SecureBoot: Update sha1 bank of PCRs along with sha256

Change-Id: I526809abe8fa8d00929f79a4c3e1dcaf7386873a
RTC: 154324
Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/27032
Reviewed-by: Timothy R. Block <block@us.ibm.com>
Tested-by: Jenkins Server <pfd-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP Build CI <op-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP HW <op-hw-jenkins+hostboot@us.ibm.com>
Tested-by: FSP CI Jenkins <fsp-CI-jenkins+hostboot@us.ibm.com>
Reviewed-by: Nicholas E. Bofferding <bofferdn@us.ibm.com>
Reviewed-by: William G. Hoffa <wghoffa@us.ibm.com>
Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/27634
Reviewed-by: Christopher J. Engel <cjengel@us.ibm.com>

9 files changed, 182 insertions, 61 deletions

diff --git a/src/usr/secureboot/trusted/test/tpmLogMgrTest.H b/src/usr/secureboot/trusted/test/tpmLogMgrTest.H
index f2f1d4d54..27ba7c2aa 100755
--- a/src/usr/secureboot/trusted/test/tpmLogMgrTest.H
+++ b/src/usr/secureboot/trusted/test/tpmLogMgrTest.H
@@ -60,8 +60,8 @@ class TPMLogMgrTest: public CxxTest::TestSuite
                 delete err;
                 err = NULL;
             }
-            else if (TpmLogMgr_getLogSize(logMgr) != 69)
-                // 69 is size of header entry
+            else if (TpmLogMgr_getLogSize(logMgr) != 73)
+                // 73 is size of header entry
             {
                 TS_FAIL( "getTestLogMgr - Failed to find "
                          "proper header log Len=%d",
@@ -123,7 +123,7 @@ class TPMLogMgrTest: public CxxTest::TestSuite
                         break;
                     }
 
-                    memset(log.digests.digests[0].digest.bytes,
+                    memset(&(log.digests.digests[0].digest),
                            0x51+idx, digestSize);
 
                     log.event.eventSize = 21+idx;
@@ -213,7 +213,9 @@ class TPMLogMgrTest: public CxxTest::TestSuite
             // Get a TCG_PCR_EVENT2
             TCG_PCR_EVENT2 eventLog = TpmLogMgr_genLogEventPcrExtend(
                                         pcr, algId,
-                                        digest, digestSize, i_logMsg);
+                                        digest, digestSize,
+                                        TPM_ALG_SHA1, digest,
+                                        digestSize, i_logMsg);
 
             // Add event to log
             errlHndl_t err = TpmLogMgr_addEvent(&i_logMgr, &eventLog);
diff --git a/src/usr/secureboot/trusted/test/trustedbootTest.H b/src/usr/secureboot/trusted/test/trustedbootTest.H
index e19ad1d00..e8b062ad7 100755
--- a/src/usr/secureboot/trusted/test/trustedbootTest.H
+++ b/src/usr/secureboot/trusted/test/trustedbootTest.H
@@ -448,7 +448,26 @@ class TrustedBootTest: public CxxTest::TestSuite
                                   fails,
                                   sizeof(TPM2_ExtendIn) +
                                   sizeof(TPMS_AUTH_COMMAND) +
-                                  4); //auth size field
+                                  sizeof(uint32_t) - //auth size field
+                                  sizeof(TPMT_HA)); // less second digest
+
+                cmdPtr->digests.count = 2;
+                cmdPtr->digests.digests[1].algorithmId = TPM_ALG_SHA1;
+
+                // Test with two hashes
+                runTpmMarshalTest(baseCmd,
+                                  dataBufOut,
+                                  sizeof(dataBufOut),
+                                  cmdSize,
+                                  "ExtendIn",
+                                  num_ops,
+                                  fails,
+                                  sizeof(TPM2_ExtendIn) +
+                                  sizeof(TPMS_AUTH_COMMAND) +
+                                  sizeof(uint32_t) - //auth size field
+                                  (TPM_ALG_SHA256_SIZE - TPM_ALG_SHA1_SIZE)
+                                  ); // less sha1 digest size
+
 
                 // Invalid number of digests
                 memset(dataBufIn, 0, sizeof(dataBufIn));
@@ -488,7 +507,8 @@ class TrustedBootTest: public CxxTest::TestSuite
                                   "PcrReadIn",
                                   num_ops,
                                   fails,
-                                  sizeof(TPM2_PcrReadIn));
+                                  sizeof(TPM2_PcrReadIn) -
+                                  sizeof(TPMS_PCR_SELECTION)); // less unused
 
                 // Invalid number of algorithms
                 memset(dataBufIn, 0, sizeof(dataBufIn));
diff --git a/src/usr/secureboot/trusted/tpmLogMgr.C b/src/usr/secureboot/trusted/tpmLogMgr.C
index f5ab74a64..b291d935f 100644
--- a/src/usr/secureboot/trusted/tpmLogMgr.C
+++ b/src/usr/secureboot/trusted/tpmLogMgr.C
@@ -120,6 +120,8 @@ namespace TRUSTEDBOOT
             eventData->numberOfAlgorithms = htole32(HASH_COUNT);
             eventData->digestSizes[0].algorithmId = htole16(TPM_ALG_SHA256);
             eventData->digestSizes[0].digestSize = htole16(TPM_ALG_SHA256_SIZE);
+            eventData->digestSizes[1].algorithmId = htole16(TPM_ALG_SHA1);
+            eventData->digestSizes[1].digestSize = htole16(TPM_ALG_SHA1_SIZE);
             eventData->vendorInfoSize = sizeof(vendorInfo);
             memcpy(eventData->vendorInfo, vendorInfo, sizeof(vendorInfo));
             val->newEventPtr = TCG_PCR_EVENT_logMarshal(&eventLogEntry,
@@ -156,16 +158,12 @@ namespace TRUSTEDBOOT
 
             mutex_init( &val->logMutex );
             mutex_lock( &val->logMutex );
-            TRACUCOMP( g_trac_trustedboot,
-                   ">>initializeUsingExistingLog() 1");
 
             val->logMaxSize = eventLogSize;
             val->eventLogInMem = eventLogPtr;
 
             // Ok, walk the log to figure out how big this is
             val->logSize = TpmLogMgr_calcLogSize(val);
-            TRACUCOMP( g_trac_trustedboot,
-                   ">>initializeUsingExistingLog() 2");
 
             if (0 == val->logSize)
             {
@@ -298,7 +296,7 @@ namespace TRUSTEDBOOT
     {
 
         // Debug display of raw data
-        TRACUCOMP(g_trac_trustedboot, "tpmDumpLog Size : %d\n",
+        TRACUCOMP(g_trac_trustedboot, "tpmDumpLog Size : %d",
                   (int)val->logSize);
 
 #ifdef __HOSTBOOT_MODULE
@@ -450,25 +448,45 @@ namespace TRUSTEDBOOT
     }
 
     TCG_PCR_EVENT2 TpmLogMgr_genLogEventPcrExtend(TPM_Pcr i_pcr,
-                                                  TPM_Alg_Id i_algId,
-                                                  const uint8_t* i_digest,
-                                                  size_t i_digestSize,
+                                                  TPM_Alg_Id i_algId_1,
+                                                  const uint8_t* i_digest_1,
+                                                  size_t i_digestSize_1,
+                                                  TPM_Alg_Id i_algId_2,
+                                                  const uint8_t* i_digest_2,
+                                                  size_t i_digestSize_2,
                                                   const char* i_logMsg)
     {
         TCG_PCR_EVENT2 eventLog;
+        size_t fullDigestSize_1 = 0;
+        size_t fullDigestSize_2 = 0;
+
+        fullDigestSize_1 = getDigestSize(i_algId_1);
+        if (NULL != i_digest_2)
+        {
+            fullDigestSize_2 = getDigestSize(i_algId_2);
+        }
 
         memset(&eventLog, 0, sizeof(eventLog));
         eventLog.pcrIndex = i_pcr;
         eventLog.eventType = EV_ACTION;
 
-        // Update digest information, we only use 1 entry
+        // Update digest information
         eventLog.digests.count = 1;
-        eventLog.digests.digests[0].algorithmId = i_algId;
-        memcpy(eventLog.digests.digests[0].digest.bytes,
-               i_digest,
-               (i_digestSize > sizeof(TPMU_HA) ?
-                sizeof(TPMU_HA) : i_digestSize));
+        eventLog.digests.digests[0].algorithmId = i_algId_1;
+        memcpy(&(eventLog.digests.digests[0].digest),
+               i_digest_1,
+               (i_digestSize_1 < fullDigestSize_1 ?
+                i_digestSize_1 : fullDigestSize_1));
 
+        if (NULL != i_digest_2)
+        {
+            eventLog.digests.count = 2;
+            eventLog.digests.digests[1].algorithmId = i_algId_2;
+            memcpy(&(eventLog.digests.digests[1].digest),
+                   i_digest_2,
+                   (i_digestSize_2 < fullDigestSize_2 ?
+                    i_digestSize_2 : fullDigestSize_2));
+        }
         // Event field data
         eventLog.event.eventSize = strlen(i_logMsg);
         memset(eventLog.event.event, 0, sizeof(eventLog.event.event));
diff --git a/src/usr/secureboot/trusted/tpmLogMgr.H b/src/usr/secureboot/trusted/tpmLogMgr.H
index 15dd6e653..90cab6515 100644
--- a/src/usr/secureboot/trusted/tpmLogMgr.H
+++ b/src/usr/secureboot/trusted/tpmLogMgr.H
@@ -77,7 +77,7 @@ namespace TRUSTEDBOOT
     uint32_t TCG_EfiSpecIdEventStruct_size(TCG_EfiSpecIdEventStruct* val);
 
     enum {
-        TPMLOG_BUFFER_SIZE   = 1024, ///< Size of event log buffer in bytes
+        TPMLOG_BUFFER_SIZE   = 2048, ///< Size of event log buffer in bytes
         TPMLOG_DEVTREE_SIZE  = 64*1024, ///< Size to allocate for OPAL
     };
 
@@ -204,17 +204,23 @@ namespace TRUSTEDBOOT
      * @brief Get a TCG_PCR_EVENT2 populated with required data
      *
      * @param[in] i_pcr PCR to write to
-     * @param[in] i_algId Algorithm to use
-     * @param[in] i_digest Digest value to write to PCR
-     * @param[in] i_digestSize Byte size of i_digest array
+     * @param[in] i_algId_1 Algorithm to use
+     * @param[in] i_digest_1 Digest value to write to PCR
+     * @param[in] i_digestSize_1 Byte size of i_digest array
+     * @param[in] i_algId_2 Algorithm to use
+     * @param[in] i_digest_2 Digest value to write to PCR, NULL if not used
+     * @param[in] i_digestSize_2 Byte size of i_digest array
      * @param[in] i_logMsg Null terminated Log message
      *
      * @return TCG_PCR_EVENT2   PCR event log
      */
     TCG_PCR_EVENT2 TpmLogMgr_genLogEventPcrExtend(TPM_Pcr i_pcr,
-                                                  TPM_Alg_Id i_algId,
-                                                  const uint8_t* i_digest,
-                                                  size_t i_digestSize,
+                                                  TPM_Alg_Id i_algId_1,
+                                                  const uint8_t* i_digest_1,
+                                                  size_t i_digestSize_1,
+                                                  TPM_Alg_Id i_algId_2,
+                                                  const uint8_t* i_digest_2,
+                                                  size_t i_digestSize_2,
                                                   const char* i_logMsg);
 
     /**
diff --git a/src/usr/secureboot/trusted/trustedTypes.C b/src/usr/secureboot/trusted/trustedTypes.C
index 709236939..edc0269cb 100644
--- a/src/usr/secureboot/trusted/trustedTypes.C
+++ b/src/usr/secureboot/trusted/trustedTypes.C
@@ -167,7 +167,7 @@ namespace TRUSTEDBOOT
             return NULL;
         }
         o_tpmBuf = marshalChunk(o_tpmBuf, i_tpmBufSize, io_cmdSize,
-                                &(val->digest.bytes),
+                                &(val->digest),
                                 getDigestSize((TPM_Alg_Id)val->algorithmId));
         return o_tpmBuf;
     }
@@ -493,7 +493,7 @@ namespace TRUSTEDBOOT
         uint16_t* field16 = (uint16_t*)i_logBuf;
         *field16 = htole16(val->algorithmId);
         i_logBuf += sizeof(uint16_t);
-        memcpy(i_logBuf, val->digest.bytes,
+        memcpy(i_logBuf, &(val->digest),
                getDigestSize((TPM_Alg_Id)val->algorithmId));
         i_logBuf += getDigestSize((TPM_Alg_Id)val->algorithmId);
         return i_logBuf;
@@ -537,7 +537,7 @@ namespace TRUSTEDBOOT
                 break;
             }
 
-            memcpy(&(val->digest.bytes), i_tpmBuf, size);
+            memcpy(&(val->digest), i_tpmBuf, size);
             i_tpmBuf += size;
         } while(0);
 
@@ -555,7 +555,7 @@ namespace TRUSTEDBOOT
     {
         size_t digestSize = getDigestSize((TPM_Alg_Id)algorithmId);
         return (algorithmId == i_rhs.algorithmId) &&
-               (memcmp(digest.bytes, i_rhs.digest.bytes, digestSize) == 0);
+            (memcmp(&(digest), &(i_rhs.digest), digestSize) == 0);
     }
 #endif
 
@@ -871,7 +871,7 @@ namespace TRUSTEDBOOT
             {
                 *o_err = true;
                 i_tpmBuf = NULL;
-                TRACFCOMP(g_trac_trustedboot,"ERROR> TCG_PCR_EVENT2:"
+                TRACUCOMP(g_trac_trustedboot,"ERROR> TCG_PCR_EVENT2:"
                           "logUnmarshal() invalid pcrIndex %d",
                           val->pcrIndex);
                 break;
@@ -888,7 +888,7 @@ namespace TRUSTEDBOOT
             {
                 *o_err = true;
                 i_tpmBuf = NULL;
-                TRACFCOMP(g_trac_trustedboot,"ERROR> TCG_PCR_EVENT2:"
+                TRACUCOMP(g_trac_trustedboot,"ERROR> TCG_PCR_EVENT2:"
                           "logUnmarshal() invalid eventType %d",
                           val->eventType);
                 break;
diff --git a/src/usr/secureboot/trusted/trustedTypes.H b/src/usr/secureboot/trusted/trustedTypes.H
index a22955ede..00effcd1c 100644
--- a/src/usr/secureboot/trusted/trustedTypes.H
+++ b/src/usr/secureboot/trusted/trustedTypes.H
@@ -76,7 +76,7 @@ namespace TRUSTEDBOOT
         TPM_BACKUP_INDEX = 1,     ///< Index for backup TPM
         MAX_TPM_LOG_MSG = 128,    ///< Maximum log message size
 
-        HASH_COUNT            = 1,       ///< Maximum # of digests
+        HASH_COUNT            = 2,       ///< Maximum # of digests
 
         PCR_SELECT_MAX = (IMPLEMENTATION_PCR+7)/8, ///< PCR selection octet max
     };
@@ -203,7 +203,6 @@ namespace TRUSTEDBOOT
     /// Digest union
     union _TPMU_HA
     {
-        uint8_t bytes[0];
         uint8_t sha1[TPM_ALG_SHA1_SIZE];
         uint8_t sha256[TPM_ALG_SHA256_SIZE];
     } PACKED;
diff --git a/src/usr/secureboot/trusted/trustedboot.C b/src/usr/secureboot/trusted/trustedboot.C
index 06924a330..f2776adfd 100644
--- a/src/usr/secureboot/trusted/trustedboot.C
+++ b/src/usr/secureboot/trusted/trustedboot.C
@@ -411,7 +411,8 @@ void tpmReplayLog(TRUSTEDBOOT::TpmTarget & io_target)
                 err = tpmCmdPcrExtend(&io_target,
                             (TPM_Pcr)l_eventLog.pcrIndex,
                             l_algId,
-                            l_eventLog.digests.digests[i].digest.bytes,
+                            reinterpret_cast<uint8_t*>
+                                      (&(l_eventLog.digests.digests[i].digest)),
                             getDigestSize(l_algId));
                 if (err)
                 {
@@ -571,8 +572,12 @@ void pcrExtendSingleTpm(TpmTarget & io_target,
              !io_target.failed))
         {
             // Fill in TCG_PCR_EVENT2 and add to log
-            eventLog = TpmLogMgr_genLogEventPcrExtend(i_pcr, i_algId, i_digest,
-                                                      i_digestSize, i_logMsg);
+            eventLog = TpmLogMgr_genLogEventPcrExtend(i_pcr,
+                                                      i_algId, i_digest,
+                                                      i_digestSize,
+                                                      TPM_ALG_SHA1, i_digest,
+                                                      i_digestSize,
+                                                      i_logMsg);
             err = TpmLogMgr_addEvent(io_target.logMgr,&eventLog);
             if (NULL != err)
             {
@@ -587,11 +592,16 @@ void pcrExtendSingleTpm(TpmTarget & io_target,
             !io_target.failed)
         {
 
-            err = tpmCmdPcrExtend(&io_target,
-                                  i_pcr,
-                                  i_algId,
-                                  i_digest,
-                                  i_digestSize);
+            // Perform the requested extension and also force into the
+            // SHA1 bank
+            err = tpmCmdPcrExtend2Hash(&io_target,
+                                       i_pcr,
+                                       i_algId,
+                                       i_digest,
+                                       i_digestSize,
+                                       TPM_ALG_SHA1,
+                                       i_digest,
+                                       i_digestSize);
         }
     } while ( 0 );
 
diff --git a/src/usr/secureboot/trusted/trustedbootCmds.C b/src/usr/secureboot/trusted/trustedbootCmds.C
index 1bc8b8945..f454aca73 100644
--- a/src/usr/secureboot/trusted/trustedbootCmds.C
+++ b/src/usr/secureboot/trusted/trustedbootCmds.C
@@ -725,66 +725,109 @@ errlHndl_t tpmCmdPcrExtend(TpmTarget * io_target,
                            const uint8_t* i_digest,
                            size_t  i_digestSize)
 {
+    return tpmCmdPcrExtend2Hash(io_target, i_pcr,
+                                i_algId, i_digest, i_digestSize,
+                                TPM_ALG_INVALID_ID, NULL, 0);
+}
+
+errlHndl_t tpmCmdPcrExtend2Hash(TpmTarget * io_target,
+                                TPM_Pcr i_pcr,
+                                TPM_Alg_Id i_algId_1,
+                                const uint8_t* i_digest_1,
+                                size_t  i_digestSize_1,
+                                TPM_Alg_Id i_algId_2,
+                                const uint8_t* i_digest_2,
+                                size_t  i_digestSize_2)
+{
     errlHndl_t err = NULL;
     uint8_t dataBuf[sizeof(TPM2_ExtendIn)];
     size_t dataSize = sizeof(dataBuf);
-    size_t fullDigestSize = 0;
+    size_t fullDigestSize_1 = 0;
+    size_t fullDigestSize_2 = 0;
     TPM2_BaseOut* resp = (TPM2_BaseOut*)dataBuf;
     TPM2_ExtendIn* cmd = (TPM2_ExtendIn*)dataBuf;
 
 
     TRACDCOMP( g_trac_trustedboot,
-               ">>tpmCmdPcrExtend()" );
-    TRACUCOMP( g_trac_trustedboot,
-               ">>tpmCmdPcrExtend() Pcr(%d) Alg(%X) DS(%d)",
-               i_pcr, i_algId, (int)i_digestSize);
+               ">>tpmCmdPcrExtend2Hash()" );
+    if (NULL == i_digest_2)
+    {
+        TRACUCOMP( g_trac_trustedboot,
+                   ">>tpmCmdPcrExtend2Hash() Pcr(%d) Alg(%X) DS(%d)",
+                   i_pcr, i_algId_1, (int)i_digestSize_1);
+    }
+    else
+    {
+        TRACUCOMP( g_trac_trustedboot,
+                   ">>tpmCmdPcrExtend2Hash() Pcr(%d) Alg(%X:%X) DS(%d:%d)",
+                   i_pcr, i_algId_1, i_algId_2,
+                   (int)i_digestSize_1, (int)i_digestSize_2);
+    }
 
     do
     {
 
-        fullDigestSize = getDigestSize(i_algId);
+        fullDigestSize_1 = getDigestSize(i_algId_1);
+        if (NULL != i_digest_2)
+        {
+            fullDigestSize_2 = getDigestSize(i_algId_2);
+        }
 
         // Build our command block
         memset(dataBuf, 0, sizeof(dataBuf));
 
         // Argument verification
-        if (fullDigestSize == 0 ||
-            NULL == i_digest ||
-            IMPLEMENTATION_PCR < i_pcr
+        if (fullDigestSize_1 == 0 ||
+            NULL == i_digest_1 ||
+            IMPLEMENTATION_PCR < i_pcr ||
+            (NULL != i_digest_2 && fullDigestSize_2 == 0)
             )
         {
             TRACFCOMP( g_trac_trustedboot,
-                       "TPM PCR EXTEND ARG FAILURE FDS(%d) DS(%d) PCR(%d)",
-                       (int)fullDigestSize, (int)i_digestSize, i_pcr);
+                       "TPM PCR EXTEND ARG FAILURE FDS(%d:%d) DS(%d:%d) "
+                       "PCR(%d)",
+                       (int)fullDigestSize_1, (int)fullDigestSize_2,
+                       (int)i_digestSize_1, (int)i_digestSize_2, i_pcr);
             /*@
              * @errortype
              * @reasoncode     RC_TPM_INVALID_ARGS
              * @severity       ERRL_SEV_UNRECOVERABLE
              * @moduleid       MOD_TPM_CMD_PCREXTEND
              * @userdata1      Digest Ptr
-             * @userdata2[0:31] Full Digest Size
+             * @userdata2[0:15] Full Digest Size 1
+             * @userdata2[16:31] Full Digest Size 2
              * @userdata2[32:63] PCR
              * @devdesc        Unmarshaling error detected
              */
             err = tpmCreateErrorLog(MOD_TPM_CMD_PCREXTEND,
                                     RC_TPM_INVALID_ARGS,
-                                    (uint64_t)i_digest,
-                                    (fullDigestSize << 32) |
+                                    (uint64_t)i_digest_1,
+                                    (fullDigestSize_1 << 48) |
+                                    (fullDigestSize_2 << 32) |
                                     i_pcr);
             break;
         }
 
         // Log the input PCR value
         TRACUBIN(g_trac_trustedboot, "PCR In",
-                 i_digest, fullDigestSize);
+                 i_digest_1, fullDigestSize_1);
 
         cmd->base.tag = TPM_ST_SESSIONS;
         cmd->base.commandCode = TPM_CC_PCR_Extend;
         cmd->pcrHandle = i_pcr;
         cmd->digests.count = 1;
-        cmd->digests.digests[0].algorithmId = i_algId;
-        memcpy(cmd->digests.digests[0].digest.bytes, i_digest,
-               (i_digestSize < fullDigestSize ? i_digestSize : fullDigestSize));
+        cmd->digests.digests[0].algorithmId = i_algId_1;
+        memcpy(&(cmd->digests.digests[0].digest), i_digest_1,
+               (i_digestSize_1 < fullDigestSize_1 ?
+                i_digestSize_1 : fullDigestSize_1) );
+        if (NULL != i_digest_2)
+        {
+            cmd->digests.count = 2;
+            cmd->digests.digests[1].algorithmId = i_algId_2;
+            memcpy(&(cmd->digests.digests[1].digest), i_digest_2,
+                   (i_digestSize_2 < fullDigestSize_2 ?
+                    i_digestSize_2 : fullDigestSize_2));
+        }
 
         err = tpmTransmitCommand(io_target,
                                  dataBuf,
diff --git a/src/usr/secureboot/trusted/trustedbootCmds.H b/src/usr/secureboot/trusted/trustedbootCmds.H
index ffabd3440..1f03eeb0e 100644
--- a/src/usr/secureboot/trusted/trustedbootCmds.H
+++ b/src/usr/secureboot/trusted/trustedbootCmds.H
@@ -129,6 +129,29 @@ errlHndl_t tpmCmdPcrExtend(TpmTarget * io_target,
                            size_t  i_digestSize);
 
 /**
+ * @brief Send the TPM_Extend command to the targeted TPM and log
+ * @param[in/out] io_target Current TPM target structure
+ * @param[in] i_pcr PCR to write to
+ * @param[in] i_algId_1 Algorithm to use
+ * @param[in] i_digest_1 Digest value to write to PCR, zeros appended as needed
+ * @param[in] i_digestSize_1 Byte size of i_digest_1 array
+ * @param[in] i_algId_2 Algorithm to use
+ * @param[in] i_digest_2 Digest value to write to PCR, zeros appended as needed
+ *                         NULL if second digest not used
+ * @param[in] i_digestSize_2 Byte size of i_digest_2 array
+ * @return errlHndl_t NULL if successful, otherwise a pointer to the
+ *       error log.
+ */
+errlHndl_t tpmCmdPcrExtend2Hash(TpmTarget * io_target,
+                                TPM_Pcr i_pcr,
+                                TPM_Alg_Id i_algId_1,
+                                const uint8_t* i_digest_1,
+                                size_t  i_digestSize_1,
+                                TPM_Alg_Id i_algId_2,
+                                const uint8_t* i_digest_2,
+                                size_t  i_digestSize_2);
+
+/**
  * @brief Send the TPM_Read command to the targeted TPM and log
  * @param[in/out] io_target Current TPM target structure
  * @param[in] i_pcr PCR to read from