refactor(measured boot): make measurement strings compliant with SBSG
Made measurement strings compliant to Server Base Security Guide
(SBSG, Arm DEN 0086) hence updated measurement strings for BL32, BL31,
and SCP_BL2 images. As the GPT image is not get measured by BL2 so
removed its measurement string.
Also, namespaced measurement string defines that were looking quite
generic.
Change-Id: Iaa17c0cfeee3d06dc822eff2bd553da23bd99b76
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
diff --git a/include/drivers/measured_boot/event_log/event_log.h b/include/drivers/measured_boot/event_log/event_log.h
index 0d22d87..c6eb29c 100644
--- a/include/drivers/measured_boot/event_log/event_log.h
+++ b/include/drivers/measured_boot/event_log/event_log.h
@@ -42,21 +42,41 @@
#define MEMBER_SIZE(type, member) sizeof(((type *)0)->member)
-#define BL2_STRING "BL_2"
-#define BL31_STRING "BL_31"
-#define BL32_STRING "BL_32"
-#define BL32_EXTRA1_IMAGE_STRING "BL32_EXTRA1_IMAGE"
-#define BL32_EXTRA2_IMAGE_STRING "BL32_EXTRA2_IMAGE"
-#define BL33_STRING "BL_33"
-#define FW_CONFIG_STRING "FW_CONFIG"
-#define GPT_IMAGE_STRING "GPT"
-#define HW_CONFIG_STRING "HW_CONFIG"
-#define NT_FW_CONFIG_STRING "NT_FW_CONFIG"
-#define SCP_BL2_IMAGE_STRING "SCP_BL2_IMAGE"
-#define SOC_FW_CONFIG_STRING "SOC_FW_CONFIG"
-#define STM32_IMAGE_STRING "STM32"
-#define TB_FW_CONFIG_STRING "TB_FW_CONFIG"
-#define TOS_FW_CONFIG_STRING "TOS_FW_CONFIG"
+/*
+ * Each event log entry has some metadata (i.e. a string) that identifies
+ * what is measured.These macros define these strings.
+ * Note that these strings follow the standardization recommendations
+ * defined in the Arm Server Base Security Guide (a.k.a. SBSG, Arm DEN 0086),
+ * where applicable. They should not be changed in the code.
+ * Where the SBSG does not make recommendations, we are free to choose any
+ * naming convention.
+ * The key thing is to choose meaningful strings so that when the TPM event
+ * log is used in attestation, the different components can be identified.
+ */
+#define EVLOG_BL2_STRING "BL_2"
+#define EVLOG_BL31_STRING "SECURE_RT_EL3"
+#if defined(SPD_opteed)
+#define EVLOG_BL32_STRING "SECURE_RT_EL1_OPTEE"
+#elif defined(SPD_tspd)
+#define EVLOG_BL32_STRING "SECURE_RT_EL1_TSPD"
+#elif defined(SPD_tlkd)
+#define EVLOG_BL32_STRING "SECURE_RT_EL1_TLKD"
+#elif defined(SPD_trusty)
+#define EVLOG_BL32_STRING "SECURE_RT_EL1_TRUSTY"
+#else
+#define EVLOG_BL32_STRING "SECURE_RT_EL1_UNKNOWN"
+#endif
+#define EVLOG_BL32_EXTRA1_STRING "SECURE_RT_EL1_OPTEE_EXTRA1"
+#define EVLOG_BL32_EXTRA2_STRING "SECURE_RT_EL1_OPTEE_EXTRA2"
+#define EVLOG_BL33_STRING "BL_33"
+#define EVLOG_FW_CONFIG_STRING "FW_CONFIG"
+#define EVLOG_HW_CONFIG_STRING "HW_CONFIG"
+#define EVLOG_NT_FW_CONFIG_STRING "NT_FW_CONFIG"
+#define EVLOG_SCP_BL2_STRING "SYS_CTRL_2"
+#define EVLOG_SOC_FW_CONFIG_STRING "SOC_FW_CONFIG"
+#define EVLOG_STM32_STRING "STM32"
+#define EVLOG_TB_FW_CONFIG_STRING "TB_FW_CONFIG"
+#define EVLOG_TOS_FW_CONFIG_STRING "TOS_FW_CONFIG"
typedef struct {
unsigned int id;
diff --git a/plat/arm/board/fvp/fvp_bl1_measured_boot.c b/plat/arm/board/fvp/fvp_bl1_measured_boot.c
index 8815b74..47af1f5 100644
--- a/plat/arm/board/fvp/fvp_bl1_measured_boot.c
+++ b/plat/arm/board/fvp/fvp_bl1_measured_boot.c
@@ -14,9 +14,9 @@
/* FVP table with platform specific image IDs, names and PCRs */
const event_log_metadata_t fvp_event_log_metadata[] = {
- { FW_CONFIG_ID, FW_CONFIG_STRING, PCR_0 },
- { TB_FW_CONFIG_ID, TB_FW_CONFIG_STRING, PCR_0 },
- { BL2_IMAGE_ID, BL2_STRING, PCR_0 },
+ { FW_CONFIG_ID, EVLOG_FW_CONFIG_STRING, PCR_0 },
+ { TB_FW_CONFIG_ID, EVLOG_TB_FW_CONFIG_STRING, PCR_0 },
+ { BL2_IMAGE_ID, EVLOG_BL2_STRING, PCR_0 },
{ INVALID_ID, NULL, (unsigned int)(-1) } /* Terminator */
};
diff --git a/plat/arm/board/fvp/fvp_bl2_measured_boot.c b/plat/arm/board/fvp/fvp_bl2_measured_boot.c
index 16e8d79..5ebfede 100644
--- a/plat/arm/board/fvp/fvp_bl2_measured_boot.c
+++ b/plat/arm/board/fvp/fvp_bl2_measured_boot.c
@@ -14,16 +14,16 @@
/* FVP table with platform specific image IDs, names and PCRs */
const event_log_metadata_t fvp_event_log_metadata[] = {
- { BL31_IMAGE_ID, BL31_STRING, PCR_0 },
- { BL32_IMAGE_ID, BL32_STRING, PCR_0 },
- { BL32_EXTRA1_IMAGE_ID, BL32_EXTRA1_IMAGE_STRING, PCR_0 },
- { BL32_EXTRA2_IMAGE_ID, BL32_EXTRA2_IMAGE_STRING, PCR_0 },
- { BL33_IMAGE_ID, BL33_STRING, PCR_0 },
- { HW_CONFIG_ID, HW_CONFIG_STRING, PCR_0 },
- { NT_FW_CONFIG_ID, NT_FW_CONFIG_STRING, PCR_0 },
- { SCP_BL2_IMAGE_ID, SCP_BL2_IMAGE_STRING, PCR_0 },
- { SOC_FW_CONFIG_ID, SOC_FW_CONFIG_STRING, PCR_0 },
- { TOS_FW_CONFIG_ID, TOS_FW_CONFIG_STRING, PCR_0 },
+ { BL31_IMAGE_ID, EVLOG_BL31_STRING, PCR_0 },
+ { BL32_IMAGE_ID, EVLOG_BL32_STRING, PCR_0 },
+ { BL32_EXTRA1_IMAGE_ID, EVLOG_BL32_EXTRA1_STRING, PCR_0 },
+ { BL32_EXTRA2_IMAGE_ID, EVLOG_BL32_EXTRA2_STRING, PCR_0 },
+ { BL33_IMAGE_ID, EVLOG_BL33_STRING, PCR_0 },
+ { HW_CONFIG_ID, EVLOG_HW_CONFIG_STRING, PCR_0 },
+ { NT_FW_CONFIG_ID, EVLOG_NT_FW_CONFIG_STRING, PCR_0 },
+ { SCP_BL2_IMAGE_ID, EVLOG_SCP_BL2_STRING, PCR_0 },
+ { SOC_FW_CONFIG_ID, EVLOG_SOC_FW_CONFIG_STRING, PCR_0 },
+ { TOS_FW_CONFIG_ID, EVLOG_TOS_FW_CONFIG_STRING, PCR_0 },
{ INVALID_ID, NULL, (unsigned int)(-1) } /* Terminator */
};