Secureboot: Enhanced Multinode Comm: Master Node

This commit introduces the logic to create the master node nodecomm
request to the slave nodes and logic to process the responses from
the slave nodes. The data from the slave nodes (the slave quote) is
hashed and extended into PCR1. The binary quote blob is also included
in the TPM log as a log message.

Additional changes: the logic to relocate the TPM log to increase
its size, and the logic to allow uint8_t* instead of char* as
the TPM log message.

Change-Id: Ide4465f0d4a91aec815c9db5d765cdbde231dcd3
RTC: 203644
Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/71407
Reviewed-by: Michael Baiocchi <mbaiocch@us.ibm.com>
Reviewed-by: Christopher J. Engel <cjengel@us.ibm.com>
Reviewed-by: Nicholas E. Bofferding <bofferdn@us.ibm.com>
Tested-by: Jenkins Server <pfd-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP Build CI <op-jenkins+hostboot@us.ibm.com>
Tested-by: FSP CI Jenkins <fsp-CI-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP HW <op-hw-jenkins+hostboot@us.ibm.com>
Reviewed-by: Daniel M. Crowell <dcrowell@us.ibm.com>

11 files changed, 249 insertions, 53 deletions

diff --git a/src/usr/secureboot/trusted/base/trustedbootMsg.H b/src/usr/secureboot/trusted/base/trustedbootMsg.H
index 929233111..40e1e53ec 100644
--- a/src/usr/secureboot/trusted/base/trustedbootMsg.H
+++ b/src/usr/secureboot/trusted/base/trustedbootMsg.H
@@ -63,7 +63,8 @@ namespace TRUSTEDBOOT
         MSG_TYPE_GEN_QUOTE,
         MSG_TYPE_FLUSH_CONTEXT,
         MSG_TYPE_PCR_READ,
-        MSG_TYPE_LAST = MSG_TYPE_PCR_READ,
+        MSG_TYPE_EXPAND_TPM_LOG,
+        MSG_TYPE_LAST = MSG_TYPE_EXPAND_TPM_LOG,
     };
 
     /// PCREXTEND message data
@@ -74,7 +75,8 @@ namespace TRUSTEDBOOT
         EventTypes       mEventType;
         size_t           mDigestSize;
         uint8_t          mDigest[TPM_ALG_SHA256_SIZE];
-        char             mLogMsg[MAX_TPM_LOG_MSG];
+        uint8_t          mLogMsg[MAX_TPM_LOG_MSG];
+        size_t           mLogMsgSize;
         const TpmTarget* mSingleTpm;
         bool             mMirrorToLog;
     };
diff --git a/src/usr/secureboot/trusted/base/trustedboot_base.C b/src/usr/secureboot/trusted/base/trustedboot_base.C
index e0170b164..9e78e08f5 100644
--- a/src/usr/secureboot/trusted/base/trustedboot_base.C
+++ b/src/usr/secureboot/trusted/base/trustedboot_base.C
@@ -199,7 +199,8 @@ errlHndl_t pcrExtend(TPM_Pcr i_pcr,
                      EventTypes i_eventType,
                      const uint8_t* i_digest,
                      size_t  i_digestSize,
-                     const char* i_logMsg,
+                     const uint8_t* i_logMsg,
+                     const size_t i_logMsgSize,
                      bool i_sendAsync,
                      const TpmTarget* i_pTpm,
                      const bool i_mirrorToLog)
@@ -210,8 +211,13 @@ errlHndl_t pcrExtend(TPM_Pcr i_pcr,
 
     TRACDCOMP( g_trac_trustedboot, ENTER_MRK"pcrExtend()" );
     TRACUCOMP( g_trac_trustedboot,
-               ENTER_MRK"pcrExtend() pcr=%d msg='%s'",
-               i_pcr, i_logMsg? i_logMsg: "(null)");
+               ENTER_MRK"pcrExtend() pcr=%d",
+               i_pcr);
+    if(i_logMsg)
+    {
+        TRACUBIN(g_trac_trustedboot, "TPM log msg", i_logMsg, i_logMsgSize);
+    }
+
     TRACUBIN(g_trac_trustedboot, "pcrExtend() digest:", i_digest, i_digestSize);
 
     // msgData will be freed when message is freed
@@ -233,10 +239,10 @@ errlHndl_t pcrExtend(TPM_Pcr i_pcr,
     if (i_logMsg)
     {
         memcpy(msgData->mLogMsg, i_logMsg,
-           (strlen(i_logMsg) < sizeof(msgData->mLogMsg) ? strlen(i_logMsg) :
-            sizeof(msgData->mLogMsg)-1)  // Leave room for NULL termination
-           );
+            (i_logMsgSize < sizeof(msgData->mLogMsg) ?
+                i_logMsgSize : sizeof(msgData->mLogMsg)));
     }
+    msgData->mLogMsgSize = i_logMsgSize;
 
     if (!i_sendAsync)
     {
@@ -369,7 +375,8 @@ errlHndl_t extendPnorSectionHash(
               pnorHashEventType,
               reinterpret_cast<const uint8_t*>(i_conHdr.payloadTextHash()),
               sizeof(SHA512_t),
-              sectionInfo.name);
+              reinterpret_cast<const uint8_t*>(sectionInfo.name),
+              strlen(sectionInfo.name) + 1);
         if (pError)
         {
             TRACFCOMP(g_trac_trustedboot, ERR_MRK " Failed in call to "
@@ -383,7 +390,8 @@ errlHndl_t extendPnorSectionHash(
                     swKeyHashEventType,
                     reinterpret_cast<const uint8_t*>(i_conHdr.swKeyHash()),
                     sizeof(SHA512_t),
-                    swKeyMsg);
+                    reinterpret_cast<const uint8_t*>(swKeyMsg),
+                    strlen(swKeyMsg) + 1);
         if (pError)
         {
             TRACFCOMP(g_trac_trustedboot, ERR_MRK " Failed in call to "
@@ -401,7 +409,8 @@ errlHndl_t extendPnorSectionHash(
                 pnorHashEventType,
                 hash,
                 sizeof(SHA512_t),
-                sectionInfo.name);
+                reinterpret_cast<const uint8_t*>(sectionInfo.name),
+                strlen(sectionInfo.name) + 1);
         if (pError)
         {
             TRACFCOMP(g_trac_trustedboot, ERR_MRK " Failed in call to "
@@ -1120,4 +1129,55 @@ errlHndl_t pcrRead(TpmTarget* i_target,
     return l_errl;
 }
 
+errlHndl_t expandTpmLog(TpmTarget* i_target)
+{
+    errlHndl_t l_errl = nullptr;
+#ifdef CONFIG_TPMDD
+    Message* l_msg = nullptr;
+
+    TpmTargetData* l_data = new TpmTargetData(i_target);
+
+    l_msg = Message::factory(MSG_TYPE_EXPAND_TPM_LOG,
+                             sizeof(*l_data),
+                             reinterpret_cast<uint8_t*>(l_data),
+                             MSG_MODE_SYNC);
+    assert(l_msg, "expandTpmLog: l_msg is nullptr");
+    l_data = nullptr; // l_msg now owns l_data
+
+    int l_rc = msg_sendrecv(systemData.msgQ, l_msg->iv_msg);
+    if(l_rc)
+    {
+        /**
+         * @errortype ERRL_SEV_UNRECOVERABLE
+         * @moduleid MOD_EXPAND_TPM_LOG
+         * @reasoncode RC_SENDRECV_FAIL
+         * @userdata1 rc from msg_sendrecv
+         * @userdata2 TPM HUID
+         * @devdesc msg_sendrecv failed for expandTpmLog
+         * @custdesc trustedboot failure
+         */
+        l_errl = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_UNRECOVERABLE,
+                                         MOD_EXPAND_TPM_LOG,
+                                         RC_SENDRECV_FAIL,
+                                         l_rc,
+                                         TARGETING::get_huid(i_target),
+                                         ERRORLOG::ErrlEntry::ADD_SW_CALLOUT);
+        l_errl->collectTrace(SECURE_COMP_NAME);
+        l_errl->collectTrace(TRBOOT_COMP_NAME);
+    }
+    else
+    {
+        l_errl = l_msg->iv_errl;
+        l_msg->iv_errl = nullptr;
+    }
+
+    if(l_msg)
+    {
+        delete l_msg;
+        l_msg = nullptr;
+    }
+#endif
+    return l_errl;
+}
+
 } // end TRUSTEDBOOT
diff --git a/src/usr/secureboot/trusted/test/tpmLogMgrTest.H b/src/usr/secureboot/trusted/test/tpmLogMgrTest.H
index 0e67056a8..aa0aa304b 100755
--- a/src/usr/secureboot/trusted/test/tpmLogMgrTest.H
+++ b/src/usr/secureboot/trusted/test/tpmLogMgrTest.H
@@ -5,7 +5,7 @@
 /*                                                                        */
 /* OpenPOWER HostBoot Project                                             */
 /*                                                                        */
-/* Contributors Listed Below - COPYRIGHT 2015,2017                        */
+/* Contributors Listed Below - COPYRIGHT 2015,2019                        */
 /* [+] International Business Machines Corp.                              */
 /*                                                                        */
 /*                                                                        */
@@ -198,7 +198,8 @@ class TPMLogMgrTest: public CxxTest::TestSuite
          * @brief Add generic test event to log and return the event added
          */
         TCG_PCR_EVENT2 addTestLogEvent(TpmLogMgr& i_logMgr,
-                                       const char* i_logMsg)
+                                       const uint8_t* i_logMsg,
+                                       size_t i_logMsgSize)
         {
             // Set components of TCG_PCR_EVENT2
             TPM_Pcr pcr = PCR_0;
@@ -215,14 +216,18 @@ class TPMLogMgrTest: public CxxTest::TestSuite
                                         pcr, EV_NO_ACTION, algId,
                                         digest, digestSize,
                                         TPM_ALG_SHA1, digest,
-                                        digestSize, i_logMsg);
+                                        digestSize, i_logMsg,
+                                        i_logMsgSize);
 
             // Add event to log
             errlHndl_t err = TpmLogMgr_addEvent(&i_logMgr, &eventLog);
             if (err)
             {
-                TS_FAIL("addTestLogEvent - Failed to addEvent with message = %s",
-                        i_logMsg);
+                TS_FAIL("addTestLogEvent - Failed to addEvent with the following message");
+                TRACFBIN(g_trac_trustedboot,
+                         "TPM log message",
+                         i_logMsg,
+                         i_logMsgSize);
                 errlCommit( err, TRBOOT_COMP_ID );
                 delete err;
                 err = NULL;
@@ -244,8 +249,10 @@ class TPMLogMgrTest: public CxxTest::TestSuite
                 getTestLogMgr(&logMgr);
 
                 // Add event to log
-                const char* logMsg = "testTpmLogReadSingleEntry";
-                TCG_PCR_EVENT2 eventLog = addTestLogEvent(logMgr, logMsg);
+                uint8_t logMsg[] = "testTpmLogReadSingleEntry";
+                TCG_PCR_EVENT2 eventLog = addTestLogEvent(logMgr,
+                                                          logMsg,
+                                                          sizeof(logMsg));
 
                 // Retrive event from log
                 TCG_PCR_EVENT2 resultEventLog;
@@ -330,8 +337,8 @@ class TPMLogMgrTest: public CxxTest::TestSuite
                 getTestLogMgr(&logMgr);
 
                 // Add event to log
-                const char* logMsg = "testTpmLogReadPastValidLog";
-                addTestLogEvent(logMgr, logMsg);
+                uint8_t logMsg[] = "testTpmLogReadPastValidLog";
+                addTestLogEvent(logMgr, logMsg, sizeof(logMsg));
 
                 // Retrive event from log
                 TCG_PCR_EVENT2 resultEventLog;
@@ -389,9 +396,11 @@ class TPMLogMgrTest: public CxxTest::TestSuite
                     break;
                 }
 
+                uint8_t logMsg[] = "CalcLog11";
                 // Add an event to log
                 TCG_PCR_EVENT2 eventLog = addTestLogEvent(logMgr,
-                                                          "CalcLog11");
+                                                          logMsg,
+                                                          sizeof(logMsg));
                 if (TpmLogMgr_calcLogSize(&logMgr) !=
                     TpmLogMgr_getLogSize(&logMgr) ||
                     ((firstEventSize +
@@ -405,11 +414,13 @@ class TPMLogMgrTest: public CxxTest::TestSuite
                     break;
                 }
 
+                uint8_t logMsg1[] = "CalcLog3434";
                 // Add more events to log
                 for (int idx = 0; idx < 10; idx ++)
                 {
                     eventLog = addTestLogEvent(logMgr,
-                                               "CalcLog3434");
+                                               logMsg1,
+                                               sizeof(logMsg1));
                     if (TpmLogMgr_calcLogSize(&logMgr) !=
                         TpmLogMgr_getLogSize(&logMgr))
                     {
@@ -460,11 +471,13 @@ class TPMLogMgrTest: public CxxTest::TestSuite
                 }
 
 
+                uint8_t logMsg[] = "CalcLog3434";
                 // Add more events to log
                 for (int idx = 0; idx < 10; idx ++)
                 {
                     eventLog = addTestLogEvent(logMgr,
-                                               "CalcLog3434");
+                                               logMsg,
+                                               sizeof(logMsg));
                 }
 
                 err = TpmLogMgr_initializeUsingExistingLog(&cloneMgr,
@@ -484,8 +497,9 @@ class TPMLogMgrTest: public CxxTest::TestSuite
                     break;
                 }
 
+                uint8_t logMsg1[] = "Clone123 23434";
                 // Now try adding an event to the clone logMgr
-                eventLog = addTestLogEvent(cloneMgr, "Clone123 23434");
+                eventLog = addTestLogEvent(cloneMgr, logMsg1, sizeof(logMsg1));
                 if (TpmLogMgr_getLogSize(&logMgr) ==
                     TpmLogMgr_getLogSize(&cloneMgr))
                 {
diff --git a/src/usr/secureboot/trusted/test/trustedbootTest.H b/src/usr/secureboot/trusted/test/trustedbootTest.H
index 8c1655dd8..cbf221e57 100755
--- a/src/usr/secureboot/trusted/test/trustedbootTest.H
+++ b/src/usr/secureboot/trusted/test/trustedbootTest.H
@@ -792,6 +792,7 @@ class TrustedBootTest: public CxxTest::TestSuite
 
             for (size_t i = 0; i < EXTEND_PCR_TESTS; ++i) {
 
+                uint8_t l_logMsg[] = "testExtendPCR: test";
                 num_ops++;
                 pcrExtendSingleTpm(pTpm,
                                    PCR_DEBUG,
@@ -799,7 +800,8 @@ class TrustedBootTest: public CxxTest::TestSuite
                                    TPM_ALG_SHA256,
                                    digest,
                                    TPM_ALG_SHA256_SIZE,
-                                   "testExtendPCR: test");
+                                   l_logMsg,
+                                   sizeof(l_logMsg));
 
                 auto hwasState = pTpm->getAttr<TARGETING::ATTR_HWAS_STATE>();
                 if(!hwasState.functional)
diff --git a/src/usr/secureboot/trusted/tpmLogMgr.C b/src/usr/secureboot/trusted/tpmLogMgr.C
index 855d02b5a..3c91ce9e6 100644
--- a/src/usr/secureboot/trusted/tpmLogMgr.C
+++ b/src/usr/secureboot/trusted/tpmLogMgr.C
@@ -5,7 +5,7 @@
 /*                                                                        */
 /* OpenPOWER HostBoot Project                                             */
 /*                                                                        */
-/* Contributors Listed Below - COPYRIGHT 2015,2018                        */
+/* Contributors Listed Below - COPYRIGHT 2015,2019                        */
 /* [+] International Business Machines Corp.                              */
 /*                                                                        */
 /*                                                                        */
@@ -465,7 +465,8 @@ namespace TRUSTEDBOOT
                                                   TPM_Alg_Id i_algId_2,
                                                   const uint8_t* i_digest_2,
                                                   size_t i_digestSize_2,
-                                                  const char* i_logMsg)
+                                                  const uint8_t* i_logMsg,
+                                                  const size_t i_logMsgSize)
     {
         TCG_PCR_EVENT2 eventLog;
         size_t fullDigestSize_1 = 0;
@@ -499,12 +500,11 @@ namespace TRUSTEDBOOT
                     i_digestSize_2 : fullDigestSize_2));
         }
         // Event field data
-        eventLog.event.eventSize = strlen(i_logMsg);
+        eventLog.event.eventSize = i_logMsgSize;
         memset(eventLog.event.event, 0, sizeof(eventLog.event.event));
         memcpy(eventLog.event.event, i_logMsg,
-               (strlen(i_logMsg) > MAX_TPM_LOG_MSG ?
-                MAX_TPM_LOG_MSG - 1 // Leave room for NULL termination
-                : strlen(i_logMsg)) );
+               (i_logMsgSize > MAX_TPM_LOG_MSG ?
+                MAX_TPM_LOG_MSG : i_logMsgSize));
 
         return eventLog;
     }
@@ -583,17 +583,28 @@ namespace TRUSTEDBOOT
                    i_val->logSize, i_maxSize);
 
         assert(i_newLog != NULL, "Bug! Log start address is nullptr");
-        assert(i_val->eventLogInMem == NULL,
-               "relocateTpmLog can only be called once");
         assert(i_val->logSize < i_maxSize,
                "Logsize is greater than maxsize");
 
-        // Point logMgr to new location
-        i_val->eventLogInMem = i_newLog;
+        if(i_val->eventLogInMem)
+        {
+            // The log had been expanded previously. Need to copy over the log
+            // memory to the new location and delete the pointer before
+            // reassigning
+            memcpy(i_newLog, i_val->eventLogInMem, i_val->logSize);
+            delete[](i_val->eventLogInMem);
+            i_val->eventLogInMem = i_newLog;
+        }
+        else
+        {
+            // Point logMgr to new location
+            i_val->eventLogInMem = i_newLog;
+
+            // Copy log into new location
+            memset(i_val->eventLogInMem, 0, i_maxSize);
+            memcpy(i_val->eventLogInMem, i_val->eventLog, i_val->logSize);
+        }
 
-        // Copy log into new location
-        memset(i_val->eventLogInMem, 0, i_maxSize);
-        memcpy(i_val->eventLogInMem, i_val->eventLog, i_val->logSize);
         i_val->newEventPtr = i_val->eventLogInMem + i_val->logSize;
         i_val->logMaxSize = i_maxSize;
 
diff --git a/src/usr/secureboot/trusted/tpmLogMgr.H b/src/usr/secureboot/trusted/tpmLogMgr.H
index 58d0cd7a0..67c70d463 100644
--- a/src/usr/secureboot/trusted/tpmLogMgr.H
+++ b/src/usr/secureboot/trusted/tpmLogMgr.H
@@ -5,7 +5,7 @@
 /*                                                                        */
 /* OpenPOWER HostBoot Project                                             */
 /*                                                                        */
-/* Contributors Listed Below - COPYRIGHT 2015,2018                        */
+/* Contributors Listed Below - COPYRIGHT 2015,2019                        */
 /* [+] International Business Machines Corp.                              */
 /*                                                                        */
 /*                                                                        */
@@ -222,7 +222,8 @@ namespace TRUSTEDBOOT
      * @param[in] i_algId_2 Algorithm to use
      * @param[in] i_digest_2 Digest value to write to PCR, NULL if not used
      * @param[in] i_digestSize_2 Byte size of i_digest array
-     * @param[in] i_logMsg Null terminated Log message
+     * @param[in] i_logMsg log message in binary form
+     * @param[in] i_logMsgSize the size of log message in bytes
      *
      * @return TCG_PCR_EVENT2   PCR event log
      */
@@ -234,7 +235,8 @@ namespace TRUSTEDBOOT
                                                   TPM_Alg_Id i_algId_2,
                                                   const uint8_t* i_digest_2,
                                                   size_t i_digestSize_2,
-                                                  const char* i_logMsg);
+                                                  const uint8_t* i_logMsg,
+                                                  size_t i_logMsgSize);
 
     /**
      * @brief Dump contents of log to a trace
diff --git a/src/usr/secureboot/trusted/trustedTypes.H b/src/usr/secureboot/trusted/trustedTypes.H
index ae3f3e233..fee966520 100644
--- a/src/usr/secureboot/trusted/trustedTypes.H
+++ b/src/usr/secureboot/trusted/trustedTypes.H
@@ -47,6 +47,8 @@
 #define PACKED __attribute__((__packed__))
 #endif
 
+#include <limits.h>
+
 #ifdef __cplusplus
 namespace TRUSTEDBOOT
 {
@@ -69,7 +71,7 @@ namespace TRUSTEDBOOT
     /// Common static values
     enum
     {
-        MAX_TPM_LOG_MSG = 128,    ///< Maximum log message size
+        MAX_TPM_LOG_MSG = PAGESIZE,    ///< Maximum log message size
 
         HASH_COUNT            = 2,       ///< Maximum # of digests
 
@@ -568,6 +570,7 @@ namespace TRUSTEDBOOT
     struct _TPM2_NVReadOut
     {
         TPM2_BaseOut base;
+        uint32_t authSessionSize;
         TPM2B_MAX_NV_BUFFER data;
     } PACKED;
     typedef struct _TPM2_NVReadOut TPM2_NVReadOut;
diff --git a/src/usr/secureboot/trusted/trustedboot.C b/src/usr/secureboot/trusted/trustedboot.C
index 28521dc7b..1237fe3b8 100644
--- a/src/usr/secureboot/trusted/trustedboot.C
+++ b/src/usr/secureboot/trusted/trustedboot.C
@@ -73,6 +73,7 @@
 #include <util/misc.H>
 #include <hwas/common/hwasCommon.H>
 
+
 namespace TRUSTEDBOOT
 {
 
@@ -738,9 +739,10 @@ errlHndl_t tpmLogConfigEntries(TRUSTEDBOOT::TpmTarget* const i_pTpm)
                                 l_securitySwitchValue);
         // Extend to TPM - PCR_1
         memcpy(l_digest, &l_securitySwitchValue, sizeof(l_securitySwitchValue));
+        uint8_t l_sswitchesLogMsg[] = "Security Switches";
         l_err = pcrExtend(PCR_1, EV_PLATFORM_CONFIG_FLAGS,
                           l_digest, sizeof(l_securitySwitchValue),
-                          "Security Switches");
+                          l_sswitchesLogMsg, sizeof(l_sswitchesLogMsg));
         if (l_err)
         {
             break;
@@ -760,8 +762,10 @@ errlHndl_t tpmLogConfigEntries(TRUSTEDBOOT::TpmTarget* const i_pTpm)
         TRACDCOMP(g_trac_trustedboot, "PVR of chip = 0x%08X", l_pvr);
         // Extend to TPM - PCR_1
         memcpy(l_digest, &l_pvr, sizeof(l_pvr));
+        uint8_t l_pvrLogMsg[] = "PVR of Chip";
         l_err = pcrExtend(PCR_1, EV_PLATFORM_CONFIG_FLAGS,
-                          l_digest, sizeof(l_pvr),"PVR of Chip");
+                          l_digest, sizeof(l_pvr), l_pvrLogMsg,
+                          sizeof(l_pvrLogMsg));
         if (l_err)
         {
             break;
@@ -782,10 +786,12 @@ errlHndl_t tpmLogConfigEntries(TRUSTEDBOOT::TpmTarget* const i_pTpm)
         const TPM_Pcr l_pcrs[] = {PCR_1,PCR_4,PCR_5,PCR_6};
         for (size_t i = 0; i < (sizeof(l_pcrs)/sizeof(TPM_Pcr)) ; ++i)
         {
+            uint8_t l_nodeIdLogMsg[] = "Node id";
             l_err = pcrExtend(l_pcrs[i],
                               (l_pcrs[i] == PCR_1 ?
                                EV_PLATFORM_CONFIG_FLAGS : EV_COMPACT_HASH),
-                              l_digest, sizeof(l_nodeid),"Node id");
+                              l_digest, sizeof(l_nodeid), l_nodeIdLogMsg,
+                              sizeof(l_nodeIdLogMsg));
             if (l_err)
             {
                 break;
@@ -800,9 +806,11 @@ errlHndl_t tpmLogConfigEntries(TRUSTEDBOOT::TpmTarget* const i_pTpm)
         memset(l_digest, 0, sizeof(uint64_t));
         bool l_tpmRequired = isTpmRequired();
         l_digest[0] = static_cast<uint8_t>(l_tpmRequired);
+        uint8_t l_tpmRequiredLogMsg[] = "Tpm Required";
         l_err = pcrExtend(PCR_1, EV_PLATFORM_CONFIG_FLAGS,
                           l_digest, sizeof(l_tpmRequired),
-                          "Tpm Required");
+                          l_tpmRequiredLogMsg,
+                          sizeof(l_tpmRequiredLogMsg));
         if (l_err)
         {
             break;
@@ -811,9 +819,11 @@ errlHndl_t tpmLogConfigEntries(TRUSTEDBOOT::TpmTarget* const i_pTpm)
         // HW Key Hash
         SHA512_t l_hw_key_hash;
         SECUREBOOT::getHwKeyHash(l_hw_key_hash);
+        uint8_t l_hwKeyHashLogMsg[] = "HW KEY HASH";
         l_err = pcrExtend(PCR_1, EV_PLATFORM_CONFIG_FLAGS,
                           l_hw_key_hash,
-                          sizeof(SHA512_t),"HW KEY HASH");
+                          sizeof(SHA512_t),l_hwKeyHashLogMsg,
+                          sizeof(l_hwKeyHashLogMsg));
         if (l_err)
         {
             break;
@@ -830,7 +840,8 @@ void pcrExtendSingleTpm(TpmTarget* const i_pTpm,
                         TPM_Alg_Id i_algId,
                         const uint8_t* i_digest,
                         size_t  i_digestSize,
-                        const char* i_logMsg)
+                        const uint8_t* i_logMsg,
+                        const size_t i_logMsgSize)
 {
     assert(i_pTpm != nullptr,"pcrExtendSingleTpm: BUG! i_pTpm was nullptr");
     assert(i_pTpm->getAttr<TARGETING::ATTR_TYPE>() == TARGETING::TYPE_TPM,
@@ -882,7 +893,8 @@ void pcrExtendSingleTpm(TpmTarget* const i_pTpm,
                                                           TPM_ALG_SHA1,
                                                           i_digest,
                                                           i_digestSize,
-                                                          i_logMsg);
+                                                          i_logMsg,
+                                                          i_logMsgSize);
                 if(useStaticLog)
                 {
                     auto * const pTpmLogMgr = getTpmLogMgr(i_pTpm);
@@ -949,7 +961,7 @@ void pcrExtendSeparator(TpmTarget* const i_pTpm)
         0xA6, 0xA9, 0xF7, 0x60, 0x79, 0xE4, 0x8B, 0xF0,
         0x90, 0xAC, 0xB7, 0xE8, 0x36, 0x7B, 0xFD, 0x0E};
     // The event message is 0xFFFFFFFF
-    const char logMsg[] = { 0xFF, 0xFF, 0xFF, 0xFF, '\0'};
+    const uint8_t logMsg[] = { 0xFF, 0xFF, 0xFF, 0xFF };
 
     memset(&eventLog, 0, sizeof(eventLog));
     do
@@ -995,7 +1007,8 @@ void pcrExtendSeparator(TpmTarget* const i_pTpm)
                                                           TPM_ALG_SHA256,
                                                           sha256_digest,
                                                           sizeof(sha256_digest),
-                                                          logMsg);
+                                                          logMsg,
+                                                          sizeof(logMsg));
 
                 if(useStaticLog)
                 {
@@ -1595,6 +1608,26 @@ errlHndl_t doPcrRead(TpmTarget* i_target,
     return l_errl;
 }
 
+errlHndl_t doExpandTpmLog(TpmTarget* i_target)
+{
+    errlHndl_t l_errl = nullptr;
+
+    do {
+    l_errl = validateTpmHandle(i_target);
+    if(l_errl)
+    {
+        break;
+    }
+
+    l_errl = tpmCmdExpandTpmLog(i_target);
+    if(l_errl)
+    {
+        break;
+    }
+    } while(0);
+    return l_errl;
+}
+
 void* tpmDaemon(void* unused)
 {
     bool shutdownPending = false;
@@ -1671,7 +1704,9 @@ void* tpmDaemon(void* unused)
                                    msgData->mDigest,
                                    msgData->mDigestSize,
                                    msgData->mMirrorToLog? msgData->mLogMsg:
-                                                                      nullptr);
+                                                                      nullptr,
+                                   msgData->mMirrorToLog? msgData->mLogMsgSize:
+                                                                      0);
                   }
 
                   // Lastly make sure we are in a state
@@ -1856,6 +1891,14 @@ void* tpmDaemon(void* unused)
                                               l_data->digest);
               }
               break;
+          case TRUSTEDBOOT::MSG_TYPE_EXPAND_TPM_LOG:
+              {
+                  tb_msg = static_cast<TRUSTEDBOOT::Message*>(msg->extra_data);
+                  TpmTargetData* l_data =
+                              reinterpret_cast<TpmTargetData*>(tb_msg->iv_data);
+                  tb_msg->iv_errl = doExpandTpmLog(l_data->tpm);
+              }
+              break;
 
           default:
             assert(false, "Invalid msg command");
@@ -2242,6 +2285,7 @@ errlHndl_t poisonTpm(const TpmTarget* i_pTpm)
                            reinterpret_cast<sha2_byte*>(&l_randNum),
                            sizeof(l_randNum),
                            nullptr, // log not needed for poison operation
+                           0,       // log size is 0
                            false,   // call synchronously to daemon
                            i_pTpm,  // only extend to pcr banks for this TPM
                            false);  // don't add PCR measurement to the log
diff --git a/src/usr/secureboot/trusted/trustedboot.H b/src/usr/secureboot/trusted/trustedboot.H
index 53ddb40fc..6314a8733 100644
--- a/src/usr/secureboot/trusted/trustedboot.H
+++ b/src/usr/secureboot/trusted/trustedboot.H
@@ -160,7 +160,8 @@ void pcrExtendSingleTpm(TpmTarget* i_pTpm,
                         TPM_Alg_Id i_algId,
                         const uint8_t* i_digest,
                         size_t  i_digestSize,
-                        const char* i_logMsg);
+                        const uint8_t* i_logMsg,
+                        size_t i_logMsgSize);
 
 /**
  *  @brief Extend a separator into a TPM and log
diff --git a/src/usr/secureboot/trusted/trustedbootCmds.C b/src/usr/secureboot/trusted/trustedbootCmds.C
index c989de719..12ce871b6 100644
--- a/src/usr/secureboot/trusted/trustedbootCmds.C
+++ b/src/usr/secureboot/trusted/trustedbootCmds.C
@@ -49,6 +49,7 @@
 #include "trustedboot.H"
 #include "trustedTypes.H"
 #include <secureboot/trustedbootif.H>
+#include "tpmLogMgr.H"
 
 #ifdef CONFIG_DRTM
 #include <secureboot/drtm.H>
@@ -411,6 +412,7 @@ errlHndl_t tpmUnmarshalResponseData(uint32_t i_commandCode,
                                     reinterpret_cast<TPM2_NVReadOut*>(o_outBuf);
                   TPM2_NVReadOut* l_tpmRespData =
                                    reinterpret_cast<TPM2_NVReadOut*>(i_respBuf);
+                  l_respPtr->authSessionSize = l_tpmRespData->authSessionSize;
                   memcpy(reinterpret_cast<uint8_t*>(&l_tpmRespData->data),
                          reinterpret_cast<uint8_t*>(&l_respPtr->data),
                          sizeof(l_tpmRespData->data));
@@ -1596,6 +1598,52 @@ errlHndl_t tpmCmdFlushContext(TpmTarget* i_target)
     return l_errl;
 }
 
+errlHndl_t tpmCmdExpandTpmLog(TpmTarget* i_target)
+{
+    TRACFCOMP(g_trac_trustedboot, ENTER_MRK"tpmCmdExpandTpmLog()");
+    errlHndl_t l_errl = nullptr;
+
+    do {
+    auto l_tpmLogMgr = getTpmLogMgr(i_target);
+    if(!l_tpmLogMgr)
+    {
+        TRACFCOMP(g_trac_trustedboot, ERR_MRK"tpmCmdExpandTpmLog: could not fetch TPM log manager for TPM HUID 0x%x", TARGETING::get_huid(i_target));
+        /*@
+         * @errortype  ERRL_SEV_UNRECOVERABLE
+         * @reasoncode RC_NO_TPM_LOG_MGR
+         * @moduleid   MOD_TPM_CMD_EXPAND_TPM_LOG
+         * @userdata1  TPM HUID
+         * @devdesc    Could not fetch the TPM log manager
+         * @custdesc   trustedboot failure
+         */
+        l_errl = tpmCreateErrorLog(MOD_TPM_CMD_EXPAND_TPM_LOG,
+                                   RC_NO_TPM_LOG_MGR,
+                                   TARGETING::get_huid(i_target),
+                                   0);
+        break;
+    }
+
+    mutex_lock(&l_tpmLogMgr->logMutex);
+
+    assert(l_tpmLogMgr->eventLogInMem == nullptr, "tpmCmdExpandTpmLog: the TPM log manager has already been moved/expanded");
+    l_tpmLogMgr->eventLogInMem = new uint8_t[TPMLOG_DEVTREE_SIZE]();
+    l_tpmLogMgr->logMaxSize = TPMLOG_DEVTREE_SIZE;
+
+    memcpy(l_tpmLogMgr->eventLogInMem,
+           l_tpmLogMgr->eventLog,
+           l_tpmLogMgr->logSize);
+
+    l_tpmLogMgr->newEventPtr = l_tpmLogMgr->eventLogInMem +l_tpmLogMgr->logSize;
+
+    // Remove the old log
+    memset(l_tpmLogMgr->eventLog, 0, l_tpmLogMgr->logSize);
+
+    mutex_unlock(&l_tpmLogMgr->logMutex);
+    } while(0);
+    TRACFCOMP(g_trac_trustedboot, EXIT_MRK"tpmCmdExpandTpmLog()");
+    return l_errl;
+}
+
 #ifdef __cplusplus
 } // end TRUSTEDBOOT
 #endif
diff --git a/src/usr/secureboot/trusted/trustedbootCmds.H b/src/usr/secureboot/trusted/trustedbootCmds.H
index 571b5224c..57b3e519c 100644
--- a/src/usr/secureboot/trusted/trustedbootCmds.H
+++ b/src/usr/secureboot/trusted/trustedbootCmds.H
@@ -214,6 +214,15 @@ errlHndl_t tpmCmdGenerateQuote(TpmTarget* i_target,
  */
 errlHndl_t tpmCmdFlushContext(TpmTarget* i_target);
 
+/**
+ * @brief Send the command to the given TPM to increase its TPM log size.
+ *        The new TPM log is allocated on the heap, and the caller is
+ *        responsible for cleaning it up.
+ * @param[in] i_target the TPM target (must not be nullptr)
+ * @return nullptr on success; non-nullptr on error
+ */
+errlHndl_t tpmCmdExpandTpmLog(TpmTarget* i_target);
+
 
 #ifdef __cplusplus
 } // end TRUSTEDBOOT namespace