tpm: Add v2 Tcg method for submitting raw TPM commands

Author: nicholasbishop

uefi-test-runner/src/proto/tcg.rs

@@ -157,6 +157,63 @@ fn test_tcg_v1(bt: &BootServices) {
     assert_eq!(event_last, event);
 }
 
+/// Get the SHA-1 digest stored in the given PCR index.
+fn tcg_v2_read_pcr_8(tcg: &mut v2::Tcg) -> v1::Sha1Digest {
+    // Input command block.
+    #[rustfmt::skip]
+    let input = [
+        // tag: TPM_ST_NO_SESSIONS
+        0x80, 0x01,
+        // commandSize
+        0x00, 0x00, 0x00, 0x14,
+        // commandCode: TPM_CC_PCR_Read
+        0x00, 0x00, 0x01, 0x7e,
+
+        // pcrSelectionIn.count: 1
+        0x00, 0x00, 0x00, 0x01,
+        // pcrSelectionIn.pcrSelections[0].hash: SHA-1
+        0x00, 0x04,
+        // pcrSelectionIn.pcrSelections[0].sizeofSelect: 3 bytes
+        0x03,
+        // pcrSelectionIn.pcrSelections[0].pcrSelect: bitmask array
+        // PCR 0-7: don't select
+        0x00,
+        // PCR 8-15: select only PCR 8
+        0x01,
+        // PCR 16-23: don't select
+        0x00,
+    ];
+
+    let mut output = [0; 50];
+    tcg.submit_command(&input, &mut output)
+        .expect("failed to get PCR value");
+
+    // tag: TPM_ST_NO_SESSIONS
+    assert_eq!(output[0..2], [0x80, 0x01]);
+    // responseSize
+    assert_eq!(output[2..6], [0x00, 0x00, 0x00, 0x32]);
+    // responseCode: TPM_RC_SUCCESS
+    assert_eq!(output[6..10], [0x00, 0x00, 0x00, 0x00]);
+    // Bytes 10..14 are the TPM update counter, ignore.
+
+    // pcrSelectionIn.count: 1
+    assert_eq!(output[14..18], [0x00, 0x00, 0x00, 0x01]);
+    // pcrSelectionIn.pcrSelections[0].hash: SHA-1
+    assert_eq!(output[18..20], [0x00, 0x04]);
+    // pcrSelectionIn.pcrSelections[0].sizeofSelect: 3 bytes
+    assert_eq!(output[20], 0x03);
+    // pcrSelectionIn.pcrSelections[0].pcrSelect: bitmap selecting PCR 8
+    assert_eq!(output[21..24], [0x00, 0x01, 0x00]);
+
+    // pcrValues.count: 1
+    assert_eq!(output[24..28], [0x00, 0x00, 0x00, 0x01]);
+    // pcrValues.digests[0].size: 20 bytes
+    assert_eq!(output[28..30], [0x00, 0x14]);
+
+    // The rest of the output is the SHA-1 digest.
+    output[30..].try_into().unwrap()
+}
+
 pub fn test_tcg_v2(bt: &BootServices) {
     info!("Running TCG v2 test");
 
@@ -216,6 +273,9 @@ pub fn test_tcg_v2(bt: &BootServices) {
         .get_result_of_set_active_pcr_banks()
         .expect("get_result_of_set_active_pcr_banks failed")
         .is_none());
+
+    // PCR 8 is initially zero.
+    assert_eq!(tcg_v2_read_pcr_8(&mut tcg), [0; 20]);
 }
 
 pub fn test(bt: &BootServices) {

uefi/src/proto/tcg/v2.rs

@@ -13,7 +13,7 @@
 use super::HashAlgorithm;
 use crate::data_types::PhysicalAddress;
 use crate::proto::unsafe_protocol;
-use crate::{Result, Status};
+use crate::{Error, Result, Status};
 use bitflags::bitflags;
 use core::mem;
 
@@ -191,6 +191,37 @@ impl Tcg {
         unsafe { (self.get_capability)(self, &mut capability).into_with_val(|| capability) }
     }
 
+    /// Send a command directly to the TPM.
+    ///
+    /// Constructing the input block and parsing the output block are outside
+    /// the scope of this crate. See the [TPM 2.0 Specification][spec], in
+    /// particular Part 2 (Structures) and Part 3 (Commands).
+    ///
+    /// Note that TPM structures are big endian.
+    ///
+    /// [spec]: https://trustedcomputinggroup.org/resource/tpm-library-specification/
+    pub fn submit_command(
+        &mut self,
+        input_parameter_block: &[u8],
+        output_parameter_block: &mut [u8],
+    ) -> Result {
+        let input_parameter_block_len = u32::try_from(input_parameter_block.len())
+            .map_err(|_| Error::from(Status::BAD_BUFFER_SIZE))?;
+        let output_parameter_block_len = u32::try_from(output_parameter_block.len())
+            .map_err(|_| Error::from(Status::BAD_BUFFER_SIZE))?;
+
+        unsafe {
+            (self.submit_command)(
+                self,
+                input_parameter_block_len,
+                input_parameter_block.as_ptr(),
+                output_parameter_block_len,
+                output_parameter_block.as_mut_ptr(),
+            )
+            .into()
+        }
+    }
+
     /// Get a bitmap of the active PCR banks. Each bank corresponds to a hash
     /// algorithm.
     pub fn get_active_pcr_banks(&mut self) -> Result<HashAlgorithm> {