1c84ccd0aSEtienne Carriere /* SPDX-License-Identifier: BSD-2-Clause */ 2c84ccd0aSEtienne Carriere /* 3c84ccd0aSEtienne Carriere * Copyright (c) 2017-2020, Linaro Limited 4c84ccd0aSEtienne Carriere */ 5c84ccd0aSEtienne Carriere #ifndef PKCS11_TA_PKCS11_TOKEN_H 6c84ccd0aSEtienne Carriere #define PKCS11_TA_PKCS11_TOKEN_H 7c84ccd0aSEtienne Carriere 8c84ccd0aSEtienne Carriere #include <sys/queue.h> 9c84ccd0aSEtienne Carriere #include <tee_api_types.h> 10c84ccd0aSEtienne Carriere #include <tee_internal_api.h> 11c84ccd0aSEtienne Carriere 12*ce94efefSEtienne Carriere /* Hard coded description */ 13*ce94efefSEtienne Carriere #define PKCS11_SLOT_DESCRIPTION "OP-TEE PKCS11 TA" 14*ce94efefSEtienne Carriere #define PKCS11_SLOT_MANUFACTURER "Linaro" 15*ce94efefSEtienne Carriere #define PKCS11_SLOT_HW_VERSION { 0, 0 } 16*ce94efefSEtienne Carriere #define PKCS11_SLOT_FW_VERSION { PKCS11_TA_VERSION_MAJOR, \ 17*ce94efefSEtienne Carriere PKCS11_TA_VERSION_MINOR } 18*ce94efefSEtienne Carriere 19c84ccd0aSEtienne Carriere enum pkcs11_token_state { 20c84ccd0aSEtienne Carriere PKCS11_TOKEN_RESET = 0, 21c84ccd0aSEtienne Carriere PKCS11_TOKEN_READ_WRITE, 22c84ccd0aSEtienne Carriere PKCS11_TOKEN_READ_ONLY, 23c84ccd0aSEtienne Carriere }; 24c84ccd0aSEtienne Carriere 25c84ccd0aSEtienne Carriere #define PKCS11_MAX_USERS 2 26c84ccd0aSEtienne Carriere #define PKCS11_TOKEN_PIN_SIZE 128 27c84ccd0aSEtienne Carriere 28c84ccd0aSEtienne Carriere /* 29c84ccd0aSEtienne Carriere * Persistent state of the token 30c84ccd0aSEtienne Carriere * 31c84ccd0aSEtienne Carriere * @version - currently unused... 32c84ccd0aSEtienne Carriere * @label - pkcs11 formatted token label, set by client 33c84ccd0aSEtienne Carriere * @flags - pkcs11 token flags 34c84ccd0aSEtienne Carriere * @so_pin_count - counter on security officer login failure 35c84ccd0aSEtienne Carriere * @so_pin_size - byte size of the provisioned SO PIN 36c84ccd0aSEtienne Carriere * @so_pin - stores the SO PIN 37c84ccd0aSEtienne Carriere * @user_pin_count - counter on user login failure 38c84ccd0aSEtienne Carriere * @user_pin_size - byte size of the provisioned user PIN 39c84ccd0aSEtienne Carriere * @user_pin - stores the user PIN 40c84ccd0aSEtienne Carriere */ 41c84ccd0aSEtienne Carriere struct token_persistent_main { 42c84ccd0aSEtienne Carriere uint32_t version; 43c84ccd0aSEtienne Carriere uint8_t label[PKCS11_TOKEN_LABEL_SIZE]; 44c84ccd0aSEtienne Carriere uint32_t flags; 45c84ccd0aSEtienne Carriere uint32_t so_pin_count; 46c84ccd0aSEtienne Carriere uint32_t so_pin_size; 47c84ccd0aSEtienne Carriere uint8_t so_pin[PKCS11_TOKEN_PIN_SIZE]; 48c84ccd0aSEtienne Carriere uint32_t user_pin_count; 49c84ccd0aSEtienne Carriere uint32_t user_pin_size; 50c84ccd0aSEtienne Carriere uint8_t user_pin[PKCS11_TOKEN_PIN_SIZE]; 51c84ccd0aSEtienne Carriere }; 52c84ccd0aSEtienne Carriere 53c84ccd0aSEtienne Carriere /* 54c84ccd0aSEtienne Carriere * Runtime state of the token, complies with pkcs11 55c84ccd0aSEtienne Carriere * 56c84ccd0aSEtienne Carriere * @state - Pkcs11 login is public, user, SO or custom 57c84ccd0aSEtienne Carriere * @session_count - Counter for opened Pkcs11 sessions 58c84ccd0aSEtienne Carriere * @rw_session_count - Count for opened Pkcs11 read/write sessions 59c84ccd0aSEtienne Carriere * @db_main - Volatile copy of the persistent main database 60c84ccd0aSEtienne Carriere */ 61c84ccd0aSEtienne Carriere struct ck_token { 62c84ccd0aSEtienne Carriere enum pkcs11_token_state state; 63c84ccd0aSEtienne Carriere uint32_t session_count; 64c84ccd0aSEtienne Carriere uint32_t rw_session_count; 65c84ccd0aSEtienne Carriere /* Copy in RAM of the persistent database */ 66c84ccd0aSEtienne Carriere struct token_persistent_main *db_main; 67c84ccd0aSEtienne Carriere }; 68c84ccd0aSEtienne Carriere 69c84ccd0aSEtienne Carriere /* Initialize static token instance(s) from default/persistent database */ 70c84ccd0aSEtienne Carriere TEE_Result pkcs11_init(void); 71c84ccd0aSEtienne Carriere void pkcs11_deinit(void); 72c84ccd0aSEtienne Carriere 73d38f9635SEtienne Carriere /* Speculation safe lookup of token instance from token identifier */ 74c84ccd0aSEtienne Carriere struct ck_token *get_token(unsigned int token_id); 75c84ccd0aSEtienne Carriere 76c84ccd0aSEtienne Carriere /* Return token identified from token instance address */ 77c84ccd0aSEtienne Carriere unsigned int get_token_id(struct ck_token *token); 78c84ccd0aSEtienne Carriere 79c84ccd0aSEtienne Carriere /* Access to persistent database */ 80c84ccd0aSEtienne Carriere struct ck_token *init_persistent_db(unsigned int token_id); 81c84ccd0aSEtienne Carriere void close_persistent_db(struct ck_token *token); 82c84ccd0aSEtienne Carriere 8322ac6984SEtienne Carriere /* Entry point for the TA commands */ 8422ac6984SEtienne Carriere uint32_t entry_ck_slot_list(uint32_t ptypes, TEE_Param *params); 85*ce94efefSEtienne Carriere uint32_t entry_ck_slot_info(uint32_t ptypes, TEE_Param *params); 8622ac6984SEtienne Carriere 87c84ccd0aSEtienne Carriere #endif /*PKCS11_TA_PKCS11_TOKEN_H*/ 88