size);
+
+#endif
diff --git a/include/grub/err.h b/include/grub/err.h
index 1c07034cd..f5268dd47 100644
--- a/include/grub/err.h
+++ b/include/grub/err.h
@@ -73,7 +73,8 @@ typedef enum
=C2=A0 =C2=A0 =C2=A0GRUB_ERR_NET_NO_DOMAIN,
=C2=A0 =C2=A0 =C2=A0GRUB_ERR_EOF,
=C2=A0 =C2=A0 =C2=A0GRUB_ERR_BAD_SIGNATURE,
-=C2=A0 =C2=A0 GRUB_ERR_BAD_FIRMWARE
+=C2=A0 =C2=A0 GRUB_ERR_BAD_FIRMWARE,
+=C2=A0 =C2=A0 GRUB_ERR_TPCM_VERIFY
=C2=A0 =C2=A0}
=C2=A0grub_err_t;

--
2.17.1

--000000000000f03bcb063517776a-- --===============2111356330335925075== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KR3J1Yi1kZXZl bCBtYWlsaW5nIGxpc3QKR3J1Yi1kZXZlbEBnbnUub3JnCmh0dHBzOi8vbGlzdHMuZ251Lm9yZy9t YWlsbWFuL2xpc3RpbmZvL2dydWItZGV2ZWwK --===============2111356330335925075==--