diff --git a/board-qemu/slof/vio-vtpm-cdriver.fs b/board-qemu/slof/vio-vtpm-cdriver.fs
index de69e2d..0699c4d 100644
--- a/board-qemu/slof/vio-vtpm-cdriver.fs
+++ b/board-qemu/slof/vio-vtpm-cdriver.fs
@@ -122,6 +122,14 @@ false VALUE vtpm-debug?
     THEN
 ;
 
+\ firmware API call
+: pass-through-to-tpm ( buf-addr buf-size -- response-size )
+    " pass-through-to-tpm" vtpm-call-forward IF
+        2drop
+        0
+    THEN
+;
+
 \ firmware API call
 : get-maximum-cmd-size ( -- maximum-size )
     " get-maximum-cmd-size" vtpm-call-forward IF
diff --git a/board-qemu/slof/vtpm-sml.fs b/board-qemu/slof/vtpm-sml.fs
index bf0d55e..c51765b 100644
--- a/board-qemu/slof/vtpm-sml.fs
+++ b/board-qemu/slof/vtpm-sml.fs
@@ -94,6 +94,16 @@ log-base LOG-SIZE tpm-set-log-parameters
     THEN
 ;
 
+: pass-through-to-tpm ( buf-addr cmd-size -- rsp-size )
+    vtpm-debug? IF
+        ." Call to pass-through-to-tpm" cr
+    THEN
+    tpm-pass-through-to-tpm                        ( rsp-size )
+    vtpm-debug? IF
+        ." VTPM: Return value from tpm-pass-through-to-tpm: " dup . cr
+    THEN
+;
+
 \
 \ internal API calls
 \
diff --git a/lib/libtpm/tcgbios.c b/lib/libtpm/tcgbios.c
index 9114d64..38fa545 100644
--- a/lib/libtpm/tcgbios.c
+++ b/lib/libtpm/tcgbios.c
@@ -837,3 +837,55 @@ uint32_t tpm_get_maximum_cmd_size(void)
 	return  MIN(cpu_to_be32(trgb.buffersize),
 	            spapr_vtpm_get_buffersize());
 }
+
+static bool pass_through_to_tpm(unsigned char *req,
+				uint32_t reqlen,
+				enum tpm_duration_type to_t,
+				unsigned char *rsp,
+				uint32_t *rsplen)
+{
+	struct tpm_req_header *trqh;
+	int ret;
+
+	if (!tpm_is_working())
+	       return TCGBIOS_FATAL_COM_ERROR;
+
+	trqh = (struct tpm_req_header *)req;
+	if (reqlen < sizeof(*trqh))
+		return TCGBIOS_INVALID_INPUT_PARA;
+
+	ret = tpmhw_transmit(0, trqh, rsp, rsplen, to_t);
+	if (ret)
+		return TCGBIOS_FATAL_COM_ERROR;
+
+	return 0;
+}
+
+/*
+ * tpm_pass_through_to_tpm: Function for interfacing with the firmware API
+ *
+ * buf: buffer holding the command; also used for holding the entire response
+ * cmdlen: length of the command in the buffer
+ *
+ * Returns 0 in case of failure, the size of the response otherwise.
+ */
+uint32_t tpm_pass_through_to_tpm(unsigned char *buf, uint32_t cmdlen)
+{
+	uint32_t resplen = PAPR_VTPM_MAX_BUFFER_SIZE;
+
+	/*
+	 * API spec: caller must ensure that the buffer is large
+	 *           enough to receive the full response into
+	 *           the same buffer where the command is in.
+	 *           We anticipate the largest possible buffer
+	 *           the driver supports in 'resplen'.
+	 * For duration we use the worst-case timeout 'LONG'
+	 * so that any command can be sent and will not time out.
+	 */
+	if (pass_through_to_tpm(buf, cmdlen,
+				TPM_DURATION_TYPE_LONG,
+				buf, &resplen))
+		return 0;
+
+	return resplen;
+}
diff --git a/lib/libtpm/tcgbios.h b/lib/libtpm/tcgbios.h
index 6eb6751..5beaa53 100644
--- a/lib/libtpm/tcgbios.h
+++ b/lib/libtpm/tcgbios.h
@@ -35,6 +35,7 @@ uint32_t tpm_measure_bcv_mbr(uint32_t bootdrv, const uint8_t *addr,
 uint32_t tpm_add_event_separators(uint32_t start_pcr, uint32_t end_pcr);
 uint32_t tpm_process_opcode(uint8_t op, bool verbose);
 uint32_t tpm_get_maximum_cmd_size(void);
+uint32_t tpm_pass_through_to_tpm(unsigned char *buf, uint32_t cmdlen);
 
 /* flags returned by tpm_get_state */
 #define TPM_STATE_ENABLED        1
diff --git a/lib/libtpm/tpm.code b/lib/libtpm/tpm.code
index ecfba8c..adf1f01 100644
--- a/lib/libtpm/tpm.code
+++ b/lib/libtpm/tpm.code
@@ -172,3 +172,14 @@ PRIM(tpm_X2d_get_X2d_maximum_X2d_cmd_X2d_size)
 	PUSH;
 	TOS.n = tpm_get_maximum_cmd_size();
 MIRP
+
+/*******************************************************************/
+/* Firmware API                                                    */
+/* SLOF:   tpm-pass-through-to-tpm (buf-addr cmd-size -- rsp-size) */
+/* LIBTPM: respsize = tpm_pass_through_to_tpm(buf, cmdsize)        */
+/*******************************************************************/
+PRIM(tpm_X2d_pass_X2d_through_X2d_to_X2d_tpm)
+	int cmdsize = TOS.n; POP;
+	void *buf = TOS.a;
+	TOS.n = tpm_pass_through_to_tpm(buf, cmdsize);
+MIRP
diff --git a/lib/libtpm/tpm.in b/lib/libtpm/tpm.in
index 1bd393e..f0c92e2 100644
--- a/lib/libtpm/tpm.in
+++ b/lib/libtpm/tpm.in
@@ -28,3 +28,4 @@ cod(tpm-get-state)
 cod(tpm-is-working)
 cod(tpm-measure-scrtm)
 cod(tpm-get-maximum-cmd-size)
+cod(tpm-pass-through-to-tpm)
diff --git a/lib/libtpm/tpm_drivers.h b/lib/libtpm/tpm_drivers.h
index ab2e152..96bd32d 100644
--- a/lib/libtpm/tpm_drivers.h
+++ b/lib/libtpm/tpm_drivers.h
@@ -70,6 +70,9 @@ typedef enum {
 	VTPM_DRV_ERROR_SML_HANDED_OVER = 14,
 } vtpm_drv_error;
 
+/* the max. buffer size by the external TPM is 4k */
+#define PAPR_VTPM_MAX_BUFFER_SIZE       4096
+
 /* exported functions */
 bool spapr_is_vtpm_present(void);
 void spapr_vtpm_finalize(void);
