ta: pkcs11: implement command PKCS11_CMD_SET_PIN

PKCS11_CMD_SET_PIN implements C_SetPIN() client API function that is in
charge of modifying a login PIN.

Acked-by: Rouven Czerwinski <r.czerwinski@p

ta: pkcs11: implement command PKCS11_CMD_SET_PIN

PKCS11_CMD_SET_PIN implements C_SetPIN() client API function that is in
charge of modifying a login PIN.

Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: implement command PKCS11_CMD_INIT_PIN

PKCS11_CMD_INIT_PIN implements C_InitPIN() client API function that is in
charge of initializing the normal user login PIN. Security Officer must
b

ta: pkcs11: implement command PKCS11_CMD_INIT_PIN

PKCS11_CMD_INIT_PIN implements C_InitPIN() client API function that is in
charge of initializing the normal user login PIN. Security Officer must
be logged to current session in order to call this function

Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: implement command PKCS11_CMD_INIT_TOKEN

PKCS11_CMD_INIT_TOKEN implements C_InitToken() client API function that
is in charge of initializing the Security Officer login PIN if not
already

ta: pkcs11: implement command PKCS11_CMD_INIT_TOKEN

PKCS11_CMD_INIT_TOKEN implements C_InitToken() client API function that
is in charge of initializing the Security Officer login PIN if not
already done and destroy objects that can be. As objects are not yet
supported in the TA, this later feature is not implemented.

Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: helper to update token persistent database

update_persistent_db() updates the persistent database or panics on
failure.

Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Co-deve

ta: pkcs11: helper to update token persistent database

update_persistent_db() updates the persistent database or panics on
failure.

Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: update PIN fields in struct token_persistent_main

Replaces the fields use to keep track of encrypted PINs with fields to
keep track of hashed PINs instead.

Acked-by: Rouven Czerwinski <

ta: pkcs11: update PIN fields in struct token_persistent_main

Replaces the fields use to keep track of encrypted PINs with fields to
keep track of hashed PINs instead.

Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: helpers for PIN hashing

Adds helpers to hash PIN and to verify the hash of a PIN. The PIN is
hashed together with user type and a generated salt. A used salt never
takes the value 0 so t

ta: pkcs11: helpers for PIN hashing

Adds helpers to hash PIN and to verify the hash of a PIN. The PIN is
hashed together with user type and a generated salt. A used salt never
takes the value 0 so that can be used to tell if a PIN is set.

Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: helper for GPD TEE to PKCS#11 status conversion

Introduce helper function pkcs2tee_error() for the several TEE Core
Internal APIs called for which return value needs to be reported to
ca

ta: pkcs11: helper for GPD TEE to PKCS#11 status conversion

Introduce helper function pkcs2tee_error() for the several TEE Core
Internal APIs called for which return value needs to be reported to
caller in PKCS#11 return code format.

The function returns PKCS11_CKR_GENERAL_ERROR for TEE_Result values that
do not strictly match a PKCS#11 return code.

Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: drop derive from AES_ECB

Drop key derivation as a capability of mechanisms AES_ECB as not part
of the PKCS#11 specification.

Reported-by: Ricardo Salveti <ricardo@foundries.io>
Signed-o

ta: pkcs11: drop derive from AES_ECB

Drop key derivation as a capability of mechanisms AES_ECB as not part
of the PKCS#11 specification.

Reported-by: Ricardo Salveti <ricardo@foundries.io>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: fix MECHANISM_IDS to return OK when no output buffer

Fix PKCS11 TA command PKCS11_CMD_MECHANISM_IDS to handle case
where client provides a NULL buffer reference when querying the
list of

ta: pkcs11: fix MECHANISM_IDS to return OK when no output buffer

Fix PKCS11 TA command PKCS11_CMD_MECHANISM_IDS to handle case
where client provides a NULL buffer reference when querying the
list of supported mechanism IDs. In such case TA should return OK,
not PKCS11_CKR_BUFFER_TOO_SMALL.

This change is needed since commit [1] that makes an OP-TEE TA able
to receive memref parameters with a NULL buffer reference.

Link: [1] 20b567068a37 ("libutee: flag NULL pointer using invalid shm id")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: remove inline comment about persistent object database

Remove inline comment that is not relevant since PKCS11 object
database is not implemented yet.

Signed-off-by: Etienne Carriere <e

ta: pkcs11: remove inline comment about persistent object database

Remove inline comment that is not relevant since PKCS11 object
database is not implemented yet.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: fixup header file inclusion ordering

Fix order of included header files where applicable.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Rouven Czerwinski <r

ta: pkcs11: fixup header file inclusion ordering

Fix order of included header files where applicable.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: fixup user id in init_pin_key()

Minor simplification of init_pin_keys() prototype. Change argument
unsigned int uid to enum pkcs11_user_type type since it's what is
provided by the calle

ta: pkcs11: fixup user id in init_pin_key()

Minor simplification of init_pin_keys() prototype. Change argument
unsigned int uid to enum pkcs11_user_type type since it's what is
provided by the called and expected by the function.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: session commands support

Add and remove session from session list owned by the client
session. Generate client session IDs using handle.c (produced
indices like starting from 1).

entry_

ta: pkcs11: session commands support

Add and remove session from session list owned by the client
session. Generate client session IDs using handle.c (produced
indices like starting from 1).

entry_ck_open_session(): uses set_session_state() to default
new session instances.

entry_ck_close_session() and entry_ck_close_all_sessions() use
close_ck_session() to factorize session resource release.

entry_ck_session_info() reads session state as when called.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: register a client instance for each opened TEE session

Each TEE session open toward the TA creates a client reference. It can
be used by command handlers to identify client. Client refer

ta: pkcs11: register a client instance for each opened TEE session

Each TEE session open toward the TA creates a client reference. It can
be used by command handlers to identify client. Client reference is
passed between TA and client library using the TEE session argument
in the GPD TEE Client API. Value used is the client instance address
in the TA (as a void *) and is abstracted with an opaque ID by OP-TEE
Core between being exposed to client.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: handle database for various client references

Dump core/kernel/handle.c into PKCS11 TA source tree with some
changes:
- Remove ptr_destructor() support,
- Adapt the TEE Internal APIs (I.

ta: pkcs11: handle database for various client references

Dump core/kernel/handle.c into PKCS11 TA source tree with some
changes:
- Remove ptr_destructor() support,
- Adapt the TEE Internal APIs (I.e. TEE_MemMove() instead of memcpy()),
- Produce 32bit IDs starting from 1, 0 is reserved as undefined reference.

Most handles return by the TA to the client are 32bit unsigned values
as per TA API. handle.c will manage these IDs.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: add mechanism info and session command to helpers

Add mechanism info and session management command IDs in debug
helpers of the PKCS11 TA.

Signed-off-by: Etienne Carriere <etienne.carri

ta: pkcs11: add mechanism info and session command to helpers

Add mechanism info and session management command IDs in debug
helpers of the PKCS11 TA.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: define TA commands related to session management

Define commands PKCS11_CMD_CLOSE_SESSION, PKCS11_CMD_CLOSE_SESSION,
PKCS11_CMD_CLOSE_SESSION and PKCS11_CMD_CLOSE_SESSION and related
res

ta: pkcs11: define TA commands related to session management

Define commands PKCS11_CMD_CLOSE_SESSION, PKCS11_CMD_CLOSE_SESSION,
PKCS11_CMD_CLOSE_SESSION and PKCS11_CMD_CLOSE_SESSION and related
resources in the PKCS11 TA API.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: command to get mechanism info

Implement command PKCS11_CMD_MECHANISM_INFO for client to get
information on a specific mechanism embedded in a token.

Signed-off-by: Etienne Carriere <eti

ta: pkcs11: command to get mechanism info

Implement command PKCS11_CMD_MECHANISM_INFO for client to get
information on a specific mechanism embedded in a token.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: command to get mechanisms embedded in a token

Implement command PKCS11_CMD_MECHANISM_IDS for client to get
IDs of the mechanisms embedded in a token

Signed-off-by: Etienne Carriere <eti

ta: pkcs11: command to get mechanisms embedded in a token

Implement command PKCS11_CMD_MECHANISM_IDS for client to get
IDs of the mechanisms embedded in a token

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: support for mechanism embedded in a token

Implement token_capabilities.c to centralize the mechanisms supported
by a token. As PKCS11 TA can implemented several token, each token
may pro

ta: pkcs11: support for mechanism embedded in a token

Implement token_capabilities.c to centralize the mechanisms supported
by a token. As PKCS11 TA can implemented several token, each token
may provide support for a restricted list of mechanisms and processing
over these mechanisms.

Array pkcs11_modes[] is used to strictly define the processing that
are allowed for a mechanism as per PKCS#11 specification.

Conversion of a mechanism ID into a debug friendly string is implemented
in token_capabilities.c rather than pkcs11_helpers.c as for the other
string helpers since the source file already defines the list of the
valid mechanism IDs, hence an indirection from id2str_mechanism()
to mechanism_string_id().

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: define mechanism info resources in ta api

Define mechanism info structure returned by the TA on command
PKCS11_CMD_MECHANISM_INFO related to client API function
C_GetMechanismInfo().

Th

ta: pkcs11: define mechanism info resources in ta api

Define mechanism info structure returned by the TA on command
PKCS11_CMD_MECHANISM_INFO related to client API function
C_GetMechanismInfo().

This change also define mechanism identifier for AES ECB in the TA API
even if this mechanism is not yet supported by the TA. This change is
needed to serve as an example of a mechanism for which a client can
invoke the PKCS11 TA to get information from.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: factorize persistent file name

get_db_file_name() and get_pin_file_name() factorize TEE object file
IDs.

open_db_file() and open_pin_file() factorize opening of TA persistent
database o

ta: pkcs11: factorize persistent file name

get_db_file_name() and get_pin_file_name() factorize TEE object file
IDs.

open_db_file() and open_pin_file() factorize opening of TA persistent
database object and PIN cipher key objects.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: fix token flags as per specification

Fix the token flags position that are expected to match the PKCS#11
specification and did not.

Fixes: a67dc424ff106 ("ta: pkcs11: API for slot/token

ta: pkcs11: fix token flags as per specification

Fix the token flags position that are expected to match the PKCS#11
specification and did not.

Fixes: a67dc424ff106 ("ta: pkcs11: API for slot/token information")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: identify user as per define user types

Define users with CKU User Type in Cryptoki API:
PKCS11_CKU_SO and PKCS11_CKU_USER. They will be used as identifiers
for login and related PKCS#11

ta: pkcs11: identify user as per define user types

Define users with CKU User Type in Cryptoki API:
PKCS11_CKU_SO and PKCS11_CKU_USER. They will be used as identifiers
for login and related PKCS#11 API functions.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: use sizeof(rc) instead of sizeof(uint32_t)

Prefer sizeof() to use rc reference rather than explicit 32bit.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jer

ta: pkcs11: use sizeof(rc) instead of sizeof(uint32_t)

Prefer sizeof() to use rc reference rather than explicit 32bit.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...