feat(dice): add cert_id argument to dpe_derive_context()
This custom argument is meant to simplify to group
components into certificates. Components with
the same cert_id contribute to the same certificate
regardless of the load order or the structure of the
derivation tree. This argument aims to flatten the tree
structure and make it easy to include branches or
subtrees in the main derivation line.
Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Change-Id: I83c4abc399616063a5eb04792d603899f7513627
diff --git a/include/drivers/measured_boot/rss/dice_prot_env.h b/include/drivers/measured_boot/rss/dice_prot_env.h
index b7fcf36..6f754f5 100644
--- a/include/drivers/measured_boot/rss/dice_prot_env.h
+++ b/include/drivers/measured_boot/rss/dice_prot_env.h
@@ -17,6 +17,7 @@
struct dpe_metadata {
unsigned int id;
+ uint32_t cert_id;
uint8_t signer_id[SIGNER_ID_MAX_SIZE];
size_t signer_id_size;
uint8_t version[VERSION_MAX_SIZE];
diff --git a/include/lib/psa/dice_protection_environment.h b/include/lib/psa/dice_protection_environment.h
index ddf9aa7..61b6482 100644
--- a/include/lib/psa/dice_protection_environment.h
+++ b/include/lib/psa/dice_protection_environment.h
@@ -41,6 +41,8 @@
*
* \param[in] context_handle Input context handle for the DPE
* context.
+ * \param[in] cert_id Logical certificate id to which derived
+ * context belongs to.
* \param[in] retain_parent_context Flag to indicate whether to retain the
* parent context. True only if a client
* will call further DPE commands on the
@@ -77,6 +79,7 @@
* \return Returns error code of type dpe_error_t
*/
dpe_error_t dpe_derive_context(int context_handle,
+ uint32_t cert_id,
bool retain_parent_context,
bool allow_new_context_to_derive,
bool create_certificate,