feat(esapi): add missing TPM commands in integrity_collection_pcr by hyperfinitism · Pull Request #650 · parallaxsecond/rust-tss-esapi

hyperfinitism · 2026-05-28T18:43:06Z

This pull request implements the following Esys wrapper the following wrapper functions with integration tests for these commands:

pcr_event (ESAPI spec 11.3.52)
pcr_allocate (11.3.54)
pcr_set_auth_policy (11.3.55)
pcr_set_auth_value (11.3.56)

These were extracted from #625.

Limitation

swtpm (libtpms) does not support PCR_SetAuthPolicy or PCR_SetAuthValue; these commands always return TPM_RC_VALUE. So their integration tests are marked #[ignore], and their doc examples are marked no_run.

Reference: https://github.com/stefanberger/libtpms/blob/521c51073fe6f7c56023db78e56961fcaf7906e8/src/tpm2/TPMCmd/Platform/src/PlatformPcr.c

Copilot

Pull request overview

This PR adds missing ESAPI command wrappers in the integrity_collection_pcr command set, and extends the integration test suite to exercise the new wrappers (with the known swtpm/libtpms limitations handled via #[ignore] and no_run examples).

Changes:

Added Context wrappers for PCR_Event, PCR_Allocate, PCR_SetAuthPolicy, and PCR_SetAuthValue in integrity_collection_pcr.
Added integration tests for the new wrappers; tests for PCR_SetAuthPolicy / PCR_SetAuthValue are ignored due to swtpm/libtpms behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
`tss-esapi/src/context/tpm_commands/integrity_collection_pcr.rs`	Adds the four missing PCR-related ESAPI wrappers and rustdoc examples (with `no_run` where applicable).
`tss-esapi/tests/integration_tests/context_tests/tpm_commands/integrity_collection_pcr_tests.rs`	Adds integration tests for the new PCR wrapper methods (with `#[ignore]` for commands unsupported by `swtpm`).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

hyperfinitism · 2026-05-31T10:47:32Z

+    use crate::common::create_ctx_with_session;
+    use tss_esapi::{handles::PcrHandle, structures::MaxBuffer};
+
+    #[test]
+    fn test_pcr_event() {
+        let mut context = create_ctx_with_session();
+        let data = MaxBuffer::from_bytes(&[0x01, 0x02, 0x03, 0x04]).unwrap();
+        context.pcr_event(PcrHandle::Pcr16, data).unwrap();
+    }


To implement the suggested check, we must add a public getter to the DigestValues struct as DigestList does.

To implement the suggested check, we must add a public getter to the DigestValues struct as DigestList does.

Sounds like a good idea

Addressed. Added public getter value() to DigestValues and implemented hash value check.

ionut-arm

Thanks! A few comments below

ionut-arm · 2026-06-09T08:10:36Z

+            size: event_data_bytes.len() as u16,
+            ..Default::default()
+        };
+        event.buffer[..event_data_bytes.len()].copy_from_slice(event_data_bytes);


TPM2B_EVENT isn't guaranteed to be big enough for this (fixed at 1024, whereas MaxBuffer may be bigger). Any chance you can create a new native struct for EVENT and take that as a param instead?

Addressed. Added the structures::Event buffer type for TPM2B_EVENT.

ionut-arm · 2026-06-09T17:08:12Z

+        &mut self,
+        auth_handle: AuthHandle,
+        pcr_allocation: PcrSelectionList,
+    ) -> Result<(bool, u32, u32, u32)> {


I think it's fairly unusual for us to return a tuple of primitives like that - seems like a simple struct that just holds these details would be a good way to make the result easier to consume.

Addressed. Added PcrAllocateResult type.

ionut-arm · 2026-06-09T17:21:18Z

-    // Missing function: _TPM_Hash_Start
-    // Missing function: _TPM_Hash_Data
-    // Missing function: _TPM_Hash_End
+    // Missing function: _TPM_Hash_Start (platform-level indication, not an ESAPI command)


Good catch, please just remove these lines in this case.

ionut-arm · 2026-06-09T17:22:28Z

+    use crate::common::create_ctx_with_session;
+    use tss_esapi::{handles::PcrHandle, structures::MaxBuffer};
+
+    #[test]
+    fn test_pcr_event() {
+        let mut context = create_ctx_with_session();
+        let data = MaxBuffer::from_bytes(&[0x01, 0x02, 0x03, 0x04]).unwrap();
+        context.pcr_event(PcrHandle::Pcr16, data).unwrap();
+    }


To implement the suggested check, we must add a public getter to the DigestValues struct as DigestList does.

Sounds like a good idea

Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>

Added the following wrapper functions with integration tests for these commands: - pcr_event (ESAPI spec 11.3.52) - pcr_allocate (11.3.54) - pcr_set_auth_policy (11.3.55) - pcr_set_auth_value (11.3.56) To make implementation of pcr_allocate clean, added return type PcrAllocateResult. swtpm (libtpms) does not support PCR_SetAuthPolicy or PCR_SetAuthValue; these commands return TPM_RC_VALUE. So their integration tests are marked #[ignore], and their doc examples are marked no_run. Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>

hyperfinitism · 2026-06-12T13:21:15Z

Thank you for your detailed review and suggestions. I have made the necessary changes.

ionut-arm requested a review from Copilot May 29, 2026 22:43

Copilot started reviewing on behalf of ionut-arm May 29, 2026 22:43 View session

Copilot AI reviewed May 29, 2026

View reviewed changes

hyperfinitism force-pushed the feature/icpcr-commands branch from 4393abd to 2b6768e Compare May 31, 2026 10:40

ionut-arm reviewed Jun 9, 2026

View reviewed changes

feat(esapi): add Event buffer type for TPM2B_EVENT

504e678

Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>

hyperfinitism force-pushed the feature/icpcr-commands branch from 2b6768e to 3011095 Compare June 12, 2026 12:21

feat(esapi): add public getter to DigestValues

19f991b

Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>

hyperfinitism force-pushed the feature/icpcr-commands branch from 3011095 to 8317e1c Compare June 12, 2026 12:50

hyperfinitism force-pushed the feature/icpcr-commands branch from 8317e1c to 1a21adc Compare June 12, 2026 13:17

Conversation

hyperfinitism commented May 28, 2026

Limitation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ionut-arm left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hyperfinitism commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants