1 /* SPDX-License-Identifier: BSD-2-Clause */ 2 /* 3 * Copyright (c) 2017-2020, Linaro Limited 4 */ 5 #ifndef PKCS11_TA_PKCS11_TOKEN_H 6 #define PKCS11_TA_PKCS11_TOKEN_H 7 8 #include <sys/queue.h> 9 #include <tee_api_types.h> 10 #include <tee_internal_api.h> 11 #include <utee_defines.h> 12 13 #include "handle.h" 14 #include "object.h" 15 #include "pkcs11_attributes.h" 16 17 /* Hard coded description */ 18 #define PKCS11_SLOT_DESCRIPTION "OP-TEE PKCS11 TA" 19 #define PKCS11_SLOT_MANUFACTURER "Linaro" 20 #define PKCS11_SLOT_HW_VERSION { 0, 0 } 21 #define PKCS11_SLOT_FW_VERSION { PKCS11_TA_VERSION_MAJOR, \ 22 PKCS11_TA_VERSION_MINOR } 23 24 #define PKCS11_TOKEN_LABEL "OP-TEE PKCS#11 TA token" 25 #define PKCS11_TOKEN_MANUFACTURER PKCS11_SLOT_MANUFACTURER 26 #define PKCS11_TOKEN_MODEL "OP-TEE TA" 27 #define PKCS11_TOKEN_HW_VERSION PKCS11_SLOT_HW_VERSION 28 #define PKCS11_TOKEN_FW_VERSION PKCS11_SLOT_FW_VERSION 29 30 enum pkcs11_token_state { 31 PKCS11_TOKEN_RESET = 0, 32 PKCS11_TOKEN_READ_WRITE, 33 PKCS11_TOKEN_READ_ONLY, 34 }; 35 36 TAILQ_HEAD(client_list, pkcs11_client); 37 TAILQ_HEAD(session_list, pkcs11_session); 38 39 struct pkcs11_client; 40 41 #define PKCS11_MAX_USERS 2 42 #define PKCS11_TOKEN_PIN_SIZE_MAX 128 43 #define PKCS11_TOKEN_PIN_SIZE_MIN 10 44 #define PKCS11_TOKEN_SO_PIN_COUNT_MAX 7 45 #define PKCS11_TOKEN_USER_PIN_COUNT_MAX 7 46 47 /* 48 * Persistent state of the token 49 * 50 * @version - currently unused... 51 * @label - pkcs11 formatted token label, set by client 52 * @flags - pkcs11 token flags 53 * @so_pin_count - counter on security officer login failure 54 * @so_pin_salt - stores salt in hash of SO PIN, 0 if not set 55 * @so_pin_hash - stores hash of SO PIN 56 * @user_pin_count - counter on user login failure 57 * @user_pin_salt - stores salt in hash of user PIN, 0 if not set 58 * @user_pin_hash - stores hash of user PIN 59 */ 60 struct token_persistent_main { 61 uint32_t version; 62 uint8_t label[PKCS11_TOKEN_LABEL_SIZE]; 63 uint32_t flags; 64 uint32_t so_pin_count; 65 uint32_t so_pin_salt; 66 uint8_t so_pin_hash[TEE_MAX_HASH_SIZE]; 67 uint32_t user_pin_count; 68 uint32_t user_pin_salt; 69 uint8_t user_pin_hash[TEE_MAX_HASH_SIZE]; 70 }; 71 72 /* 73 * Persistent objects in the token 74 * 75 * @count - number of objects stored in the token 76 * @uuids - array of object references/UUIDs (@count items) 77 */ 78 struct token_persistent_objs { 79 uint32_t count; 80 TEE_UUID uuids[]; 81 }; 82 83 /* 84 * Runtime state of the token, complies with pkcs11 85 * 86 * @state - Pkcs11 login is public, user, SO or custom 87 * @session_count - Counter for opened Pkcs11 sessions 88 * @rw_session_count - Count for opened Pkcs11 read/write sessions 89 * @object_list - List of the objects owned by the token 90 * @db_main - Volatile copy of the persistent main database 91 * @db_objs - Volatile copy of the persistent object database 92 */ 93 struct ck_token { 94 enum pkcs11_token_state state; 95 uint32_t session_count; 96 uint32_t rw_session_count; 97 struct object_list object_list; 98 /* Copy in RAM of the persistent database */ 99 struct token_persistent_main *db_main; 100 struct token_persistent_objs *db_objs; 101 }; 102 103 /* 104 * Structure tracking the PKCS#11 sessions 105 * 106 * @link - List of the session belonging to a client 107 * @client - Client the session belongs to 108 * @token - Token this session belongs to 109 * @handle - Identifier of the session published to the client 110 * @object_list - Entry of the session objects list 111 * @object_handle_db - Database for object handles published by the session 112 * @state - R/W SO, R/W user, RO user, R/W public, RO public. 113 */ 114 struct pkcs11_session { 115 TAILQ_ENTRY(pkcs11_session) link; 116 struct pkcs11_client *client; 117 struct ck_token *token; 118 uint32_t handle; 119 struct object_list object_list; 120 struct handle_db object_handle_db; 121 enum pkcs11_session_state state; 122 }; 123 124 /* Initialize static token instance(s) from default/persistent database */ 125 TEE_Result pkcs11_init(void); 126 void pkcs11_deinit(void); 127 128 /* Speculation safe lookup of token instance from token identifier */ 129 struct ck_token *get_token(unsigned int token_id); 130 131 /* Return token identified from token instance address */ 132 unsigned int get_token_id(struct ck_token *token); 133 134 /* Access to persistent database */ 135 struct ck_token *init_persistent_db(unsigned int token_id); 136 void update_persistent_db(struct ck_token *token); 137 void close_persistent_db(struct ck_token *token); 138 139 enum pkcs11_rc hash_pin(enum pkcs11_user_type user, const uint8_t *pin, 140 size_t pin_size, uint32_t *salt, 141 uint8_t hash[TEE_MAX_HASH_SIZE]); 142 enum pkcs11_rc verify_pin(enum pkcs11_user_type user, const uint8_t *pin, 143 size_t pin_size, uint32_t salt, 144 const uint8_t hash[TEE_MAX_HASH_SIZE]); 145 146 /* Token persistent objects */ 147 enum pkcs11_rc create_object_uuid(struct ck_token *token, 148 struct pkcs11_object *obj); 149 void destroy_object_uuid(struct ck_token *token, struct pkcs11_object *obj); 150 enum pkcs11_rc unregister_persistent_object(struct ck_token *token, 151 TEE_UUID *uuid); 152 enum pkcs11_rc register_persistent_object(struct ck_token *token, 153 TEE_UUID *uuid); 154 enum pkcs11_rc get_persistent_objects_list(struct ck_token *token, 155 TEE_UUID *array, size_t *size); 156 157 /* 158 * Pkcs11 session support 159 */ 160 struct pkcs11_client *tee_session2client(void *tee_session); 161 struct pkcs11_client *register_client(void); 162 void unregister_client(struct pkcs11_client *client); 163 164 struct pkcs11_session *pkcs11_handle2session(uint32_t handle, 165 struct pkcs11_client *client); 166 167 static inline bool pkcs11_session_is_read_write(struct pkcs11_session *session) 168 { 169 return session->state == PKCS11_CKS_RW_PUBLIC_SESSION || 170 session->state == PKCS11_CKS_RW_USER_FUNCTIONS || 171 session->state == PKCS11_CKS_RW_SO_FUNCTIONS; 172 } 173 174 static inline bool pkcs11_session_is_public(struct pkcs11_session *session) 175 { 176 return session->state == PKCS11_CKS_RO_PUBLIC_SESSION || 177 session->state == PKCS11_CKS_RW_PUBLIC_SESSION; 178 } 179 180 static inline bool pkcs11_session_is_user(struct pkcs11_session *session) 181 { 182 return session->state == PKCS11_CKS_RO_USER_FUNCTIONS || 183 session->state == PKCS11_CKS_RW_USER_FUNCTIONS; 184 } 185 186 static inline bool pkcs11_session_is_so(struct pkcs11_session *session) 187 { 188 return session->state == PKCS11_CKS_RW_SO_FUNCTIONS; 189 } 190 191 static inline 192 struct object_list *pkcs11_get_session_objects(struct pkcs11_session *session) 193 { 194 return &session->object_list; 195 } 196 197 static inline 198 struct ck_token *pkcs11_session2token(struct pkcs11_session *session) 199 { 200 return session->token; 201 } 202 203 /* Entry point for the TA commands */ 204 enum pkcs11_rc entry_ck_slot_list(uint32_t ptypes, TEE_Param *params); 205 enum pkcs11_rc entry_ck_slot_info(uint32_t ptypes, TEE_Param *params); 206 enum pkcs11_rc entry_ck_token_info(uint32_t ptypes, TEE_Param *params); 207 enum pkcs11_rc entry_ck_token_mecha_ids(uint32_t ptypes, TEE_Param *params); 208 enum pkcs11_rc entry_ck_token_mecha_info(uint32_t ptypes, TEE_Param *params); 209 enum pkcs11_rc entry_ck_open_session(struct pkcs11_client *client, 210 uint32_t ptypes, TEE_Param *params); 211 enum pkcs11_rc entry_ck_close_session(struct pkcs11_client *client, 212 uint32_t ptypes, TEE_Param *params); 213 enum pkcs11_rc entry_ck_close_all_sessions(struct pkcs11_client *client, 214 uint32_t ptypes, TEE_Param *params); 215 enum pkcs11_rc entry_ck_session_info(struct pkcs11_client *client, 216 uint32_t ptypes, TEE_Param *params); 217 enum pkcs11_rc entry_ck_token_initialize(uint32_t ptypes, TEE_Param *params); 218 enum pkcs11_rc entry_ck_init_pin(struct pkcs11_client *client, 219 uint32_t ptypes, TEE_Param *params); 220 enum pkcs11_rc entry_ck_set_pin(struct pkcs11_client *client, 221 uint32_t ptypes, TEE_Param *params); 222 enum pkcs11_rc entry_ck_login(struct pkcs11_client *client, 223 uint32_t ptypes, TEE_Param *params); 224 enum pkcs11_rc entry_ck_logout(struct pkcs11_client *client, 225 uint32_t ptypes, TEE_Param *params); 226 227 #endif /*PKCS11_TA_PKCS11_TOKEN_H*/ 228