1 /* SPDX-License-Identifier: BSD-2-Clause */ 2 /* 3 * Copyright (c) 2017-2020, Linaro Limited 4 */ 5 #ifndef PKCS11_TA_PKCS11_TOKEN_H 6 #define PKCS11_TA_PKCS11_TOKEN_H 7 8 #include <sys/queue.h> 9 #include <tee_api_types.h> 10 #include <tee_internal_api.h> 11 12 /* Hard coded description */ 13 #define PKCS11_SLOT_DESCRIPTION "OP-TEE PKCS11 TA" 14 #define PKCS11_SLOT_MANUFACTURER "Linaro" 15 #define PKCS11_SLOT_HW_VERSION { 0, 0 } 16 #define PKCS11_SLOT_FW_VERSION { PKCS11_TA_VERSION_MAJOR, \ 17 PKCS11_TA_VERSION_MINOR } 18 19 #define PKCS11_TOKEN_LABEL "OP-TEE PKCS#11 TA token" 20 #define PKCS11_TOKEN_MANUFACTURER PKCS11_SLOT_MANUFACTURER 21 #define PKCS11_TOKEN_MODEL "OP-TEE TA" 22 #define PKCS11_TOKEN_SERIAL_NUMBER "0000000000000000" 23 #define PKCS11_TOKEN_HW_VERSION PKCS11_SLOT_HW_VERSION 24 #define PKCS11_TOKEN_FW_VERSION PKCS11_SLOT_FW_VERSION 25 26 enum pkcs11_token_state { 27 PKCS11_TOKEN_RESET = 0, 28 PKCS11_TOKEN_READ_WRITE, 29 PKCS11_TOKEN_READ_ONLY, 30 }; 31 32 #define PKCS11_MAX_USERS 2 33 #define PKCS11_TOKEN_PIN_SIZE_MAX 128 34 #define PKCS11_TOKEN_PIN_SIZE_MIN 10 35 36 /* 37 * Persistent state of the token 38 * 39 * @version - currently unused... 40 * @label - pkcs11 formatted token label, set by client 41 * @flags - pkcs11 token flags 42 * @so_pin_count - counter on security officer login failure 43 * @so_pin_size - byte size of the provisioned SO PIN 44 * @so_pin - stores the SO PIN 45 * @user_pin_count - counter on user login failure 46 * @user_pin_size - byte size of the provisioned user PIN 47 * @user_pin - stores the user PIN 48 */ 49 struct token_persistent_main { 50 uint32_t version; 51 uint8_t label[PKCS11_TOKEN_LABEL_SIZE]; 52 uint32_t flags; 53 uint32_t so_pin_count; 54 uint32_t so_pin_size; 55 uint8_t so_pin[PKCS11_TOKEN_PIN_SIZE_MAX]; 56 uint32_t user_pin_count; 57 uint32_t user_pin_size; 58 uint8_t user_pin[PKCS11_TOKEN_PIN_SIZE_MAX]; 59 }; 60 61 /* 62 * Runtime state of the token, complies with pkcs11 63 * 64 * @state - Pkcs11 login is public, user, SO or custom 65 * @session_count - Counter for opened Pkcs11 sessions 66 * @rw_session_count - Count for opened Pkcs11 read/write sessions 67 * @db_main - Volatile copy of the persistent main database 68 */ 69 struct ck_token { 70 enum pkcs11_token_state state; 71 uint32_t session_count; 72 uint32_t rw_session_count; 73 /* Copy in RAM of the persistent database */ 74 struct token_persistent_main *db_main; 75 }; 76 77 /* Initialize static token instance(s) from default/persistent database */ 78 TEE_Result pkcs11_init(void); 79 void pkcs11_deinit(void); 80 81 /* Speculation safe lookup of token instance from token identifier */ 82 struct ck_token *get_token(unsigned int token_id); 83 84 /* Return token identified from token instance address */ 85 unsigned int get_token_id(struct ck_token *token); 86 87 /* Access to persistent database */ 88 struct ck_token *init_persistent_db(unsigned int token_id); 89 void close_persistent_db(struct ck_token *token); 90 91 /* Entry point for the TA commands */ 92 uint32_t entry_ck_slot_list(uint32_t ptypes, TEE_Param *params); 93 uint32_t entry_ck_slot_info(uint32_t ptypes, TEE_Param *params); 94 uint32_t entry_ck_token_info(uint32_t ptypes, TEE_Param *params); 95 96 #endif /*PKCS11_TA_PKCS11_TOKEN_H*/ 97