STATOAHL

Data format: This data matches the output from the secure bootloader of the adapter. Assuming the same nonce is provided and given correct ordering of operations (query the bootloader first) the payload data hashes to the same value as that data provided by the secure bootloader.

The overall structure is called health_t, as indicated by the enumerated value in the first struct_id_t name field. This contains multiple sub-structures, each reproduced here.

In this section are three var_t structures, followed in the next section by three segment identifiers that are pointed to by the var_t structures.

If type is FAM_OWNER, the adapterID is a bit vector that specifies onto which device families the image identified by the mbid_t parameter may be loaded. An attempt to load an image onto a device belonging to a family whose bit in adapterID is not set, will fail.

This var_t parameter indicates the offset from byte 0 of this field to the beginning of the public key which describes the segment that this mbid_t represents.

A firmware load operation is actually a pre-packaged and signed *command*, as recognized by the secure bootloader in the adapter. While it is commonly said that the firmware is signed, it is more accurate to say that the firmware load command is signed, and includes the new firmware. Each firmware load command has been signed by the owner of a signing key, and this owner becomes the owner of the segment after the owner’s firmware has been loaded. Thus we refer to the ‘segment owner’ as the person who held the private key that signed the command to load the firmware for that segment. Each firmware load command package also includes a signed version of the public key of the ‘segment owner’ for the segment to be loaded. The segment owner public key signature has been computed with the private key of the owner of the lower segment that is expected to have been installed. For example, consider load of a new segment 2:

1. The segment 2 load command is a binary software image, with:
   1. firmware image for new segment 2
   2. command of how to load the segment 2
   3. signature over the firmware image and command, calculated with segment 2 owner private key
   4. segment 2 owner public key
   5. signature over segment 2 owner public key calculated with segment 1 owner private key
2. The secure boot loader
   1. uses segment 1 owner public key to verify signature over segment 2 owner public key
   2. uses segment 2 owner public key to verify signature over firmware and command
   3. executes the command.

Given the above explanation, it is now possible to say that the public key included in the mbid_t is the segment owner public key for the segment that the mbid_t describes. If the mbid_t describes segment 1, then the segment 1 owner public key is included at the end of the mbid_t when returned from the adapter.

Length is 66 bytes for ECC P521 key + padding bytes for hardware use of the value.

Begin signature section sig-section (if SIGNSTAT passed)

VUD fields + signed_data_t:          30 bytes
Rom_status_t:                       294 bytes
Nonce:                               32 bytes
var_t array (describing mbid_t):     24 bytes
mbid_t array:                      1059 bytes
Signature section and hash:         196 bytes
Total:                             1634 bytes