1 /* SPDX-License-Identifier: BSD-2-Clause */ 2 /* 3 * Copyright (c) 2017-2020, Linaro Limited 4 */ 5 #ifndef PKCS11_TA_PKCS11_TOKEN_H 6 #define PKCS11_TA_PKCS11_TOKEN_H 7 8 #include <sys/queue.h> 9 #include <tee_api_types.h> 10 #include <tee_internal_api.h> 11 #include <utee_defines.h> 12 13 #include "handle.h" 14 15 /* Hard coded description */ 16 #define PKCS11_SLOT_DESCRIPTION "OP-TEE PKCS11 TA" 17 #define PKCS11_SLOT_MANUFACTURER "Linaro" 18 #define PKCS11_SLOT_HW_VERSION { 0, 0 } 19 #define PKCS11_SLOT_FW_VERSION { PKCS11_TA_VERSION_MAJOR, \ 20 PKCS11_TA_VERSION_MINOR } 21 22 #define PKCS11_TOKEN_LABEL "OP-TEE PKCS#11 TA token" 23 #define PKCS11_TOKEN_MANUFACTURER PKCS11_SLOT_MANUFACTURER 24 #define PKCS11_TOKEN_MODEL "OP-TEE TA" 25 #define PKCS11_TOKEN_HW_VERSION PKCS11_SLOT_HW_VERSION 26 #define PKCS11_TOKEN_FW_VERSION PKCS11_SLOT_FW_VERSION 27 28 enum pkcs11_token_state { 29 PKCS11_TOKEN_RESET = 0, 30 PKCS11_TOKEN_READ_WRITE, 31 PKCS11_TOKEN_READ_ONLY, 32 }; 33 34 TAILQ_HEAD(client_list, pkcs11_client); 35 TAILQ_HEAD(session_list, pkcs11_session); 36 37 struct pkcs11_client; 38 39 #define PKCS11_MAX_USERS 2 40 #define PKCS11_TOKEN_PIN_SIZE_MAX 128 41 #define PKCS11_TOKEN_PIN_SIZE_MIN 10 42 #define PKCS11_TOKEN_SO_PIN_COUNT_MAX 7 43 #define PKCS11_TOKEN_USER_PIN_COUNT_MAX 7 44 45 /* 46 * Persistent state of the token 47 * 48 * @version - currently unused... 49 * @label - pkcs11 formatted token label, set by client 50 * @flags - pkcs11 token flags 51 * @so_pin_count - counter on security officer login failure 52 * @so_pin_salt - stores salt in hash of SO PIN, 0 if not set 53 * @so_pin_hash - stores hash of SO PIN 54 * @user_pin_count - counter on user login failure 55 * @user_pin_salt - stores salt in hash of user PIN, 0 if not set 56 * @user_pin_hash - stores hash of user PIN 57 */ 58 struct token_persistent_main { 59 uint32_t version; 60 uint8_t label[PKCS11_TOKEN_LABEL_SIZE]; 61 uint32_t flags; 62 uint32_t so_pin_count; 63 uint32_t so_pin_salt; 64 uint8_t so_pin_hash[TEE_MAX_HASH_SIZE]; 65 uint32_t user_pin_count; 66 uint32_t user_pin_salt; 67 uint8_t user_pin_hash[TEE_MAX_HASH_SIZE]; 68 }; 69 70 /* 71 * Runtime state of the token, complies with pkcs11 72 * 73 * @state - Pkcs11 login is public, user, SO or custom 74 * @session_count - Counter for opened Pkcs11 sessions 75 * @rw_session_count - Count for opened Pkcs11 read/write sessions 76 * @db_main - Volatile copy of the persistent main database 77 */ 78 struct ck_token { 79 enum pkcs11_token_state state; 80 uint32_t session_count; 81 uint32_t rw_session_count; 82 /* Copy in RAM of the persistent database */ 83 struct token_persistent_main *db_main; 84 }; 85 86 /* 87 * Structure tracking the PKCS#11 sessions 88 * 89 * @link - List of the session belonging to a client 90 * @client - Client the session belongs to 91 * @token - Token this session belongs to 92 * @handle - Identifier of the session published to the client 93 * @state - R/W SO, R/W user, RO user, R/W public, RO public. 94 */ 95 struct pkcs11_session { 96 TAILQ_ENTRY(pkcs11_session) link; 97 struct pkcs11_client *client; 98 struct ck_token *token; 99 uint32_t handle; 100 enum pkcs11_session_state state; 101 }; 102 103 /* Initialize static token instance(s) from default/persistent database */ 104 TEE_Result pkcs11_init(void); 105 void pkcs11_deinit(void); 106 107 /* Speculation safe lookup of token instance from token identifier */ 108 struct ck_token *get_token(unsigned int token_id); 109 110 /* Return token identified from token instance address */ 111 unsigned int get_token_id(struct ck_token *token); 112 113 /* Access to persistent database */ 114 struct ck_token *init_persistent_db(unsigned int token_id); 115 void update_persistent_db(struct ck_token *token); 116 void close_persistent_db(struct ck_token *token); 117 118 enum pkcs11_rc hash_pin(enum pkcs11_user_type user, const uint8_t *pin, 119 size_t pin_size, uint32_t *salt, 120 uint8_t hash[TEE_MAX_HASH_SIZE]); 121 enum pkcs11_rc verify_pin(enum pkcs11_user_type user, const uint8_t *pin, 122 size_t pin_size, uint32_t salt, 123 const uint8_t hash[TEE_MAX_HASH_SIZE]); 124 125 /* 126 * Pkcs11 session support 127 */ 128 struct pkcs11_client *tee_session2client(void *tee_session); 129 struct pkcs11_client *register_client(void); 130 void unregister_client(struct pkcs11_client *client); 131 132 struct pkcs11_session *pkcs11_handle2session(uint32_t handle, 133 struct pkcs11_client *client); 134 135 static inline bool pkcs11_session_is_read_write(struct pkcs11_session *session) 136 { 137 return session->state == PKCS11_CKS_RW_PUBLIC_SESSION || 138 session->state == PKCS11_CKS_RW_USER_FUNCTIONS || 139 session->state == PKCS11_CKS_RW_SO_FUNCTIONS; 140 } 141 142 static inline bool pkcs11_session_is_public(struct pkcs11_session *session) 143 { 144 return session->state == PKCS11_CKS_RO_PUBLIC_SESSION || 145 session->state == PKCS11_CKS_RW_PUBLIC_SESSION; 146 } 147 148 static inline bool pkcs11_session_is_user(struct pkcs11_session *session) 149 { 150 return session->state == PKCS11_CKS_RO_USER_FUNCTIONS || 151 session->state == PKCS11_CKS_RW_USER_FUNCTIONS; 152 } 153 154 static inline bool pkcs11_session_is_so(struct pkcs11_session *session) 155 { 156 return session->state == PKCS11_CKS_RW_SO_FUNCTIONS; 157 } 158 159 static inline 160 struct ck_token *pkcs11_session2token(struct pkcs11_session *session) 161 { 162 return session->token; 163 } 164 165 /* Entry point for the TA commands */ 166 uint32_t entry_ck_slot_list(uint32_t ptypes, TEE_Param *params); 167 uint32_t entry_ck_slot_info(uint32_t ptypes, TEE_Param *params); 168 uint32_t entry_ck_token_info(uint32_t ptypes, TEE_Param *params); 169 uint32_t entry_ck_token_mecha_ids(uint32_t ptypes, TEE_Param *params); 170 uint32_t entry_ck_token_mecha_info(uint32_t ptypes, TEE_Param *params); 171 uint32_t entry_ck_open_session(struct pkcs11_client *client, 172 uint32_t ptypes, TEE_Param *params); 173 uint32_t entry_ck_close_session(struct pkcs11_client *client, 174 uint32_t ptypes, TEE_Param *params); 175 uint32_t entry_ck_close_all_sessions(struct pkcs11_client *client, 176 uint32_t ptypes, TEE_Param *params); 177 uint32_t entry_ck_session_info(struct pkcs11_client *client, 178 uint32_t ptypes, TEE_Param *params); 179 uint32_t entry_ck_token_initialize(uint32_t ptypes, TEE_Param *params); 180 uint32_t entry_ck_init_pin(struct pkcs11_client *client, 181 uint32_t ptypes, TEE_Param *params); 182 uint32_t entry_ck_set_pin(struct pkcs11_client *client, 183 uint32_t ptypes, TEE_Param *params); 184 uint32_t entry_ck_login(struct pkcs11_client *client, 185 uint32_t ptypes, TEE_Param *params); 186 uint32_t entry_ck_logout(struct pkcs11_client *client, 187 uint32_t ptypes, TEE_Param *params); 188 189 #endif /*PKCS11_TA_PKCS11_TOKEN_H*/ 190