1 /* SPDX-License-Identifier: BSD-2-Clause */ 2 /* 3 * Copyright (c) 2017-2020, Linaro Limited 4 */ 5 #ifndef PKCS11_TA_PKCS11_TOKEN_H 6 #define PKCS11_TA_PKCS11_TOKEN_H 7 8 #include <sys/queue.h> 9 #include <tee_api_types.h> 10 #include <tee_internal_api.h> 11 12 #include "handle.h" 13 14 /* Hard coded description */ 15 #define PKCS11_SLOT_DESCRIPTION "OP-TEE PKCS11 TA" 16 #define PKCS11_SLOT_MANUFACTURER "Linaro" 17 #define PKCS11_SLOT_HW_VERSION { 0, 0 } 18 #define PKCS11_SLOT_FW_VERSION { PKCS11_TA_VERSION_MAJOR, \ 19 PKCS11_TA_VERSION_MINOR } 20 21 #define PKCS11_TOKEN_LABEL "OP-TEE PKCS#11 TA token" 22 #define PKCS11_TOKEN_MANUFACTURER PKCS11_SLOT_MANUFACTURER 23 #define PKCS11_TOKEN_MODEL "OP-TEE TA" 24 #define PKCS11_TOKEN_SERIAL_NUMBER "0000000000000000" 25 #define PKCS11_TOKEN_HW_VERSION PKCS11_SLOT_HW_VERSION 26 #define PKCS11_TOKEN_FW_VERSION PKCS11_SLOT_FW_VERSION 27 28 enum pkcs11_token_state { 29 PKCS11_TOKEN_RESET = 0, 30 PKCS11_TOKEN_READ_WRITE, 31 PKCS11_TOKEN_READ_ONLY, 32 }; 33 34 TAILQ_HEAD(client_list, pkcs11_client); 35 TAILQ_HEAD(session_list, pkcs11_session); 36 37 struct pkcs11_client; 38 39 #define PKCS11_MAX_USERS 2 40 #define PKCS11_TOKEN_PIN_SIZE_MAX 128 41 #define PKCS11_TOKEN_PIN_SIZE_MIN 10 42 43 /* 44 * Persistent state of the token 45 * 46 * @version - currently unused... 47 * @label - pkcs11 formatted token label, set by client 48 * @flags - pkcs11 token flags 49 * @so_pin_count - counter on security officer login failure 50 * @so_pin_size - byte size of the provisioned SO PIN 51 * @so_pin - stores the SO PIN 52 * @user_pin_count - counter on user login failure 53 * @user_pin_size - byte size of the provisioned user PIN 54 * @user_pin - stores the user PIN 55 */ 56 struct token_persistent_main { 57 uint32_t version; 58 uint8_t label[PKCS11_TOKEN_LABEL_SIZE]; 59 uint32_t flags; 60 uint32_t so_pin_count; 61 uint32_t so_pin_size; 62 uint8_t so_pin[PKCS11_TOKEN_PIN_SIZE_MAX]; 63 uint32_t user_pin_count; 64 uint32_t user_pin_size; 65 uint8_t user_pin[PKCS11_TOKEN_PIN_SIZE_MAX]; 66 }; 67 68 /* 69 * Runtime state of the token, complies with pkcs11 70 * 71 * @state - Pkcs11 login is public, user, SO or custom 72 * @session_count - Counter for opened Pkcs11 sessions 73 * @rw_session_count - Count for opened Pkcs11 read/write sessions 74 * @db_main - Volatile copy of the persistent main database 75 */ 76 struct ck_token { 77 enum pkcs11_token_state state; 78 uint32_t session_count; 79 uint32_t rw_session_count; 80 /* Copy in RAM of the persistent database */ 81 struct token_persistent_main *db_main; 82 }; 83 84 /* 85 * Structure tracking the PKCS#11 sessions 86 * 87 * @link - List of the session belonging to a client 88 * @client - Client the session belongs to 89 * @token - Token this session belongs to 90 * @handle - Identifier of the session published to the client 91 * @state - R/W SO, R/W user, RO user, R/W public, RO public. 92 */ 93 struct pkcs11_session { 94 TAILQ_ENTRY(pkcs11_session) link; 95 struct pkcs11_client *client; 96 struct ck_token *token; 97 uint32_t handle; 98 enum pkcs11_session_state state; 99 }; 100 101 /* Initialize static token instance(s) from default/persistent database */ 102 TEE_Result pkcs11_init(void); 103 void pkcs11_deinit(void); 104 105 /* Speculation safe lookup of token instance from token identifier */ 106 struct ck_token *get_token(unsigned int token_id); 107 108 /* Return token identified from token instance address */ 109 unsigned int get_token_id(struct ck_token *token); 110 111 /* Access to persistent database */ 112 struct ck_token *init_persistent_db(unsigned int token_id); 113 void close_persistent_db(struct ck_token *token); 114 115 enum pkcs11_rc hash_pin(enum pkcs11_user_type user, const uint8_t *pin, 116 size_t pin_size, uint32_t *salt, 117 uint8_t hash[TEE_MAX_HASH_SIZE]); 118 enum pkcs11_rc verify_pin(enum pkcs11_user_type user, const uint8_t *pin, 119 size_t pin_size, uint32_t salt, 120 const uint8_t hash[TEE_MAX_HASH_SIZE]); 121 122 /* 123 * Pkcs11 session support 124 */ 125 struct pkcs11_client *tee_session2client(void *tee_session); 126 struct pkcs11_client *register_client(void); 127 void unregister_client(struct pkcs11_client *client); 128 129 struct pkcs11_session *pkcs11_handle2session(uint32_t handle, 130 struct pkcs11_client *client); 131 132 static inline bool pkcs11_session_is_read_write(struct pkcs11_session *session) 133 { 134 return session->state == PKCS11_CKS_RW_PUBLIC_SESSION || 135 session->state == PKCS11_CKS_RW_USER_FUNCTIONS || 136 session->state == PKCS11_CKS_RW_SO_FUNCTIONS; 137 } 138 139 static inline bool pkcs11_session_is_public(struct pkcs11_session *session) 140 { 141 return session->state == PKCS11_CKS_RO_PUBLIC_SESSION || 142 session->state == PKCS11_CKS_RW_PUBLIC_SESSION; 143 } 144 145 static inline bool pkcs11_session_is_user(struct pkcs11_session *session) 146 { 147 return session->state == PKCS11_CKS_RO_USER_FUNCTIONS || 148 session->state == PKCS11_CKS_RW_USER_FUNCTIONS; 149 } 150 151 static inline bool pkcs11_session_is_so(struct pkcs11_session *session) 152 { 153 return session->state == PKCS11_CKS_RW_SO_FUNCTIONS; 154 } 155 156 static inline 157 struct ck_token *pkcs11_session2token(struct pkcs11_session *session) 158 { 159 return session->token; 160 } 161 162 /* Entry point for the TA commands */ 163 uint32_t entry_ck_slot_list(uint32_t ptypes, TEE_Param *params); 164 uint32_t entry_ck_slot_info(uint32_t ptypes, TEE_Param *params); 165 uint32_t entry_ck_token_info(uint32_t ptypes, TEE_Param *params); 166 uint32_t entry_ck_token_mecha_ids(uint32_t ptypes, TEE_Param *params); 167 uint32_t entry_ck_token_mecha_info(uint32_t ptypes, TEE_Param *params); 168 uint32_t entry_ck_open_session(struct pkcs11_client *client, 169 uint32_t ptypes, TEE_Param *params); 170 uint32_t entry_ck_close_session(struct pkcs11_client *client, 171 uint32_t ptypes, TEE_Param *params); 172 uint32_t entry_ck_close_all_sessions(struct pkcs11_client *client, 173 uint32_t ptypes, TEE_Param *params); 174 uint32_t entry_ck_session_info(struct pkcs11_client *client, 175 uint32_t ptypes, TEE_Param *params); 176 177 #endif /*PKCS11_TA_PKCS11_TOKEN_H*/ 178