-
Notifications
You must be signed in to change notification settings - Fork 97
/
node_comm_exchange.C
1805 lines (1603 loc) · 67.7 KB
/
node_comm_exchange.C
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/* IBM_PROLOG_BEGIN_TAG */
/* This is an automatically generated prolog. */
/* */
/* $Source: src/usr/secureboot/node_comm/node_comm_exchange.C $ */
/* */
/* OpenPOWER HostBoot Project */
/* */
/* Contributors Listed Below - COPYRIGHT 2018,2019 */
/* [+] International Business Machines Corp. */
/* */
/* */
/* Licensed under the Apache License, Version 2.0 (the "License"); */
/* you may not use this file except in compliance with the License. */
/* You may obtain a copy of the License at */
/* */
/* http://www.apache.org/licenses/LICENSE-2.0 */
/* */
/* Unless required by applicable law or agreed to in writing, software */
/* distributed under the License is distributed on an "AS IS" BASIS, */
/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or */
/* implied. See the License for the specific language governing */
/* permissions and limitations under the License. */
/* */
/* IBM_PROLOG_END_TAG */
/**
* @file node_comm_exchange.C
*
* @brief Runs the procedure for the drawers/nodes to exchange messages
* over the ABUS Link Mailbox facility
*
*/
// ----------------------------------------------
// Includes
// ----------------------------------------------
#include <string.h>
#include <algorithm>
#include <trace/interface.H>
#include <errl/errlentry.H>
#include <errl/errlmanager.H>
#include <errl/errludtarget.H>
#include <errl/errludstring.H>
#include <targeting/common/targetservice.H>
#include <devicefw/userif.H>
#include <devicefw/driverif.H>
#include <secureboot/secure_reasoncodes.H>
#include <secureboot/nodecommif.H>
#include <secureboot/trustedbootif.H>
#include <targeting/common/commontargeting.H>
#include <targeting/common/utilFilter.H>
#include <targeting/targplatutil.H>
#include <sys/internode.h>
#include <util/misc.H>
#include <config.h>
#include "node_comm.H"
#include "node_comm_transfer.H"
#include <secureboot/service.H>
#include <securerom/contrib/sha512.H>
#include "../trusted/trustedTypes.H"
#include "../trusted/tpmLogMgr.H"
// ----------------------------------------------
// Defines
// ----------------------------------------------
// Use if there is an issue getting random number from a functional TPM
#define NODE_COMM_DEFAULT_NONCE 0xFFFFFFFFFFFFFFFF
using namespace TARGETING;
namespace SECUREBOOT
{
namespace NODECOMM
{
/*
* Struct used to collect data about current node's master proc and other info
*/
struct master_proc_info_t
{
TARGETING::Target* tgt = nullptr;
uint8_t procInstance = 0;
uint8_t nodeInstance = 0;
};
/*
* Struct used to hold data about obus instances
*/
struct obus_instances_t
{
uint8_t myObusInstance = 0;
uint8_t myObusRelLink = 0;
// Expect data to be received on the PEER_PATH instances
uint8_t peerNodeInstance = 0;
uint8_t peerProcInstance = 0;
uint8_t peerObusInstance = 0;
};
/*
* Union used to hold the 3-tuple of information passed between the nodes -
* master node to every sibling node, and all those sibling nodes
* back to the master node
*/
union msg_format_t
{
uint64_t value;
struct
{
uint64_t origin_linkId : 4; // relative to the originator
uint64_t receiver_linkId : 4; // relative to the receiver
uint64_t nonce : 56; // a cryptographically strong random
// nummber requested from the TPM
} PACKED;
};
/**
* @brief This function generates a nonce by calling GetRandom on an
* available TPM.
*
* @param[out] o_nonce - The nonce that is generated
* @note Nonce is only valid if the operation is successful
*
* @return errlHndl_t Error log handle
* @retval nullptr Operation was successful
* @retval !nullptr Operation failed with valid error log
*/
errlHndl_t nodeCommAbusGetRandom(uint64_t & o_nonce)
{
errlHndl_t err = nullptr;
o_nonce = NODE_COMM_DEFAULT_NONCE;
#ifdef CONFIG_TPMDD
Target* tpm_tgt = nullptr;
TRACUCOMP(g_trac_nc,ENTER_MRK"nodeCommAbusGetRandom:");
do
{
// Can only use the functional Primary TPM
// This function call requires the CONFIG check for compilation purposes,
// but no extra error handling is needed as it should not have gotten this
// far if CONFIG_TPMDD wasn't set
TRUSTEDBOOT::getPrimaryTpm(tpm_tgt);
HwasState hwasState{};
if(tpm_tgt)
{
hwasState = tpm_tgt->getAttr<TARGETING::ATTR_HWAS_STATE>();
TRACUCOMP(g_trac_nc,INFO_MRK
"TPM HUID 0x%08X has state of {present=%d, "
"functional=%d}",
get_huid(tpm_tgt),
hwasState.present,hwasState.functional);
}
if ((tpm_tgt == nullptr) ||
(hwasState.functional == false))
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommAbusGetRandom: no functional "
"Primary TPM: huid=0x%.08X: functional=%d",
get_huid(tpm_tgt), hwasState.functional);
/*@
* @errortype
* @reasoncode RC_NCEX_NO_FUNCTIONAL_PRIMARY_TPM
* @moduleid MOD_NCEX_GET_RANDOM
* @userdata1 TPM Target HUID
* @userdata2[0:31] TPM Target HWAS State Present
* @userdata2[31:63] TPM Target HWAS State Functional
* @devdesc Functional Primary TPM was not found
* @custdesc Trusted Boot failure
*/
err = new ERRORLOG::ErrlEntry( ERRORLOG::ERRL_SEV_PREDICTIVE,
MOD_NCEX_GET_RANDOM,
RC_NCEX_NO_FUNCTIONAL_PRIMARY_TPM,
get_huid(tpm_tgt),
TWO_UINT32_TO_UINT64(
hwasState.present,
hwasState.functional),
ERRORLOG::ErrlEntry::ADD_SW_CALLOUT );
// break here to skip calling GetRandom() below
break;
}
// This function call requires the CONFIG check for compilation purposes,
// but no extra error handling is needed as it should not have gotten this
// far if CONFIG_TPMDD wasn't set
err = TRUSTEDBOOT::GetRandom(tpm_tgt,
sizeof(o_nonce),
reinterpret_cast<uint8_t*>(&o_nonce));
if (err)
{
// Reset just to make sure above call didn't change it
o_nonce = NODE_COMM_DEFAULT_NONCE;
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommAbusGetRandom: GetRandom "
"returned a fail for TPM 0x%.08X. Commiting err: "
TRACE_ERR_FMT
". Using default nonce=0x%.16llX",
get_huid(tpm_tgt),
TRACE_ERR_ARGS(err),
o_nonce);
// break to be safe in case code gets added later
break;
}
} while( 0 );
if(err)
{
if(!TRUSTEDBOOT::isTpmRequired())
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommAbusGetRandom: Error occurred; "
"RC: 0x%.04X; PLID: 0x%.08X. TPM Required policy is off; "
"deleting the error and trying to continue.",
err->reasonCode(),
err->plid());
// TPM is not required - do not return the error
delete err;
err = nullptr;
}
else
{
err->collectTrace(TRBOOT_COMP_NAME);
err->collectTrace(NODECOMM_TRACE_NAME);
}
}
TRACFCOMP(g_trac_nc,EXIT_MRK"nodeCommAbusGetRandom: "
"nonce=0x%.16llX from TPM=0x%.08X. "
TRACE_ERR_FMT,
o_nonce, get_huid(tpm_tgt),
TRACE_ERR_ARGS(err));
#endif
return err;
} // end of nodeCommAbusGetRandom
/**
* @brief This function logs a nonce to all available TPMs on the node by
* extending it to a specific PCR.
*
* @param[in] i_nonce - The nonce to be logged/extended
*
* @return errlHndl_t Error log handle
* @retval nullptr Operation was successful
* @retval !nullptr Operation failed with valid error log
*/
errlHndl_t nodeCommAbusLogNonce(uint64_t & i_nonce)
{
errlHndl_t err = nullptr;
TRACUCOMP(g_trac_nc,ENTER_MRK"nodeCommAbusLogNonce: i_nonce=0x%.16llX",
i_nonce);
do
{
// Extend the nonce asychronously to all available TPMs
uint8_t l_digest[sizeof(i_nonce)]={0};
memcpy(l_digest, &i_nonce, sizeof(i_nonce));
uint8_t l_logMsg[] = "Node Nonce";
err = TRUSTEDBOOT::pcrExtend(TRUSTEDBOOT::PCR_1,
TRUSTEDBOOT::EV_PLATFORM_CONFIG_FLAGS,
l_digest,
sizeof(uint64_t),
l_logMsg,
sizeof(l_logMsg));
if (err)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommAbusLogNonce: pcrExtend "
"returned a fail: "
TRACE_ERR_FMT,
TRACE_ERR_ARGS(err));
}
} while( 0 );
TRACFCOMP(g_trac_nc,EXIT_MRK"nodeCommAbusLogNonce: i_nonce=0x%.16llX. "
TRACE_ERR_FMT,
i_nonce,
TRACE_ERR_ARGS(err));
return err;
} // end of nodeCommAbusLogNonce
/**
* @brief A function to create the slave node quote response that consists of
* eye catcher, slave node ID, quote and signature data (represented by
* the QuoteDataOut structure), the contents of PCRs 0-7, the
* Attestation Key Certificate returned from TPM, the size
* and the contents of the TPM log
* @param[in] i_request the master node request structure
* @param[out] o_size the size of the slave quote
* @param[out] o_resp the slave quote in binary format
* @note Assuming CONFIG_TPMDD is compiled in, o_resp is always allocated
* dynamically in this function, and it is the responsibility of the
* calller to delete it after the function returns. If an error occurs
* within the function, the o_resp will only have an eye catcher
* indicating that the slave quote is bad.
* @return nullptr on success; non-nullptr on error
*/
errlHndl_t nodeCommGenSlaveQuoteResponse(const MasterQuoteRequestBlob* const i_request,
size_t& o_size,
uint8_t*& o_resp)
{
errlHndl_t l_errl = nullptr;
#ifdef CONFIG_TPMDD
TRACFCOMP(g_trac_nc, ENTER_MRK"nodeCommGenSlaveQuoteResponse");
bool l_tpmRequired = TRUSTEDBOOT::isTpmRequired();
bool l_errorOccurred = false;
TRUSTEDBOOT::QuoteDataOut l_quoteData;
uint32_t l_nodeId = TARGETING::UTIL::getCurrentNodePhysId();
do {
o_resp = nullptr;
TARGETING::Target* l_primaryTpm = nullptr;
TRUSTEDBOOT::getPrimaryTpm(l_primaryTpm);
if(!l_primaryTpm ||
!l_primaryTpm->getAttr<TARGETING::ATTR_HWAS_STATE>().functional ||
!l_primaryTpm->getAttr<TARGETING::ATTR_HWAS_STATE>().present)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenSlaveQuoteResponse: primary TPM not found or not functional");
l_errorOccurred = true;
break;
}
// If Master indicated that there is an issue with its TPM: Case 1: If the
// TPM Required policy is on, terminate the boot; Case 2: If TPM required
// policy is off, send back a token indicating that no nodecomm TPM commands
// have been performed (remote attestation is not possible with bad master
// TPM); do not fail the boot.
if(i_request->EyeCatcher == MSTNOTPM)
{
l_errorOccurred = true;
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenSlaveQuoteResponse: Master indicated an issue with secure nodecomm (master eye catcher is MSTNOTPM)");
// Case 1
if(l_tpmRequired)
{
/* @
* @errortype
* @reasoncode RC_NC_BAD_MASTER_TPM
* @moduleid MOD_NC_GEN_SLAVE_RESPONSE
* @userdata1 <unused>
* @userdata2 <unused>
* @devdesc The system policy is set to not allow boot without a
* functioning TPM, but the system's master node
* indicated that its TPM is compromised. This slave
* node must terminate the boot process.
* @custdesc Trustedboot failure
*/
l_errl = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_UNRECOVERABLE,
MOD_NC_GEN_SLAVE_RESPONSE,
RC_NC_BAD_MASTER_TPM);
// It is unlikely that there is an issue with this node, but collect
// the logs anyway for ease of debug.
l_errl->collectTrace(SECURE_COMP_NAME);
l_errl->collectTrace(TRBOOT_COMP_NAME);
l_errl->collectTrace(NODECOMM_TRACE_NAME);
break;
}
// Case 2
// The error condition will be handled below in the if branch that
// checks l_errorOccurred
}
else if(i_request->EyeCatcher != MASTERQ_)
{
l_errorOccurred = true;
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenSlaveQuoteResponse: Invalid master eye catcher received: 0x%x", i_request->EyeCatcher);
if(l_tpmRequired)
{
/* @
* @errortype
* @reasoncode RC_NC_BAD_MASTER_EYE_CATCH
* @moduleid MOD_NC_GEN_SLAVE_RESPONSE
* @userdata1 Eye catcher received from master
* @devdesc Master node sent an unrecognized eye catcher
* @custdesc Trustedboot failure
*/
l_errl = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_UNRECOVERABLE,
MOD_NC_GEN_SLAVE_RESPONSE,
RC_NC_BAD_MASTER_EYE_CATCH,
i_request->EyeCatcher);
// It is unlikely that there is an issue with this node, but collect
// the logs anyway for ease of debug.
l_errl->collectTrace(NODECOMM_TRACE_NAME);
l_errl->collectTrace(TRBOOT_COMP_NAME);
l_errl->collectTrace(SECURE_COMP_NAME);
}
break;
}
// Step 1: Recreate node Attestation Key (AK)
l_errl = TRUSTEDBOOT::createAttestationKeys(l_primaryTpm);
if(l_errl)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenSlaveQuoteResponse: could not create attestation keys");
break;
}
TRUSTEDBOOT::TPM2B_MAX_NV_BUFFER l_AKCert;
// Step 2: Read the AK Certificate
l_errl = TRUSTEDBOOT::readAKCertificate(l_primaryTpm, &l_AKCert);
if(l_errl)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenSlaveQuoteResponse: could not read AK certificate");
break;
}
// Hash the AK Certificate and extend the hash into PCR1
SHA512_t l_AKCertHash = {0};
hashBlob(l_AKCert.buffer,
sizeof(l_AKCert.buffer),
l_AKCertHash);
l_errl = TRUSTEDBOOT::pcrExtend(TRUSTEDBOOT::PCR_1,
TRUSTEDBOOT::EV_PLATFORM_CONFIG_FLAGS,
l_AKCertHash,
sizeof(l_AKCertHash),
l_AKCert.buffer,
sizeof(l_AKCert.buffer));
if(l_errl)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenSlaveQuoteResponse: could not extend AK Certificate hash to TPM");
break;
}
l_quoteData.data = new uint8_t[1 * KILOBYTE]{};// the actual data size will
// be smaller than 1KB
// Step 3: Generate quote and signature data (presented as binary data in
// the QuoteDataOut structure)
l_errl = TRUSTEDBOOT::generateQuote(l_primaryTpm,
&i_request->MasterNonce,
&l_quoteData);
if(l_errl)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenSlaveQuoteResponse: could not generate TPM quote");
break;
}
// Step 4: Flush the AK from the TPM
l_errl = TRUSTEDBOOT::flushContext(l_primaryTpm);
if(l_errl)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenSlaveQuoteResponse: could not flush TPM context");
break;
}
// Step 5: Read the selected PCRs
// Make sure there is only 1 algo selection
assert(i_request->PcrSelect.count == 1, "nodeCommGenSlaveQuoteResponse: only 1 hash algo is supported for PCR read");
uint32_t l_pcrCount = 0;
TRUSTEDBOOT::TPM_Pcr l_pcrRegs[TRUSTEDBOOT::FW_USED_PCR_COUNT] = {
TRUSTEDBOOT::PCR_0,
TRUSTEDBOOT::PCR_1,
TRUSTEDBOOT::PCR_2,
TRUSTEDBOOT::PCR_3,
TRUSTEDBOOT::PCR_4,
TRUSTEDBOOT::PCR_5,
TRUSTEDBOOT::PCR_6,
TRUSTEDBOOT::PCR_7
};
TRUSTEDBOOT::TPM_Alg_Id l_algId = static_cast<TRUSTEDBOOT::TPM_Alg_Id>
(i_request->PcrSelect.pcrSelections[0].algorithmId);
size_t l_digestSize = TRUSTEDBOOT::getDigestSize(l_algId);
// An array of PCR Digest structures to hold the contents of the selected
// PCRs
TRUSTEDBOOT::TPM2B_DIGEST l_pcrDigests[TRUSTEDBOOT::FW_USED_PCR_COUNT] {};
// Iterate through PCRs that hostboot interacts with (PCR0-7) and see
// if any of those were seleceted; read the selected ones
for(const auto l_pcr : l_pcrRegs)
{
if((i_request->PcrSelect.pcrSelections[0]
.pcrSelect[l_pcr/TRUSTEDBOOT::FW_USED_PCR_COUNT]) &
(0x01 << (l_pcr % TRUSTEDBOOT::FW_USED_PCR_COUNT)))
{
++l_pcrCount;
l_pcrDigests[l_pcr].size = l_digestSize;
l_errl = TRUSTEDBOOT::pcrRead(l_primaryTpm,
l_pcr,
l_algId,
l_digestSize,
l_pcrDigests[l_pcr].buffer);
if(l_errl)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenSlaveQuoteResponse: could not read PCR%d", l_pcr);
break;
}
}
}
if(l_errl)
{
break;
}
// Step 6: Read out the primary TPM's Log and copy it into the quote
TRUSTEDBOOT::TpmLogMgr* l_primaryLogMgr =
TRUSTEDBOOT::getTpmLogMgr(l_primaryTpm);
if(!l_primaryLogMgr)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenSlaveQuoteResponse: could not fetch primary TPM's log");
/*@
* @errortype
* @reasoncode RC_NC_NO_PRIMARY_TPM_LOG
* @moduleid MOD_NC_GEN_SLAVE_RESPONSE
* @userdata1 Primary TPM HUID
* @devdesc Could not fetch primary TPM's Log
* @custdes Trustedboot failure
*/
l_errl = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_UNRECOVERABLE,
MOD_NC_GEN_SLAVE_RESPONSE,
RC_NC_NO_PRIMARY_TPM_LOG,
get_huid(l_primaryTpm));
l_errl->collectTrace(NODECOMM_TRACE_NAME);
l_errl->collectTrace(SECURE_COMP_NAME);
l_errl->collectTrace(TRBOOT_COMP_NAME);
break;
}
uint32_t l_logSize = TRUSTEDBOOT::TpmLogMgr_getLogSize(l_primaryLogMgr);
const uint8_t* l_logPtr =
TRUSTEDBOOT::TpmLogMgr_getLogStartPtr(l_primaryLogMgr);
NCEyeCatcher_t l_goodEyeCatch = NODEQUOT;
// Figure out the size of the slave quote
o_size = sizeof(l_goodEyeCatch) +
sizeof(l_nodeId) +
sizeof(l_quoteData.size) +
l_quoteData.size +
sizeof(l_pcrCount) +
// Only include the read PCRs in the slave quote
sizeof(TRUSTEDBOOT::TPM2B_DIGEST) * l_pcrCount +
sizeof(l_AKCert) +
sizeof(l_logSize) +
l_logSize;
// Allocate the output
o_resp = new uint8_t[o_size] {};
// Now populate the output
size_t l_currentOffset = 0;
// First the good eye catcher
memcpy(o_resp, &l_goodEyeCatch, sizeof(l_goodEyeCatch));
l_currentOffset += sizeof(l_goodEyeCatch);
// Now the node ID
memcpy(o_resp + l_currentOffset, &l_nodeId, sizeof(l_nodeId));
l_currentOffset += sizeof(l_nodeId);
// The size of the quote and signature structures
memcpy(o_resp + l_currentOffset,&l_quoteData.size,sizeof(l_quoteData.size));
l_currentOffset += sizeof(l_quoteData.size);
// The TPM quote & signature information (both are included in the TPM
// quote blob)
memcpy(o_resp + l_currentOffset, l_quoteData.data, l_quoteData.size);
l_currentOffset += l_quoteData.size;
// The number of PCRs read
memcpy(o_resp + l_currentOffset, &l_pcrCount, sizeof(l_pcrCount));
l_currentOffset += sizeof(l_pcrCount);
// PCR contents
for(const auto l_pcr : l_pcrRegs)
{
if(l_pcrDigests[l_pcr].size != 0)
{
// Copy the size of the PCR
memcpy(o_resp + l_currentOffset,
&l_pcrDigests[l_pcr].size,
sizeof(l_pcrDigests[l_pcr].size));
l_currentOffset += sizeof(l_pcrDigests[l_pcr].size);
// Now the actual data
memcpy(o_resp + l_currentOffset,
l_pcrDigests[l_pcr].buffer,
l_pcrDigests[l_pcr].size);
l_currentOffset += l_pcrDigests[l_pcr].size;
}
}
// AK certificate size
memcpy(o_resp + l_currentOffset, &l_AKCert.size, sizeof(l_AKCert.size));
l_currentOffset += sizeof(l_AKCert.size);
// Actual AK certificate
memcpy(o_resp + l_currentOffset, l_AKCert.buffer, l_AKCert.size);
l_currentOffset += l_AKCert.size;
// The length of the TPM log
memcpy(o_resp + l_currentOffset, &l_logSize, sizeof(l_logSize));
l_currentOffset += sizeof(l_logSize);
// The actual TPM log
memcpy(o_resp + l_currentOffset, l_logPtr, l_logSize);
} while(0);
if(l_quoteData.data)
{
delete[](l_quoteData.data);
l_quoteData.data = nullptr;
}
if(l_errl || l_errorOccurred)
{
// There was some error; allocate the output buffer just big enough
// for an eye catcher and node ID
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenSlaveQuoteResponse: An error "
"occurred during slave quote composition. Sending NDNOTPM_ "
"back Master Node after poisoning all TPMs on this node");
NCEyeCatcher_t l_badEyeCatcher = NDNOTPM_;
o_resp = new uint8_t[sizeof(l_badEyeCatcher) + sizeof(l_nodeId)]{};
memcpy(o_resp, &l_badEyeCatcher, sizeof(l_badEyeCatcher));
memcpy(o_resp + sizeof(l_badEyeCatcher), &l_nodeId, sizeof(l_nodeId));
o_size = sizeof(l_badEyeCatcher) + sizeof(l_nodeId);
errlHndl_t l_poisonTpmErr = TRUSTEDBOOT::poisonAllTpms();
if(l_poisonTpmErr)
{
if(l_errl)
{
l_poisonTpmErr->plid(l_errl->plid());
}
if(l_tpmRequired)
{
errlCommit(l_poisonTpmErr, SECURE_COMP_ID);
}
else
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenSlaveQuoteResponse: "
"Could not poison TPMs. Errl PLID: 0x%.08X "
"Deleting the error log and continuing anyway.",
l_poisonTpmErr->plid());
delete l_poisonTpmErr;
l_poisonTpmErr = nullptr;
}
}
}
TRACFCOMP(g_trac_nc, EXIT_MRK"nodeCommGenSlaveQuoteResponse: " TRACE_ERR_FMT, TRACE_ERR_ARGS(l_errl));
#endif
return l_errl;
} //nodeCommGenSlaveQuoteResponse
/**
* @brief A function to generate a master quote request blob that will be sent
* to the slave node(s) as part of the node communication protocol. The
* master request consists of an eye catcher, 32-byte TPM-generated
* random number, and a PCR selection structure.
* @param[out] o_request the output master quote request data structure
* @return nullptr on success; non-nullptr on error
*/
errlHndl_t nodeCommGenMasterQuoteRequest(MasterQuoteRequestBlob* const o_request)
{
errlHndl_t l_errl = nullptr;
#ifdef CONFIG_TPMDD
TRACFCOMP(g_trac_nc, ENTER_MRK"nodeCommGenMasterQuoteRequest");
bool l_tpmRequired = TRUSTEDBOOT::isTpmRequired();
do {
TARGETING::Target* l_primaryTpm = nullptr;
TRUSTEDBOOT::getPrimaryTpm(l_primaryTpm);
if(!l_primaryTpm ||
!l_primaryTpm->getAttr<TARGETING::ATTR_HWAS_STATE>().functional ||
!l_primaryTpm->getAttr<TARGETING::ATTR_HWAS_STATE>().present)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenMasterQuoteRequest: primary TPM not found or is not functional");
l_errl = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_UNRECOVERABLE,
MOD_NC_GEN_MASTER_REQUEST,
RC_NC_BAD_MASTER_TPM);
l_errl->collectTrace(SECURE_COMP_NAME);
l_errl->collectTrace(TRBOOT_COMP_NAME);
l_errl->collectTrace(NODECOMM_TRACE_NAME);
break;
}
o_request->EyeCatcher = MASTERQ_;
// Generate the 32-byte nonce for master request
l_errl = TRUSTEDBOOT::GetRandom(l_primaryTpm,
sizeof(o_request->MasterNonce),
o_request->MasterNonce);
if(l_errl)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenMasterQuoteRequest: GetRandom failed");
break;
}
// Select PCRs (PCR0-7) to include in slave quote response
o_request->PcrSelect.count = 1; // One algorithm
o_request->PcrSelect.pcrSelections[0].algorithmId =
TRUSTEDBOOT::TPM_ALG_SHA256;
o_request->PcrSelect.pcrSelections[0].sizeOfSelect =
TRUSTEDBOOT::PCR_SELECT_MAX;
memset(o_request->PcrSelect.pcrSelections[0].pcrSelect, 0,
sizeof(o_request->PcrSelect.pcrSelections[0].pcrSelect));
TRUSTEDBOOT::TPM_Pcr l_pcrRegs[TRUSTEDBOOT::FW_USED_PCR_COUNT] = {
TRUSTEDBOOT::PCR_0,
TRUSTEDBOOT::PCR_1,
TRUSTEDBOOT::PCR_2,
TRUSTEDBOOT::PCR_3,
TRUSTEDBOOT::PCR_4,
TRUSTEDBOOT::PCR_5,
TRUSTEDBOOT::PCR_6,
TRUSTEDBOOT::PCR_7
};
for(const auto l_pcr : l_pcrRegs)
{
o_request->PcrSelect.pcrSelections[0]
.pcrSelect[l_pcr/TRUSTEDBOOT::FW_USED_PCR_COUNT] |=
0x01 << (l_pcr % TRUSTEDBOOT::FW_USED_PCR_COUNT);
}
} while(0);
if(l_errl)
{
// Error occurred. Tell the slave that the master TPM is unavailable and
// poison the TPMs on master node.
o_request->EyeCatcher = MSTNOTPM;
errlHndl_t l_poisonTpmErr = TRUSTEDBOOT::poisonAllTpms();
if(l_poisonTpmErr)
{
if(l_errl)
{
l_poisonTpmErr->plid(l_errl->plid());
}
if(l_tpmRequired)
{
errlCommit(l_poisonTpmErr, SECURE_COMP_ID);
}
else
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommGenMasterQuoteRequest: "
"Could not poison TPMs. Errl PLID: 0x%.08X. "
"Deleting the error log and continuing anyway.",
l_poisonTpmErr->plid());
delete l_poisonTpmErr;
l_poisonTpmErr = nullptr;
}
}
}
TRACFCOMP(g_trac_nc, EXIT_MRK"nodeCommGenMasterQuoteRequest: " TRACE_ERR_FMT, TRACE_ERR_ARGS(l_errl));
#endif
return l_errl;
} // nodeCommGenMasterQuoteRequest
/**
* @brief A function to process the response of one of the slave nodes
* @param[in] i_slaveQuote the quote received from a slave node in binary format
* @param[in] i_slaveQuoteSize the size of the slave quote (in bytes)
* @return nullptr on success; non-nullptr on error
*/
errlHndl_t nodeCommProcessSlaveQuote(uint8_t* const i_slaveQuote,
const size_t i_slaveQuoteSize)
{
errlHndl_t l_errl = nullptr;
#ifdef CONFIG_TPMDD
TRACFCOMP(g_trac_nc, ENTER_MRK"nodeCommProcessSlaveQuote");
bool l_tpmRequired = TRUSTEDBOOT::isTpmRequired();
bool l_errorOccurred = false;
do {
NCEyeCatcher_t* l_eyeCatcher =
reinterpret_cast<NCEyeCatcher_t*>(i_slaveQuote);
uint32_t* l_slaveNodeId = reinterpret_cast<uint32_t*>(i_slaveQuote +
sizeof(l_eyeCatcher));
if(*l_eyeCatcher == NDNOTPM_)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommProcessSlaveQuote: Slave node %d indicated that it could not complete the slave quote generation process", *l_slaveNodeId);
l_errorOccurred = true;
if(l_tpmRequired)
{
// Slave sent bad data and TPM is required - return an error and
// the IPL should be terminated
/* @
* @errortype
* @reasoncode RC_NC_BAD_SLAVE_QUOTE
* @moduleid MOD_NC_PROCESS_SLAVE_QUOTE
* @userdata1 Slave node where the quote came from
* @devdesc One of the slave nodes indicated that there was
* an issue with its TPM or quote generation process
* @custdesc trustedboot failure
*/
l_errl = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_UNRECOVERABLE,
MOD_NC_PROCESS_SLAVE_QUOTE,
RC_NC_BAD_SLAVE_QUOTE,
*l_slaveNodeId,
0);
l_errl->collectTrace(SECURE_COMP_NAME);
l_errl->collectTrace(TRBOOT_COMP_NAME);
l_errl->collectTrace(NODECOMM_TRACE_NAME);
}
break;
}
// Extend the hash of the slave quote to PCR 1, and include the whole quote
// in binary form as the message in the TPM log
SHA512_t l_quoteHash = {0};
hashBlob(i_slaveQuote, i_slaveQuoteSize, l_quoteHash);
l_errl = TRUSTEDBOOT::pcrExtend(TRUSTEDBOOT::PCR_1,
TRUSTEDBOOT::EV_PLATFORM_CONFIG_FLAGS,
l_quoteHash,
sizeof(l_quoteHash),
i_slaveQuote,
i_slaveQuoteSize);
if(l_errl)
{
TRACFCOMP(g_trac_nc, ERR_MRK"nodeCommProcessSlaveQuote: could not extend slave response to PCR 1");
break;
}
} while(0);
if(l_errl || l_errorOccurred)
{
errlHndl_t l_poisonTpmErr = TRUSTEDBOOT::poisonAllTpms();
if(l_poisonTpmErr)
{
if(l_errl)
{
l_poisonTpmErr->plid(l_errl->plid());
}
if(TRUSTEDBOOT::isTpmRequired())
{
errlCommit(l_poisonTpmErr, SECURE_COMP_ID);
}
else
{
TRACFCOMP(g_trac_nc, ERR_MRK"nodeCommProcessSlaveQuote: "
"Could not poison TPMs. Errl PLID: 0x%.08X. "
"Deleting the error log and continuing.",
l_poisonTpmErr->plid());
delete l_poisonTpmErr;
l_poisonTpmErr = nullptr;
}
}
}
TRACFCOMP(g_trac_nc, EXIT_MRK"nodeCommProcessSlaveQuote: " TRACE_ERR_FMT, TRACE_ERR_ARGS(l_errl));
#endif
return l_errl;
} // nodeCommProcessSlaveQuote
/**
* @brief This function runs the procedure for the master processor on the
* master node to send and receive messages over the ABUS to the
* master processors on the slave nodes
*
* @param[in] i_mProcInfo - Information about Master Proc
* @param[in] i_obus_instances - Vector containing all of the OBUS connections
* that the Master Proc on the Master Node needs
* to send and received messages across
*
* @return errlHndl_t Error log handle
* @retval nullptr Operation was successful
* @retval !nullptr Operation failed with valid error log
*/
errlHndl_t nodeCommAbusExchangeMaster(const master_proc_info_t & i_mProcInfo,
const std::vector<obus_instances_t> &
i_obus_instances)
{
errlHndl_t err = nullptr;
TRACFCOMP(g_trac_nc,ENTER_MRK"nodeCommAbusExchangeMaster: mProc=0x%.08X "
"to communicate through %d obus connection(s)",
get_huid(i_mProcInfo.tgt), i_obus_instances.size());
// Pointer to buffer used for receiving data from nodeCommTransferRecv()
uint8_t * data_rcv_buffer = nullptr;
do
{
// The slave quote that is returned by the slave nodes as part of the node
// comm protocol is too big to be placed in the TPM's log without moving the
// log to a new memory location, so before processing the slave quote, we
// need to send a message to the TPM queue to expand the log. We need to
// expand logs on all TPMs, since logging and PCR extends are mirrorred into
// all TPMs/logs on the node.
TARGETING::TargetHandleList l_tpms;
TRUSTEDBOOT::getTPMs(l_tpms);
for(const auto& l_tpm : l_tpms)
{
err = TRUSTEDBOOT::expandTpmLog(l_tpm);
if(err)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommAbusExchangeMaster: could not expand the TPM log for TPM HUID 0x%x", TARGETING::get_huid(l_tpm));
break;
}
}
if(err)
{
break;
}
// Loop 1: Exchange SBID/nonces between Master and each of the Slave Nodes
for ( auto const l_obus : i_obus_instances)
{
uint8_t my_linkId = 0;
uint8_t my_mboxId = 0;
getLinkMboxFromObusInstance(l_obus.myObusInstance,
l_obus.myObusRelLink,
my_linkId,
my_mboxId);
uint8_t expected_peer_linkId = 0;
uint8_t expected_peer_mboxId = 0;
getLinkMboxFromObusInstance(l_obus.peerObusInstance,
// same relative link for peer path:
l_obus.myObusRelLink,
expected_peer_linkId,
expected_peer_mboxId);
TRACFCOMP(g_trac_nc,INFO_MRK"nodeCommAbusExchangeMaster: Loop 1: "
"my: linkId=%d, mboxId=%d, ObusInstance=%d. "
"expected peer: n%d linkId=%d, mboxId=%d, ObusInstance=%d",
my_linkId, my_mboxId, l_obus.myObusInstance,
l_obus.peerNodeInstance, expected_peer_linkId,
expected_peer_mboxId, l_obus.peerObusInstance);
// Get random number from TPM
msg_format_t msg_data;
msg_data.value = 0;
err = nodeCommAbusGetRandom(msg_data.value);
if (err)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommAbusExchangeMaster: Loop 1: "
"Error Back From nodeCommAbusGetRandom: "
TRACE_ERR_FMT,
TRACE_ERR_ARGS(err));
break;
}
// Set the send and expected receive LinkIds in the nonce
msg_data.origin_linkId = my_linkId;
msg_data.receiver_linkId = expected_peer_linkId;
// Send a message to a slave
size_t tmp_size = sizeof(msg_data.value);
err = nodeCommTransferSend(i_mProcInfo.tgt,
my_linkId,
my_mboxId,
l_obus.peerNodeInstance,
NCT_TRANSFER_SBID,
reinterpret_cast<uint8_t*>
(&(msg_data.value)),
tmp_size);
if (err)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommAbusExchangeMaster: Loop 1: "
"nodeCommTransferSend returned an error");
break;
}
// Push this msg_data to TPM
err = nodeCommAbusLogNonce(msg_data.value);
if (err)
{
TRACFCOMP(g_trac_nc,ERR_MRK"nodeCommAbusExchangeMaster: Loop 1: "
"Error Back From nodeCommAbusLogNonce: "
TRACE_ERR_FMT,
TRACE_ERR_ARGS(err));
break;
}
// Look for Return Message From The Slave
size_t data_rcv_size = 0;
if (data_rcv_buffer != nullptr)
{
free(data_rcv_buffer);
data_rcv_buffer = nullptr;
}
err = nodeCommTransferRecv(i_mProcInfo.tgt,
my_linkId,
my_mboxId,
l_obus.peerNodeInstance,
NCT_TRANSFER_SBID,
data_rcv_buffer,
data_rcv_size);
if (err)
{
TRACFCOMP(g_trac_nc,INFO_MRK"nodeCommAbusExchangeMaster: Loop 1: "
"nodeCommTransferRecv returned an error");
break;
}
// If no err is returned, data_rcv_buffer should be valid, but do a