1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /*
3  * Copyright (c) 2018-2020, Linaro Limited
4  */
5 
6 #ifndef PKCS11_TA_H
7 #define PKCS11_TA_H
8 
9 #include <stdbool.h>
10 #include <stdint.h>
11 
12 #define PKCS11_TA_UUID { 0xfd02c9da, 0x306c, 0x48c7, \
13 			 { 0xa4, 0x9c, 0xbb, 0xd8, 0x27, 0xae, 0x86, 0xee } }
14 
15 /* PKCS11 trusted application version information */
16 #define PKCS11_TA_VERSION_MAJOR			0
17 #define PKCS11_TA_VERSION_MINOR			1
18 #define PKCS11_TA_VERSION_PATCH			0
19 
20 /* Attribute specific values */
21 #define PKCS11_CK_UNAVAILABLE_INFORMATION	UINT32_C(0xFFFFFFFF)
22 #define PKCS11_UNDEFINED_ID			UINT32_C(0xFFFFFFFF)
23 #define PKCS11_FALSE				false
24 #define PKCS11_TRUE				true
25 
26 /*
27  * Note on PKCS#11 TA commands ABI
28  *
29  * For evolution of the TA API and to not mess with the GPD TEE 4 parameters
30  * constraint, all the PKCS11 TA invocation commands use a subset of available
31  * the GPD TEE invocation parameter types.
32  *
33  * Param#0 is used for the so-called control arguments of the invoked command
34  * and for providing a PKCS#11 compliant status code for the request command.
35  * Param#0 is an in/out memory reference (aka memref[0]). The input buffer
36  * stores serialized arguments for the command. The output buffer store the
37  * 32bit TA return code for the command. As a consequence, param#0 shall
38  * always be an input/output memory reference of at least 32bit, more if
39  * the command expects more input arguments.
40  *
41  * When the TA returns with TEE_SUCCESS result, client shall always get the
42  * 32bit value stored in param#0 output buffer and use the value as TA
43  * return code for the invoked command.
44  *
45  * Param#1 can be used for input data arguments of the invoked command.
46  * It is unused or is an input memory reference, aka memref[1].
47  * Evolution of the API may use memref[1] for output data as well.
48  *
49  * Param#2 is mostly used for output data arguments of the invoked command
50  * and for output handles generated from invoked commands.
51  * Few commands uses it for a secondary input data buffer argument.
52  * It is unused or is an input/output/in-out memory reference, aka memref[2].
53  *
54  * Param#3 is currently unused and reserved for evolution of the API.
55  */
56 
57 enum pkcs11_ta_cmd {
58 	/*
59 	 * PKCS11_CMD_PING		Ack TA presence and return version info
60 	 *
61 	 * [in]  memref[0] = 32bit, unused, must be 0
62 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
63 	 * [out] memref[2] = [
64 	 *              32bit version major value,
65 	 *              32bit version minor value
66 	 *              32bit version patch value
67 	 *       ]
68 	 */
69 	PKCS11_CMD_PING = 0,
70 
71 	/*
72 	 * PKCS11_CMD_SLOT_LIST - Get the table of the valid slot IDs
73 	 *
74 	 * [in]  memref[0] = 32bit, unused, must be 0
75 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
76 	 * [out] memref[2] = 32bit array slot_ids[slot counts]
77 	 *
78 	 * The TA instance may represent several PKCS#11 slots and
79 	 * associated tokens. This commadn reports the IDs of embedded tokens.
80 	 * This command relates the PKCS#11 API function C_GetSlotList().
81 	 */
82 	PKCS11_CMD_SLOT_LIST = 1,
83 
84 	/*
85 	 * PKCS11_CMD_SLOT_INFO - Get cryptoki structured slot information
86 	 *
87 	 * [in]	 memref[0] = 32bit slot ID
88 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
89 	 * [out] memref[2] = (struct pkcs11_slot_info)info
90 	 *
91 	 * The TA instance may represent several PKCS#11 slots/tokens.
92 	 * This command relates the PKCS#11 API function C_GetSlotInfo().
93 	 */
94 	PKCS11_CMD_SLOT_INFO = 2,
95 
96 	/*
97 	 * PKCS11_CMD_TOKEN_INFO - Get cryptoki structured token information
98 	 *
99 	 * [in]	 memref[0] = 32bit slot ID
100 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
101 	 * [out] memref[2] = (struct pkcs11_token_info)info
102 	 *
103 	 * The TA instance may represent several PKCS#11 slots/tokens.
104 	 * This command relates the PKCS#11 API function C_GetTokenInfo().
105 	 */
106 	PKCS11_CMD_TOKEN_INFO = 3,
107 
108 	/*
109 	 * PKCS11_CMD_MECHANISM_IDS - Get list of the supported mechanisms
110 	 *
111 	 * [in]	 memref[0] = 32bit slot ID
112 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
113 	 * [out] memref[2] = 32bit array mechanism IDs
114 	 *
115 	 * This command relates to the PKCS#11 API function
116 	 * C_GetMechanismList().
117 	 */
118 	PKCS11_CMD_MECHANISM_IDS = 4,
119 
120 	/*
121 	 * PKCS11_CMD_MECHANISM_INFO - Get information on a specific mechanism
122 	 *
123 	 * [in]  memref[0] = [
124 	 *              32bit slot ID,
125 	 *              32bit mechanism ID (PKCS11_CKM_*)
126 	 *       ]
127 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
128 	 * [out] memref[2] = (struct pkcs11_mechanism_info)info
129 	 *
130 	 * This command relates to the PKCS#11 API function
131 	 * C_GetMechanismInfo().
132 	 */
133 	PKCS11_CMD_MECHANISM_INFO = 5,
134 
135 	/*
136 	 * PKCS11_CMD_OPEN_SESSION - Open a session
137 	 *
138 	 * [in]  memref[0] = [
139 	 *              32bit slot ID,
140 	 *              32bit session flags,
141 	 *       ]
142 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
143 	 * [out] memref[2] = 32bit session handle
144 	 *
145 	 * This command relates to the PKCS#11 API function C_OpenSession().
146 	 */
147 	PKCS11_CMD_OPEN_SESSION = 6,
148 
149 	/*
150 	 * PKCS11_CMD_CLOSE_SESSION - Close an opened session
151 	 *
152 	 * [in]  memref[0] = 32bit session handle
153 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
154 	 *
155 	 * This command relates to the PKCS#11 API function C_CloseSession().
156 	 */
157 	PKCS11_CMD_CLOSE_SESSION = 7,
158 
159 	/*
160 	 * PKCS11_CMD_CLOSE_ALL_SESSIONS - Close all client sessions on token
161 	 *
162 	 * [in]	 memref[0] = 32bit slot ID
163 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
164 	 *
165 	 * This command relates to the PKCS#11 API function
166 	 * C_CloseAllSessions().
167 	 */
168 	PKCS11_CMD_CLOSE_ALL_SESSIONS = 8,
169 
170 	/*
171 	 * PKCS11_CMD_SESSION_INFO - Get Cryptoki information on a session
172 	 *
173 	 * [in]  memref[0] = 32bit session handle
174 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
175 	 * [out] memref[2] = (struct pkcs11_session_info)info
176 	 *
177 	 * This command relates to the PKCS#11 API function C_GetSessionInfo().
178 	 */
179 	PKCS11_CMD_SESSION_INFO = 9,
180 
181 	/*
182 	 * PKCS11_CMD_INIT_TOKEN - Initialize PKCS#11 token
183 	 *
184 	 * [in]  memref[0] = [
185 	 *              32bit slot ID,
186 	 *              32bit PIN length,
187 	 *              byte array label[32]
188 	 *              byte array PIN[PIN length],
189 	 *	 ]
190 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
191 	 *
192 	 * This command relates to the PKCS#11 API function C_InitToken().
193 	 */
194 	PKCS11_CMD_INIT_TOKEN = 10,
195 
196 	/*
197 	 * PKCS11_CMD_INIT_PIN - Initialize user PIN
198 	 *
199 	 * [in]  memref[0] = [
200 	 *              32bit session handle,
201 	 *              32bit PIN byte size,
202 	 *              byte array: PIN data
203 	 *	 ]
204 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
205 	 *
206 	 * This command relates to the PKCS#11 API function C_InitPIN().
207 	 */
208 	PKCS11_CMD_INIT_PIN = 11,
209 
210 	/*
211 	 * PKCS11_CMD_SET_PIN - Change user PIN
212 	 *
213 	 * [in]	 memref[0] = [
214 	 *              32bit session handle,
215 	 *              32bit old PIN byte size,
216 	 *              32bit new PIN byte size,
217 	 *              byte array: PIN data,
218 	 *              byte array: new PIN data,
219 	 *       ]
220 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
221 	 *
222 	 * This command relates to the PKCS#11 API function C_SetPIN().
223 	 */
224 	PKCS11_CMD_SET_PIN = 12,
225 
226 	/*
227 	 * PKCS11_CMD_LOGIN - Initialize user PIN
228 	 *
229 	 * [in]  memref[0] = [
230 	 *              32bit session handle,
231 	 *              32bit user identifier, enum pkcs11_user_type
232 	 *              32bit PIN byte size,
233 	 *              byte array: PIN data
234 	 *	 ]
235 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
236 	 *
237 	 * This command relates to the PKCS#11 API function C_Login().
238 	 */
239 	PKCS11_CMD_LOGIN = 13,
240 
241 	/*
242 	 * PKCS11_CMD_LOGOUT - Log out from token
243 	 *
244 	 * [in]  memref[0] = [
245 	 *              32bit session handle,
246 	 *	 ]
247 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
248 	 *
249 	 * This command relates to the PKCS#11 API function C_Logout().
250 	 */
251 	PKCS11_CMD_LOGOUT = 14,
252 
253 	/*
254 	 * PKCS11_CMD_CREATE_OBJECT - Create a raw client assembled object in
255 	 *			      the session or token
256 	 *
257 	 *
258 	 * [in]  memref[0] = [
259 	 *              32bit session handle,
260 	 *              (struct pkcs11_object_head)attribs + attributes data
261 	 *	 ]
262 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
263 	 * [out] memref[2] = 32bit object handle
264 	 *
265 	 * This command relates to the PKCS#11 API function C_CreateObject().
266 	 */
267 	PKCS11_CMD_CREATE_OBJECT = 15,
268 
269 	/*
270 	 * PKCS11_CMD_DESTROY_OBJECT - Destroy an object
271 	 *
272 	 * [in]  memref[0] = [
273 	 *              32bit session handle,
274 	 *              32bit object handle
275 	 *	 ]
276 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
277 	 *
278 	 * This command relates to the PKCS#11 API function C_DestroyObject().
279 	 */
280 	PKCS11_CMD_DESTROY_OBJECT = 16,
281 
282 	/*
283 	 * PKCS11_CMD_ENCRYPT_INIT - Initialize encryption processing
284 	 * PKCS11_CMD_DECRYPT_INIT - Initialize decryption processing
285 	 *
286 	 * [in]  memref[0] = [
287 	 *              32bit session handle,
288 	 *              32bit object handle of the key,
289 	 *              (struct pkcs11_attribute_head)mechanism + mecha params
290 	 *	 ]
291 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
292 	 *
293 	 * These commands relate to the PKCS#11 API functions
294 	 * C_EncryptInit() and C_DecryptInit().
295 	 */
296 	PKCS11_CMD_ENCRYPT_INIT = 17,
297 	PKCS11_CMD_DECRYPT_INIT = 18,
298 
299 	/*
300 	 * PKCS11_CMD_ENCRYPT_UPDATE - Update encryption processing
301 	 * PKCS11_CMD_DECRYPT_UPDATE - Update decryption processing
302 	 *
303 	 * [in]  memref[0] = 32bit session handle
304 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
305 	 * [in]  memref[1] = input data to be processed
306 	 * [out] memref[2] = output processed data
307 	 *
308 	 * These commands relate to the PKCS#11 API functions
309 	 * C_EncryptUpdate() and C_DecryptUpdate().
310 	 */
311 	PKCS11_CMD_ENCRYPT_UPDATE = 19,
312 	PKCS11_CMD_DECRYPT_UPDATE = 20,
313 
314 	/*
315 	 * PKCS11_CMD_ENCRYPT_FINAL - Finalize encryption processing
316 	 * PKCS11_CMD_DECRYPT_FINAL - Finalize decryption processing
317 	 *
318 	 * [in]  memref[0] = 32bit session handle
319 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
320 	 * [out] memref[2] = output processed data
321 	 *
322 	 * These commands relate to the PKCS#11 API functions
323 	 * C_EncryptFinal() and C_DecryptFinal().
324 	 */
325 	PKCS11_CMD_ENCRYPT_FINAL = 21,
326 	PKCS11_CMD_DECRYPT_FINAL = 22,
327 
328 	/*
329 	 * PKCS11_CMD_ENCRYPT_ONESHOT - Update and finalize encryption
330 	 *                              processing
331 	 * PKCS11_CMD_DECRYPT_ONESHOT - Update and finalize decryption
332 	 *                              processing
333 	 *
334 	 * [in]  memref[0] = 32bit session handle
335 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
336 	 * [in]  memref[1] = input data to be processed
337 	 * [out] memref[2] = output processed data
338 	 *
339 	 * These commands relate to the PKCS#11 API functions C_Encrypt and
340 	 * C_Decrypt.
341 	 */
342 	PKCS11_CMD_ENCRYPT_ONESHOT = 23,
343 	PKCS11_CMD_DECRYPT_ONESHOT = 24,
344 
345 	/*
346 	 * PKCS11_CMD_SIGN_INIT   - Initialize a signature computation
347 	 *                          processing
348 	 * PKCS11_CMD_VERIFY_INIT - Initialize a signature verification
349 	 *                          processing
350 	 *
351 	 * [in]  memref[0] = [
352 	 *              32bit session handle,
353 	 *              32bit key handle,
354 	 *              (struct pkcs11_attribute_head)mechanism +
355 	 *                                            mechanism params,
356 	 *	 ]
357 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
358 	 *
359 	 * These commands relate to the PKCS#11 API functions C_SignInit() and
360 	 * C_VerifyInit().
361 	 */
362 	PKCS11_CMD_SIGN_INIT = 25,
363 	PKCS11_CMD_VERIFY_INIT = 26,
364 
365 	/*
366 	 * PKCS11_CMD_SIGN_UPDATE   - Update a signature computation processing
367 	 * PKCS11_CMD_VERIFY_UPDATE - Update a signature verification processing
368 	 *
369 	 * [in]  memref[0] = 32bit session handle
370 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
371 	 * [in]  memref[1] = input data to be processed
372 	 *
373 	 * These commands relate to the PKCS#11 API functions C_SignUpdate() and
374 	 * C_VerifyUpdate().
375 	 */
376 	PKCS11_CMD_SIGN_UPDATE = 27,
377 	PKCS11_CMD_VERIFY_UPDATE = 28,
378 
379 	/*
380 	 * PKCS11_CMD_SIGN_FINAL - Finalize a signature computation processing
381 	 *
382 	 * [in]  memref[0] = 32bit session handle
383 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
384 	 * [out] memref[2] = output signature
385 	 *
386 	 * This command relates to the PKCS#11 API functions C_SignFinal().
387 	 */
388 	PKCS11_CMD_SIGN_FINAL = 29,
389 
390 	/*
391 	 * PKCS11_CMD_VERIFY_FINAL - Finalize a signature verification
392 	 *                           processing
393 	 *
394 	 * [in]  memref[0] = 32bit session handle
395 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
396 	 * [in]  memref[2] = input signature to be processed
397 	 *
398 	 * This command relates to the PKCS#11 API functions C_VerifyFinal().
399 	 */
400 	PKCS11_CMD_VERIFY_FINAL = 30,
401 
402 	/*
403 	 * PKCS11_CMD_SIGN_ONESHOT - Compute a signature
404 	 *
405 	 * [in]  memref[0] = 32bit session handle
406 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
407 	 * [in]  memref[1] = input data to be processed
408 	 * [out] memref[2] = byte array: generated signature
409 	 *
410 	 * This command relates to the PKCS#11 API function C_Sign().
411 	 */
412 	PKCS11_CMD_SIGN_ONESHOT = 31,
413 
414 	/*
415 	 * PKCS11_CMD_VERIFY_ONESHOT - Compute and compare a signature
416 	 *
417 	 * [in]  memref[0] = 32bit session handle
418 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
419 	 * [in]  memref[1] = input data to be processed
420 	 * [in]  memref[2] = input signature to be processed
421 	 *
422 	 * This command relates to the PKCS#11 API function C_Verify().
423 	 */
424 	PKCS11_CMD_VERIFY_ONESHOT = 32,
425 
426 	/*
427 	 * PKCS11_CMD_GENERATE_KEY - Generate a symmetric key or domain
428 	 *                           parameters
429 	 *
430 	 * [in]  memref[0] = [
431 	 *              32bit session handle,
432 	 *              (struct pkcs11_attribute_head)mechanism + mecha params,
433 	 *              (struct pkcs11_object_head)attribs + attributes data
434 	 *	 ]
435 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
436 	 * [out] memref[2] = 32bit object handle
437 	 *
438 	 * This command relates to the PKCS#11 API function C_GenerateKey().
439 	 */
440 	PKCS11_CMD_GENERATE_KEY = 33,
441 
442 	/*
443 	 * PKCS11_CMD_FIND_OBJECTS_INIT - Initialize an object search
444 	 *
445 	 * [in]  memref[0] = [
446 	 *              32bit session handle,
447 	 *              (struct pkcs11_object_head)attribs + attributes data
448 	 *	 ]
449 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
450 	 *
451 	 * This command relates to the PKCS#11 API function C_FindOjectsInit().
452 	 */
453 	PKCS11_CMD_FIND_OBJECTS_INIT = 34,
454 
455 	/*
456 	 * PKCS11_CMD_FIND_OBJECTS - Get handles of matching objects
457 	 *
458 	 * [in]  memref[0] = 32bit session handle
459 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
460 	 * [out] memref[2] = 32bit array object_handle_array[N]
461 	 *
462 	 * This command relates to the PKCS#11 API function C_FindOjects().
463 	 * The size of object_handle_array depends on the size of the output
464 	 * buffer provided by the client.
465 	 */
466 	PKCS11_CMD_FIND_OBJECTS = 35,
467 
468 	/*
469 	 * PKCS11_CMD_FIND_OBJECTS_FINAL - Finalize current objects search
470 	 *
471 	 * [in]  memref[0] = 32bit session handle
472 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
473 	 *
474 	 * This command relates to the PKCS#11 API function C_FindOjectsFinal().
475 	 */
476 	PKCS11_CMD_FIND_OBJECTS_FINAL = 36,
477 
478 	/*
479 	 * PKCS11_CMD_GET_OBJECT_SIZE - Get byte size used by object in the TEE
480 	 *
481 	 * [in]  memref[0] = [
482 	 *              32bit session handle,
483 	 *              32bit object handle
484 	 *	 ]
485 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
486 	 * [out] memref[2] = 32bit object_byte_size
487 	 *
488 	 * This command relates to the PKCS#11 API function C_GetObjectSize().
489 	 */
490 	PKCS11_CMD_GET_OBJECT_SIZE = 37,
491 
492 	/*
493 	 * PKCS11_CMD_GET_ATTRIBUTE_VALUE - Get the value of object attribute(s)
494 	 *
495 	 * [in]  memref[0] = [
496 	 *              32bit session handle,
497 	 *              32bit object handle,
498 	 *              (struct pkcs11_object_head)attribs + attributes data
499 	 *	 ]
500 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
501 	 * [out] memref[2] = (struct pkcs11_object_head)attribs + attributes
502 	 *                   data
503 	 *
504 	 * This command relates to the PKCS#11 API function C_GetAttributeValue.
505 	 * Caller provides an attribute template as 3rd argument in memref[0]
506 	 * (referred here as attribs + attributes data). Upon successful
507 	 * completion, the TA returns the provided template filled with expected
508 	 * data through output argument memref[2] (referred here again as
509 	 * attribs + attributes data).
510 	 */
511 	PKCS11_CMD_GET_ATTRIBUTE_VALUE = 38,
512 
513 	/*
514 	 * PKCS11_CMD_SET_ATTRIBUTE_VALUE - Set the value of object attribute(s)
515 	 *
516 	 * [in]  memref[0] = [
517 	 *              32bit session handle,
518 	 *              32bit object handle,
519 	 *              (struct pkcs11_object_head)attribs + attributes data
520 	 *	 ]
521 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
522 	 *
523 	 * This command relates to the PKCS#11 API function C_SetAttributeValue.
524 	 * Caller provides an attribute template as 3rd argument in memref[0]
525 	 * (referred here as attribs + attributes data).
526 	 */
527 	PKCS11_CMD_SET_ATTRIBUTE_VALUE = 39,
528 
529 	/*
530 	 * PKCS11_CMD_COPY_OBJECT - Copies an object, creating a new object for
531 	 *			    the copy.
532 	 *
533 	 * [in]  memref[0] = [
534 	 *              32bit session handle,
535 	 *              32bit object handle,
536 	 *              (struct pkcs11_object_head)attribs + attributes data
537 	 *	 ]
538 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
539 	 * [out] memref[2] = 32bit object handle
540 	 *
541 	 * This command relates to the PKCS#11 API function C_CopyObject().
542 	 * Caller provides an attribute template as 3rd argument in memref[0]
543 	 * (referred here as attribs + attributes data).
544 	 */
545 	PKCS11_CMD_COPY_OBJECT = 40,
546 
547 	/*
548 	 * PKCS11_CMD_SEED_RANDOM - Seed random data generator
549 	 *
550 	 * [in]  memref[0] = 32bit session handle
551 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
552 	 * [in]  memref[1] = byte array: seed material to feed into the RNG
553 	 *
554 	 * This command relates to the PKCS#11 API function C_SeedRandom().
555 	 */
556 	PKCS11_CMD_SEED_RANDOM = 41,
557 
558 	/*
559 	 * PKCS11_CMD_GENERATE_RANDOM - Generate random data
560 	 *
561 	 * [in]  memref[0] = 32bit session handle
562 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
563 	 * [out] memref[2] = byte array: generated random
564 	 *
565 	 * This command relates to the PKCS#11 API function C_GenerateRandom().
566 	 */
567 	PKCS11_CMD_GENERATE_RANDOM = 42,
568 
569 	/*
570 	 * PKCS11_CMD_DERIVE_KEY - Derive a key from a parent key.
571 	 *
572 	 * [in]  memref[0] = [
573 	 *              32bit session handle,
574 	 *              32bit parent key handle,
575 	 *              (struct pkcs11_attribute_head)mechanism + mecha params,
576 	 *              (struct pkcs11_object_head)attribs + attributes data
577 	 *	 ]
578 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
579 	 * [out] memref[2] = 32bit object handle
580 	 *
581 	 * This command relates to the PKCS#11 API function C_DeriveKey().
582 	 */
583 	PKCS11_CMD_DERIVE_KEY = 43,
584 
585 	/*
586 	 * PKCS11_CMD_RELEASE_ACTIVE_PROCESSING - Release active processing
587 	 *
588 	 * [in]  memref[0] = [
589 	 *              32bit session handle,
590 	 *              32bit enum pkcs11_ta_cmd
591 	 *       ]
592 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
593 	 *
594 	 * This command is used to release active processing in case of
595 	 * Cryptoki API invocation error is detected in user space processing.
596 	 * Function derived from pkcs11_ta_cmd is used to verify that active
597 	 * processing matches.
598 	 */
599 	PKCS11_CMD_RELEASE_ACTIVE_PROCESSING = 44,
600 
601 	/*
602 	 * PKCS11_CMD_DIGEST_INIT - Initialize a digest computation processing
603 	 *
604 	 * [in]  memref[0] = [
605 	 *              32bit session handle,
606 	 *              (struct pkcs11_attribute_head)mechanism + mecha params
607 	 *	 ]
608 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
609 	 *
610 	 * This command relates to the PKCS#11 API function C_DigestInit().
611 	 */
612 	PKCS11_CMD_DIGEST_INIT = 45,
613 
614 	/*
615 	 * PKCS11_CMD_DIGEST_KEY - Update digest with a key
616 	 *
617 	 * [in]  memref[0] = [
618 	 *              32bit session handle,
619 	 *              32bit key handle
620 	 *	 ]
621 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
622 	 *
623 	 * This command relates to the PKCS#11 API function C_DigestKey().
624 	 */
625 	PKCS11_CMD_DIGEST_KEY = 46,
626 
627 	/*
628 	 * PKCS11_CMD_DIGEST_UPDATE - Update digest with data
629 	 *
630 	 * [in]  memref[0] = 32bit session handle
631 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
632 	 * [in]  memref[1] = input data to be processed
633 	 *
634 	 * This command relates to the PKCS#11 API function C_DigestUpdate().
635 	 */
636 	PKCS11_CMD_DIGEST_UPDATE = 47,
637 
638 	/*
639 	 * PKCS11_CMD_DIGEST_FINAL - Finalize a digest computation processing
640 	 *
641 	 * [in]  memref[0] = 32bit session handle
642 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
643 	 * [out] memref[2] = output digest
644 	 *
645 	 * This command relates to the PKCS#11 API function C_DigestFinal().
646 	 */
647 	PKCS11_CMD_DIGEST_FINAL = 48,
648 
649 	/*
650 	 * PKCS11_CMD_DIGEST_ONESHOT - Compute a digest
651 	 *
652 	 * [in]  memref[0] = 32bit session handle
653 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
654 	 * [in]  memref[1] = input data to be processed
655 	 * [out] memref[2] = byte array: generated digest
656 	 *
657 	 * This command relates to the PKCS#11 API function C_Digest().
658 	 */
659 	PKCS11_CMD_DIGEST_ONESHOT = 49,
660 
661 	/*
662 	 * PKCS11_CMD_GENERATE_KEY_PAIR - Generate an asymmetric key pair
663 	 *
664 	 * [in]  memref[0] = [
665 	 *              32bit session handle,
666 	 *              (struct pkcs11_attribute_head)mechanism + mecha params,
667 	 *              (struct pkcs11_object_head)public key attribs +
668 	 *              attributes data,
669 	 *              (struct pkcs11_object_head)private key attribs +
670 	 *              attributes data
671 	 *	 ]
672 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
673 	 * [out] memref[2] = [
674 	 *              32bit public key object handle,
675 	 *              32bit private key object handle
676 	 *	 ]
677 	 *
678 	 * This command relates to the PKCS#11 API function
679 	 * C_GenerateKeyPair().
680 	 */
681 	PKCS11_CMD_GENERATE_KEY_PAIR = 50,
682 
683 	/*
684 	 * PKCS11_CMD_WRAP_KEY - Wraps a private or secret key.
685 	 *
686 	 * [in]  memref[0] = [
687 	 *              32bit session handle,
688 	 *              32bit wrapping key handle,
689 	 *              32bit key handle,
690 	 *              (struct pkcs11_attribute_head)mechanism + mecha params
691 	 *	 ]
692 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
693 	 * [out] memref[2] = wrapped key
694 	 *
695 	 * This command relates to the PKCS#11 API function C_WrapKey().
696 	 */
697 	PKCS11_CMD_WRAP_KEY = 51,
698 
699 	/*
700 	 * PKCS11_CMD_UNWRAP_KEY - Unwraps a wrapped key, creating a new
701 	 *                         private or secret key object.
702 	 *
703 	 * [in]  memref[0] = [
704 	 *              32bit session handle,
705 	 *              32bit unwrapping key handle,
706 	 *              (struct pkcs11_attribute_head)mechanism + mecha params,
707 	 *              (struct pkcs11_object_head)attribs + attributes data
708 	 *	 ]
709 	 * [out] memref[0] = 32bit return code, enum pkcs11_rc
710 	 * [in]  memref[1] = wrapped key
711 	 * [out] memref[2] = 32bit object handle
712 	 *
713 	 * This command relates to the PKCS#11 API function C_UnwrapKey().
714 	 */
715 	PKCS11_CMD_UNWRAP_KEY = 52,
716 };
717 
718 /*
719  * Command return codes
720  * PKCS11_<x> relates CryptoKi client API CKR_<x>
721  */
722 enum pkcs11_rc {
723 	PKCS11_CKR_OK				= 0,
724 	PKCS11_CKR_CANCEL			= 0x0001,
725 	PKCS11_CKR_SLOT_ID_INVALID		= 0x0003,
726 	PKCS11_CKR_GENERAL_ERROR		= 0x0005,
727 	PKCS11_CKR_FUNCTION_FAILED		= 0x0006,
728 	PKCS11_CKR_ARGUMENTS_BAD		= 0x0007,
729 	PKCS11_CKR_ATTRIBUTE_READ_ONLY		= 0x0010,
730 	PKCS11_CKR_ATTRIBUTE_SENSITIVE		= 0x0011,
731 	PKCS11_CKR_ATTRIBUTE_TYPE_INVALID	= 0x0012,
732 	PKCS11_CKR_ATTRIBUTE_VALUE_INVALID	= 0x0013,
733 	PKCS11_CKR_ACTION_PROHIBITED		= 0x001b,
734 	PKCS11_CKR_DATA_INVALID			= 0x0020,
735 	PKCS11_CKR_DATA_LEN_RANGE		= 0x0021,
736 	PKCS11_CKR_DEVICE_ERROR			= 0x0030,
737 	PKCS11_CKR_DEVICE_MEMORY		= 0x0031,
738 	PKCS11_CKR_DEVICE_REMOVED		= 0x0032,
739 	PKCS11_CKR_ENCRYPTED_DATA_INVALID	= 0x0040,
740 	PKCS11_CKR_ENCRYPTED_DATA_LEN_RANGE	= 0x0041,
741 	PKCS11_CKR_KEY_HANDLE_INVALID		= 0x0060,
742 	PKCS11_CKR_KEY_SIZE_RANGE		= 0x0062,
743 	PKCS11_CKR_KEY_TYPE_INCONSISTENT	= 0x0063,
744 	PKCS11_CKR_KEY_INDIGESTIBLE		= 0x0067,
745 	PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED	= 0x0068,
746 	PKCS11_CKR_KEY_NOT_WRAPPABLE		= 0x0069,
747 	PKCS11_CKR_KEY_UNEXTRACTABLE		= 0x006a,
748 	PKCS11_CKR_MECHANISM_INVALID		= 0x0070,
749 	PKCS11_CKR_MECHANISM_PARAM_INVALID	= 0x0071,
750 	PKCS11_CKR_OBJECT_HANDLE_INVALID	= 0x0082,
751 	PKCS11_CKR_OPERATION_ACTIVE		= 0x0090,
752 	PKCS11_CKR_OPERATION_NOT_INITIALIZED	= 0x0091,
753 	PKCS11_CKR_PIN_INCORRECT		= 0x00a0,
754 	PKCS11_CKR_PIN_INVALID			= 0x00a1,
755 	PKCS11_CKR_PIN_LEN_RANGE		= 0x00a2,
756 	PKCS11_CKR_PIN_EXPIRED			= 0x00a3,
757 	PKCS11_CKR_PIN_LOCKED			= 0x00a4,
758 	PKCS11_CKR_SESSION_CLOSED		= 0x00b0,
759 	PKCS11_CKR_SESSION_COUNT		= 0x00b1,
760 	PKCS11_CKR_SESSION_HANDLE_INVALID	= 0x00b3,
761 	PKCS11_CKR_SESSION_PARALLEL_NOT_SUPPORTED = 0x00b4,
762 	PKCS11_CKR_SESSION_READ_ONLY		= 0x00b5,
763 	PKCS11_CKR_SESSION_EXISTS		= 0x00b6,
764 	PKCS11_CKR_SESSION_READ_ONLY_EXISTS	= 0x00b7,
765 	PKCS11_CKR_SESSION_READ_WRITE_SO_EXISTS	= 0x00b8,
766 	PKCS11_CKR_SIGNATURE_INVALID		= 0x00c0,
767 	PKCS11_CKR_SIGNATURE_LEN_RANGE		= 0x00c1,
768 	PKCS11_CKR_TEMPLATE_INCOMPLETE		= 0x00d0,
769 	PKCS11_CKR_TEMPLATE_INCONSISTENT	= 0x00d1,
770 	PKCS11_CKR_TOKEN_NOT_PRESENT		= 0x00e0,
771 	PKCS11_CKR_TOKEN_NOT_RECOGNIZED		= 0x00e1,
772 	PKCS11_CKR_TOKEN_WRITE_PROTECTED	= 0x00e2,
773 	PKCS11_CKR_UNWRAPPING_KEY_HANDLE_INVALID = 0x00f0,
774 	PKCS11_CKR_UNWRAPPING_KEY_SIZE_RANGE	= 0x00f1,
775 	PKCS11_CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT = 0x00f2,
776 	PKCS11_CKR_USER_ALREADY_LOGGED_IN	= 0x0100,
777 	PKCS11_CKR_USER_NOT_LOGGED_IN		= 0x0101,
778 	PKCS11_CKR_USER_PIN_NOT_INITIALIZED	= 0x0102,
779 	PKCS11_CKR_USER_TYPE_INVALID		= 0x0103,
780 	PKCS11_CKR_USER_ANOTHER_ALREADY_LOGGED_IN = 0x0104,
781 	PKCS11_CKR_USER_TOO_MANY_TYPES		= 0x0105,
782 	PKCS11_CKR_WRAPPED_KEY_INVALID		= 0x0110,
783 	PKCS11_CKR_WRAPPED_KEY_LEN_RANGE	= 0x0112,
784 	PKCS11_CKR_WRAPPING_KEY_HANDLE_INVALID  = 0x0113,
785 	PKCS11_CKR_WRAPPING_KEY_SIZE_RANGE	= 0x0114,
786 	PKCS11_CKR_WRAPPING_KEY_TYPE_INCONSISTENT = 0x0115,
787 	PKCS11_CKR_RANDOM_SEED_NOT_SUPPORTED	= 0x0120,
788 	PKCS11_CKR_RANDOM_NO_RNG		= 0x0121,
789 	PKCS11_CKR_DOMAIN_PARAMS_INVALID	= 0x0130,
790 	PKCS11_CKR_CURVE_NOT_SUPPORTED		= 0x0140,
791 	PKCS11_CKR_BUFFER_TOO_SMALL		= 0x0150,
792 	PKCS11_CKR_SAVED_STATE_INVALID		= 0x0160,
793 	PKCS11_CKR_INFORMATION_SENSITIVE	= 0x0170,
794 	PKCS11_CKR_STATE_UNSAVEABLE		= 0x0180,
795 	PKCS11_CKR_PIN_TOO_WEAK			= 0x01b8,
796 	PKCS11_CKR_PUBLIC_KEY_INVALID		= 0x01b9,
797 	PKCS11_CKR_FUNCTION_REJECTED		= 0x0200,
798 	/* Vendor specific IDs not returned to client */
799 	PKCS11_RV_NOT_FOUND			= 0x80000000,
800 	PKCS11_RV_NOT_IMPLEMENTED		= 0x80000001,
801 };
802 
803 /*
804  * Arguments for PKCS11_CMD_SLOT_INFO
805  */
806 #define PKCS11_SLOT_DESC_SIZE			64
807 #define PKCS11_SLOT_MANUFACTURER_SIZE		32
808 #define PKCS11_SLOT_VERSION_SIZE		2
809 
810 struct pkcs11_slot_info {
811 	uint8_t slot_description[PKCS11_SLOT_DESC_SIZE];
812 	uint8_t manufacturer_id[PKCS11_SLOT_MANUFACTURER_SIZE];
813 	uint32_t flags;
814 	uint8_t hardware_version[PKCS11_SLOT_VERSION_SIZE];
815 	uint8_t firmware_version[PKCS11_SLOT_VERSION_SIZE];
816 };
817 
818 /*
819  * Values for pkcs11_slot_info::flags.
820  * PKCS11_CKFS_<x> reflects CryptoKi client API slot flags CKF_<x>.
821  */
822 #define PKCS11_CKFS_TOKEN_PRESENT		(1U << 0)
823 #define PKCS11_CKFS_REMOVABLE_DEVICE		(1U << 1)
824 #define PKCS11_CKFS_HW_SLOT			(1U << 2)
825 
826 /*
827  * Arguments for PKCS11_CMD_TOKEN_INFO
828  */
829 #define PKCS11_TOKEN_LABEL_SIZE			32
830 #define PKCS11_TOKEN_MANUFACTURER_SIZE		32
831 #define PKCS11_TOKEN_MODEL_SIZE			16
832 #define PKCS11_TOKEN_SERIALNUM_SIZE		16
833 
834 struct pkcs11_token_info {
835 	uint8_t label[PKCS11_TOKEN_LABEL_SIZE];
836 	uint8_t manufacturer_id[PKCS11_TOKEN_MANUFACTURER_SIZE];
837 	uint8_t model[PKCS11_TOKEN_MODEL_SIZE];
838 	uint8_t serial_number[PKCS11_TOKEN_SERIALNUM_SIZE];
839 	uint32_t flags;
840 	uint32_t max_session_count;
841 	uint32_t session_count;
842 	uint32_t max_rw_session_count;
843 	uint32_t rw_session_count;
844 	uint32_t max_pin_len;
845 	uint32_t min_pin_len;
846 	uint32_t total_public_memory;
847 	uint32_t free_public_memory;
848 	uint32_t total_private_memory;
849 	uint32_t free_private_memory;
850 	uint8_t hardware_version[2];
851 	uint8_t firmware_version[2];
852 	uint8_t utc_time[16];
853 };
854 
855 /*
856  * Values for pkcs11_token_info::flags.
857  * PKCS11_CKFT_<x> reflects CryptoKi client API token flags CKF_<x>.
858  */
859 #define PKCS11_CKFT_RNG					(1U << 0)
860 #define PKCS11_CKFT_WRITE_PROTECTED			(1U << 1)
861 #define PKCS11_CKFT_LOGIN_REQUIRED			(1U << 2)
862 #define PKCS11_CKFT_USER_PIN_INITIALIZED		(1U << 3)
863 #define PKCS11_CKFT_RESTORE_KEY_NOT_NEEDED		(1U << 5)
864 #define PKCS11_CKFT_CLOCK_ON_TOKEN			(1U << 6)
865 #define PKCS11_CKFT_PROTECTED_AUTHENTICATION_PATH	(1U << 8)
866 #define PKCS11_CKFT_DUAL_CRYPTO_OPERATIONS		(1U << 9)
867 #define PKCS11_CKFT_TOKEN_INITIALIZED			(1U << 10)
868 #define PKCS11_CKFT_SECONDARY_AUTHENTICATION		(1U << 11)
869 #define PKCS11_CKFT_USER_PIN_COUNT_LOW			(1U << 16)
870 #define PKCS11_CKFT_USER_PIN_FINAL_TRY			(1U << 17)
871 #define PKCS11_CKFT_USER_PIN_LOCKED			(1U << 18)
872 #define PKCS11_CKFT_USER_PIN_TO_BE_CHANGED		(1U << 19)
873 #define PKCS11_CKFT_SO_PIN_COUNT_LOW			(1U << 20)
874 #define PKCS11_CKFT_SO_PIN_FINAL_TRY			(1U << 21)
875 #define PKCS11_CKFT_SO_PIN_LOCKED			(1U << 22)
876 #define PKCS11_CKFT_SO_PIN_TO_BE_CHANGED		(1U << 23)
877 #define PKCS11_CKFT_ERROR_STATE				(1U << 24)
878 
879 /* Values for user identity */
880 enum pkcs11_user_type {
881 	PKCS11_CKU_SO = 0x000,
882 	PKCS11_CKU_USER = 0x001,
883 	PKCS11_CKU_CONTEXT_SPECIFIC = 0x002,
884 };
885 
886 /*
887  * TEE Identity based authentication for tokens
888  *
889  * When configuration CFG_PKCS11_TA_AUTH_TEE_IDENTITY is enabled TEE Identity
890  * based authentication scheme is enabled.
891  *
892  * Feature enablement per token basis is controlled by token flag:
893  * pkcs11_token_info->flags & PKCS11_CKFT_PROTECTED_AUTHENTICATION_PATH
894  *
895  * When calling C_InitToken() mode is determined based on SO PIN value.
896  * - If the PIN is empty (or NULL_PTR) then active client TEE Identity will be
897  *   used as SO TEE Identity
898  * - If the PIN is given then normal PIN behavior is used
899  *
900  * Once TEE Identity based authentication is activated following operational
901  * changes happen:
902  * - PIN failure counters are disabled to prevent token authentication lockups
903  * - Switching to different authentication mode needs C_InitToken()
904  * - When C_Login() or so is performed actual PIN value is ignored and active
905  *   client TEE Identity will be used
906  *
907  * Different types of TEE Identity authentication methods can be configured:
908  * - Configured with C_InitToken(), C_InitPIN() or by C_SetPIN()
909  * - PIN value follows below PIN syntax
910  *
911  * TEE Identity based authenticate PIN syntax:
912  * - PIN value: NULL_PTR or empty
913  *   - Use active client TEE Identity
914  * - PIN value: public
915  *   - TEE public login
916  * - PIN value: user:<client UUID string>
917  *   - TEE user login with client UUID matching user credentials
918  * - PIN value: group:<client UUID string>
919  *   - TEE group login with client UUID matching group credentials
920  */
921 
922 /* Keywords for protected authenticated path PIN parser */
923 #define PKCS11_AUTH_TEE_IDENTITY_PUBLIC	"public"
924 #define PKCS11_AUTH_TEE_IDENTITY_USER	"user:"
925 #define PKCS11_AUTH_TEE_IDENTITY_GROUP	"group:"
926 
927 /*
928  * Values for 32bit session flags argument to PKCS11_CMD_OPEN_SESSION
929  * and pkcs11_session_info::flags.
930  * PKCS11_CKFSS_<x> reflects CryptoKi client API session flags CKF_<x>.
931  */
932 #define PKCS11_CKFSS_RW_SESSION				(1U << 1)
933 #define PKCS11_CKFSS_SERIAL_SESSION			(1U << 2)
934 
935 /*
936  * Arguments for PKCS11_CMD_SESSION_INFO
937  */
938 
939 struct pkcs11_session_info {
940 	uint32_t slot_id;
941 	uint32_t state;
942 	uint32_t flags;
943 	uint32_t device_error;
944 };
945 
946 /* Valid values for pkcs11_session_info::state */
947 enum pkcs11_session_state {
948 	PKCS11_CKS_RO_PUBLIC_SESSION = 0,
949 	PKCS11_CKS_RO_USER_FUNCTIONS = 1,
950 	PKCS11_CKS_RW_PUBLIC_SESSION = 2,
951 	PKCS11_CKS_RW_USER_FUNCTIONS = 3,
952 	PKCS11_CKS_RW_SO_FUNCTIONS = 4,
953 };
954 
955 /*
956  * Arguments for PKCS11_CMD_MECHANISM_INFO
957  */
958 
959 struct pkcs11_mechanism_info {
960 	uint32_t min_key_size;
961 	uint32_t max_key_size;
962 	uint32_t flags;
963 };
964 
965 /*
966  * Values for pkcs11_mechanism_info::flags.
967  * PKCS11_CKFM_<x> reflects CryptoKi client API mechanism flags CKF_<x>.
968  */
969 #define PKCS11_CKFM_HW				(1U << 0)
970 #define PKCS11_CKFM_ENCRYPT			(1U << 8)
971 #define PKCS11_CKFM_DECRYPT			(1U << 9)
972 #define PKCS11_CKFM_DIGEST			(1U << 10)
973 #define PKCS11_CKFM_SIGN			(1U << 11)
974 #define PKCS11_CKFM_SIGN_RECOVER		(1U << 12)
975 #define PKCS11_CKFM_VERIFY			(1U << 13)
976 #define PKCS11_CKFM_VERIFY_RECOVER		(1U << 14)
977 #define PKCS11_CKFM_GENERATE			(1U << 15)
978 #define PKCS11_CKFM_GENERATE_KEY_PAIR		(1U << 16)
979 #define PKCS11_CKFM_WRAP			(1U << 17)
980 #define PKCS11_CKFM_UNWRAP			(1U << 18)
981 #define PKCS11_CKFM_DERIVE			(1U << 19)
982 #define PKCS11_CKFM_EC_F_P			(1U << 20)
983 #define PKCS11_CKFM_EC_F_2M			(1U << 21)
984 #define PKCS11_CKFM_EC_ECPARAMETERS		(1U << 22)
985 #define PKCS11_CKFM_EC_NAMEDCURVE		(1U << 23)
986 #define PKCS11_CKFM_EC_UNCOMPRESS		(1U << 24)
987 #define PKCS11_CKFM_EC_COMPRESS			(1U << 25)
988 
989 /*
990  * pkcs11_object_head - Header of object whose data are serialized in memory
991  *
992  * An object is made of several attributes. Attributes are stored one next to
993  * the other with byte alignment as a serialized byte array. The byte array
994  * of serialized attributes is prepended with the size of the attrs[] array
995  * in bytes and the number of attributes in the array, yielding the struct
996  * pkcs11_object_head.
997  *
998  * @attrs_size - byte size of whole byte array attrs[]
999  * @attrs_count - number of attribute items stored in attrs[]
1000  * @attrs - then starts the attributes data
1001  */
1002 struct pkcs11_object_head {
1003 	uint32_t attrs_size;
1004 	uint32_t attrs_count;
1005 	uint8_t attrs[];
1006 };
1007 
1008 /*
1009  * Attribute reference in the TA ABI. Each attribute starts with a header
1010  * structure followed by the attribute value. The attribute byte size is
1011  * defined in the attribute header.
1012  *
1013  * @id - the 32bit identifier of the attribute, see PKCS11_CKA_<x>
1014  * @size - the 32bit value attribute byte size
1015  * @data - then starts the attribute value
1016  */
1017 struct pkcs11_attribute_head {
1018 	uint32_t id;
1019 	uint32_t size;
1020 	uint8_t data[];
1021 };
1022 
1023 /*
1024  * Attribute identification IDs as of v2.40 excluding deprecated IDs.
1025  * Valid values for struct pkcs11_attribute_head::id
1026  * PKCS11_CKA_<x> reflects CryptoKi client API attribute IDs CKA_<x>.
1027  */
1028 enum pkcs11_attr_id {
1029 	PKCS11_CKA_CLASS			= 0x0000,
1030 	PKCS11_CKA_TOKEN			= 0x0001,
1031 	PKCS11_CKA_PRIVATE			= 0x0002,
1032 	PKCS11_CKA_LABEL			= 0x0003,
1033 	PKCS11_CKA_APPLICATION			= 0x0010,
1034 	PKCS11_CKA_VALUE			= 0x0011,
1035 	PKCS11_CKA_OBJECT_ID			= 0x0012,
1036 	PKCS11_CKA_CERTIFICATE_TYPE		= 0x0080,
1037 	PKCS11_CKA_ISSUER			= 0x0081,
1038 	PKCS11_CKA_SERIAL_NUMBER		= 0x0082,
1039 	PKCS11_CKA_AC_ISSUER			= 0x0083,
1040 	PKCS11_CKA_OWNER			= 0x0084,
1041 	PKCS11_CKA_ATTR_TYPES			= 0x0085,
1042 	PKCS11_CKA_TRUSTED			= 0x0086,
1043 	PKCS11_CKA_CERTIFICATE_CATEGORY		= 0x0087,
1044 	PKCS11_CKA_JAVA_MIDP_SECURITY_DOMAIN	= 0x0088,
1045 	PKCS11_CKA_URL				= 0x0089,
1046 	PKCS11_CKA_HASH_OF_SUBJECT_PUBLIC_KEY	= 0x008a,
1047 	PKCS11_CKA_HASH_OF_ISSUER_PUBLIC_KEY	= 0x008b,
1048 	PKCS11_CKA_NAME_HASH_ALGORITHM		= 0x008c,
1049 	PKCS11_CKA_CHECK_VALUE			= 0x0090,
1050 	PKCS11_CKA_KEY_TYPE			= 0x0100,
1051 	PKCS11_CKA_SUBJECT			= 0x0101,
1052 	PKCS11_CKA_ID				= 0x0102,
1053 	PKCS11_CKA_SENSITIVE			= 0x0103,
1054 	PKCS11_CKA_ENCRYPT			= 0x0104,
1055 	PKCS11_CKA_DECRYPT			= 0x0105,
1056 	PKCS11_CKA_WRAP				= 0x0106,
1057 	PKCS11_CKA_UNWRAP			= 0x0107,
1058 	PKCS11_CKA_SIGN				= 0x0108,
1059 	PKCS11_CKA_SIGN_RECOVER			= 0x0109,
1060 	PKCS11_CKA_VERIFY			= 0x010a,
1061 	PKCS11_CKA_VERIFY_RECOVER		= 0x010b,
1062 	PKCS11_CKA_DERIVE			= 0x010c,
1063 	PKCS11_CKA_START_DATE			= 0x0110,
1064 	PKCS11_CKA_END_DATE			= 0x0111,
1065 	PKCS11_CKA_MODULUS			= 0x0120,
1066 	PKCS11_CKA_MODULUS_BITS			= 0x0121,
1067 	PKCS11_CKA_PUBLIC_EXPONENT		= 0x0122,
1068 	PKCS11_CKA_PRIVATE_EXPONENT		= 0x0123,
1069 	PKCS11_CKA_PRIME_1			= 0x0124,
1070 	PKCS11_CKA_PRIME_2			= 0x0125,
1071 	PKCS11_CKA_EXPONENT_1			= 0x0126,
1072 	PKCS11_CKA_EXPONENT_2			= 0x0127,
1073 	PKCS11_CKA_COEFFICIENT			= 0x0128,
1074 	PKCS11_CKA_PUBLIC_KEY_INFO		= 0x0129,
1075 	PKCS11_CKA_PRIME			= 0x0130,
1076 	PKCS11_CKA_SUBPRIME			= 0x0131,
1077 	PKCS11_CKA_BASE				= 0x0132,
1078 	PKCS11_CKA_PRIME_BITS			= 0x0133,
1079 	PKCS11_CKA_SUBPRIME_BITS		= 0x0134,
1080 	PKCS11_CKA_VALUE_BITS			= 0x0160,
1081 	PKCS11_CKA_VALUE_LEN			= 0x0161,
1082 	PKCS11_CKA_EXTRACTABLE			= 0x0162,
1083 	PKCS11_CKA_LOCAL			= 0x0163,
1084 	PKCS11_CKA_NEVER_EXTRACTABLE		= 0x0164,
1085 	PKCS11_CKA_ALWAYS_SENSITIVE		= 0x0165,
1086 	PKCS11_CKA_KEY_GEN_MECHANISM		= 0x0166,
1087 	PKCS11_CKA_MODIFIABLE			= 0x0170,
1088 	PKCS11_CKA_COPYABLE			= 0x0171,
1089 	PKCS11_CKA_DESTROYABLE			= 0x0172,
1090 	PKCS11_CKA_EC_PARAMS			= 0x0180,
1091 	PKCS11_CKA_EC_POINT			= 0x0181,
1092 	PKCS11_CKA_ALWAYS_AUTHENTICATE		= 0x0202,
1093 	PKCS11_CKA_WRAP_WITH_TRUSTED		= 0x0210,
1094 	/*
1095 	 * The leading 4 comes from the PKCS#11 spec or:ing with
1096 	 * CKF_ARRAY_ATTRIBUTE = 0x40000000.
1097 	 */
1098 	PKCS11_CKA_WRAP_TEMPLATE		= 0x40000211,
1099 	PKCS11_CKA_UNWRAP_TEMPLATE		= 0x40000212,
1100 	PKCS11_CKA_DERIVE_TEMPLATE		= 0x40000213,
1101 	PKCS11_CKA_OTP_FORMAT			= 0x0220,
1102 	PKCS11_CKA_OTP_LENGTH			= 0x0221,
1103 	PKCS11_CKA_OTP_TIME_INTERVAL		= 0x0222,
1104 	PKCS11_CKA_OTP_USER_FRIENDLY_MODE	= 0x0223,
1105 	PKCS11_CKA_OTP_CHALLENGE_REQUIREMENT	= 0x0224,
1106 	PKCS11_CKA_OTP_TIME_REQUIREMENT		= 0x0225,
1107 	PKCS11_CKA_OTP_COUNTER_REQUIREMENT	= 0x0226,
1108 	PKCS11_CKA_OTP_PIN_REQUIREMENT		= 0x0227,
1109 	PKCS11_CKA_OTP_COUNTER			= 0x022e,
1110 	PKCS11_CKA_OTP_TIME			= 0x022f,
1111 	PKCS11_CKA_OTP_USER_IDENTIFIER		= 0x022a,
1112 	PKCS11_CKA_OTP_SERVICE_IDENTIFIER	= 0x022b,
1113 	PKCS11_CKA_OTP_SERVICE_LOGO		= 0x022c,
1114 	PKCS11_CKA_OTP_SERVICE_LOGO_TYPE	= 0x022d,
1115 	PKCS11_CKA_GOSTR3410_PARAMS		= 0x0250,
1116 	PKCS11_CKA_GOSTR3411_PARAMS		= 0x0251,
1117 	PKCS11_CKA_GOST28147_PARAMS		= 0x0252,
1118 	PKCS11_CKA_HW_FEATURE_TYPE		= 0x0300,
1119 	PKCS11_CKA_RESET_ON_INIT		= 0x0301,
1120 	PKCS11_CKA_HAS_RESET			= 0x0302,
1121 	PKCS11_CKA_PIXEL_X			= 0x0400,
1122 	PKCS11_CKA_PIXEL_Y			= 0x0401,
1123 	PKCS11_CKA_RESOLUTION			= 0x0402,
1124 	PKCS11_CKA_CHAR_ROWS			= 0x0403,
1125 	PKCS11_CKA_CHAR_COLUMNS			= 0x0404,
1126 	PKCS11_CKA_COLOR			= 0x0405,
1127 	PKCS11_CKA_BITS_PER_PIXEL		= 0x0406,
1128 	PKCS11_CKA_CHAR_SETS			= 0x0480,
1129 	PKCS11_CKA_ENCODING_METHODS		= 0x0481,
1130 	PKCS11_CKA_MIME_TYPES			= 0x0482,
1131 	PKCS11_CKA_MECHANISM_TYPE		= 0x0500,
1132 	PKCS11_CKA_REQUIRED_CMS_ATTRIBUTES	= 0x0501,
1133 	PKCS11_CKA_DEFAULT_CMS_ATTRIBUTES	= 0x0502,
1134 	PKCS11_CKA_SUPPORTED_CMS_ATTRIBUTES	= 0x0503,
1135 	/*
1136 	 * The leading 4 comes from the PKCS#11 spec or:ing with
1137 	 * CKF_ARRAY_ATTRIBUTE = 0x40000000.
1138 	 */
1139 	PKCS11_CKA_ALLOWED_MECHANISMS		= 0x40000600,
1140 	/* Vendor extension: reserved for undefined ID (~0U) */
1141 	PKCS11_CKA_UNDEFINED_ID			= PKCS11_UNDEFINED_ID,
1142 };
1143 
1144 /*
1145  * Valid values for attribute PKCS11_CKA_CLASS
1146  * PKCS11_CKO_<x> reflects CryptoKi client API object class IDs CKO_<x>.
1147  */
1148 enum pkcs11_class_id {
1149 	PKCS11_CKO_DATA				= 0x000,
1150 	PKCS11_CKO_CERTIFICATE			= 0x001,
1151 	PKCS11_CKO_PUBLIC_KEY			= 0x002,
1152 	PKCS11_CKO_PRIVATE_KEY			= 0x003,
1153 	PKCS11_CKO_SECRET_KEY			= 0x004,
1154 	PKCS11_CKO_HW_FEATURE			= 0x005,
1155 	PKCS11_CKO_DOMAIN_PARAMETERS		= 0x006,
1156 	PKCS11_CKO_MECHANISM			= 0x007,
1157 	PKCS11_CKO_OTP_KEY			= 0x008,
1158 	/* Vendor extension: reserved for undefined ID (~0U) */
1159 	PKCS11_CKO_UNDEFINED_ID			= PKCS11_UNDEFINED_ID,
1160 };
1161 
1162 /*
1163  * Valid values for attribute PKCS11_CKA_KEY_TYPE
1164  * PKCS11_CKK_<x> reflects CryptoKi client API key type IDs CKK_<x>.
1165  * Note that this is only a subset of the PKCS#11 specification.
1166  */
1167 enum pkcs11_key_type {
1168 	PKCS11_CKK_RSA				= 0x000,
1169 	PKCS11_CKK_DSA				= 0x001,
1170 	PKCS11_CKK_DH				= 0x002,
1171 	PKCS11_CKK_EC				= 0x003,
1172 	PKCS11_CKK_EDDSA			= 0x004,
1173 	PKCS11_CKK_GENERIC_SECRET		= 0x010,
1174 	PKCS11_CKK_AES				= 0x01f,
1175 	PKCS11_CKK_MD5_HMAC			= 0x027,
1176 	PKCS11_CKK_SHA_1_HMAC			= 0x028,
1177 	PKCS11_CKK_SHA256_HMAC			= 0x02b,
1178 	PKCS11_CKK_SHA384_HMAC			= 0x02c,
1179 	PKCS11_CKK_SHA512_HMAC			= 0x02d,
1180 	PKCS11_CKK_SHA224_HMAC			= 0x02e,
1181 	PKCS11_CKK_EC_EDWARDS			= 0x040,
1182 	/* Vendor extension: reserved for undefined ID (~0U) */
1183 	PKCS11_CKK_UNDEFINED_ID			= PKCS11_UNDEFINED_ID,
1184 };
1185 
1186 /*
1187  * Valid values for attribute PKCS11_CKA_CERTIFICATE_TYPE
1188  */
1189 enum pkcs11_certificate_type {
1190 	PKCS11_CKC_X_509		= 0x00000000UL,
1191 	PKCS11_CKC_X_509_ATTR_CERT	= 0x00000001UL,
1192 	PKCS11_CKC_WTLS			= 0x00000002UL,
1193 	/* Vendor extension: reserved for undefined ID (~0U) */
1194 	PKCS11_CKC_UNDEFINED_ID		= PKCS11_UNDEFINED_ID,
1195 };
1196 
1197 /*
1198  * Valid values for attribute PKCS11_CKA_CERTIFICATE_CATEGORY
1199  */
1200 enum pkcs11_certificate_category {
1201 	PKCS11_CK_CERTIFICATE_CATEGORY_UNSPECIFIED	= 0UL,
1202 	PKCS11_CK_CERTIFICATE_CATEGORY_TOKEN_USER	= 1UL,
1203 	PKCS11_CK_CERTIFICATE_CATEGORY_AUTHORITY	= 2UL,
1204 	PKCS11_CK_CERTIFICATE_CATEGORY_OTHER_ENTITY	= 3UL,
1205 };
1206 
1207 /*
1208  * Valid values for mechanism IDs
1209  * PKCS11_CKM_<x> reflects CryptoKi client API mechanism IDs CKM_<x>.
1210  * Note that this will be extended as needed.
1211  */
1212 enum pkcs11_mechanism_id {
1213 	PKCS11_CKM_RSA_PKCS_KEY_PAIR_GEN	= 0x00000,
1214 	PKCS11_CKM_RSA_PKCS			= 0x00001,
1215 	PKCS11_CKM_MD5_RSA_PKCS			= 0x00005,
1216 	PKCS11_CKM_SHA1_RSA_PKCS		= 0x00006,
1217 	PKCS11_CKM_RSA_PKCS_OAEP		= 0x00009,
1218 	PKCS11_CKM_RSA_PKCS_PSS			= 0x0000d,
1219 	PKCS11_CKM_SHA1_RSA_PKCS_PSS		= 0x0000e,
1220 	PKCS11_CKM_SHA256_RSA_PKCS		= 0x00040,
1221 	PKCS11_CKM_SHA384_RSA_PKCS		= 0x00041,
1222 	PKCS11_CKM_SHA512_RSA_PKCS		= 0x00042,
1223 	PKCS11_CKM_SHA256_RSA_PKCS_PSS		= 0x00043,
1224 	PKCS11_CKM_SHA384_RSA_PKCS_PSS		= 0x00044,
1225 	PKCS11_CKM_SHA512_RSA_PKCS_PSS		= 0x00045,
1226 	PKCS11_CKM_SHA224_RSA_PKCS		= 0x00046,
1227 	PKCS11_CKM_SHA224_RSA_PKCS_PSS		= 0x00047,
1228 	PKCS11_CKM_MD5				= 0x00210,
1229 	PKCS11_CKM_MD5_HMAC			= 0x00211,
1230 	PKCS11_CKM_MD5_HMAC_GENERAL		= 0x00212,
1231 	PKCS11_CKM_SHA_1			= 0x00220,
1232 	PKCS11_CKM_SHA_1_HMAC			= 0x00221,
1233 	PKCS11_CKM_SHA_1_HMAC_GENERAL		= 0x00222,
1234 	PKCS11_CKM_SHA256			= 0x00250,
1235 	PKCS11_CKM_SHA256_HMAC			= 0x00251,
1236 	PKCS11_CKM_SHA256_HMAC_GENERAL		= 0x00252,
1237 	PKCS11_CKM_SHA224			= 0x00255,
1238 	PKCS11_CKM_SHA224_HMAC			= 0x00256,
1239 	PKCS11_CKM_SHA224_HMAC_GENERAL		= 0x00257,
1240 	PKCS11_CKM_SHA384			= 0x00260,
1241 	PKCS11_CKM_SHA384_HMAC			= 0x00261,
1242 	PKCS11_CKM_SHA384_HMAC_GENERAL		= 0x00262,
1243 	PKCS11_CKM_SHA512			= 0x00270,
1244 	PKCS11_CKM_SHA512_HMAC			= 0x00271,
1245 	PKCS11_CKM_SHA512_HMAC_GENERAL		= 0x00272,
1246 	PKCS11_CKM_GENERIC_SECRET_KEY_GEN	= 0x00350,
1247 	PKCS11_CKM_EC_KEY_PAIR_GEN		= 0x01040,
1248 	PKCS11_CKM_ECDSA			= 0x01041,
1249 	PKCS11_CKM_ECDSA_SHA1			= 0x01042,
1250 	PKCS11_CKM_ECDSA_SHA224			= 0x01043,
1251 	PKCS11_CKM_ECDSA_SHA256			= 0x01044,
1252 	PKCS11_CKM_ECDSA_SHA384			= 0x01045,
1253 	PKCS11_CKM_ECDSA_SHA512			= 0x01046,
1254 	PKCS11_CKM_ECDH1_DERIVE			= 0x01050,
1255 	PKCS11_CKM_RSA_AES_KEY_WRAP		= 0x01054,
1256 	PKCS11_CKM_EC_EDWARDS_KEY_PAIR_GEN	= 0x01055,
1257 	PKCS11_CKM_EDDSA			= 0x01057,
1258 	PKCS11_CKM_AES_KEY_GEN			= 0x01080,
1259 	PKCS11_CKM_AES_ECB			= 0x01081,
1260 	PKCS11_CKM_AES_CBC			= 0x01082,
1261 	PKCS11_CKM_AES_CBC_PAD			= 0x01085,
1262 	PKCS11_CKM_AES_CTR			= 0x01086,
1263 	PKCS11_CKM_AES_CTS			= 0x01089,
1264 	PKCS11_CKM_AES_CMAC			= 0x0108a,
1265 	PKCS11_CKM_AES_CMAC_GENERAL		= 0x0108b,
1266 	PKCS11_CKM_AES_ECB_ENCRYPT_DATA		= 0x01104,
1267 	PKCS11_CKM_AES_CBC_ENCRYPT_DATA		= 0x01105,
1268 	/*
1269 	 * Vendor extensions below.
1270 	 * PKCS11 added IDs for operation not related to a CK mechanism ID
1271 	 */
1272 	PKCS11_PROCESSING_IMPORT		= 0x80000000,
1273 	PKCS11_CKM_UNDEFINED_ID			= PKCS11_UNDEFINED_ID,
1274 };
1275 
1276 /*
1277  * PKCS11_CKD_<x> reflects CryptoKi client API key diff function IDs CKD_<x>.
1278  */
1279 enum pkcs11_keydiff_id {
1280 	PKCS11_CKD_NULL				= 0x0001,
1281 	/* Vendor extension: reserved for undefined ID (~0U) */
1282 	PKCS11_CKD_UNDEFINED_ID			= PKCS11_UNDEFINED_ID,
1283 };
1284 
1285 /*
1286  * Valid values MG function identifiers
1287  * PKCS11_CKG_<x> reflects CryptoKi client API MG function IDs CKG_<x>.
1288  */
1289 enum pkcs11_mgf_id {
1290 	PKCS11_CKG_MGF1_SHA1			= 0x0001,
1291 	PKCS11_CKG_MGF1_SHA224			= 0x0005,
1292 	PKCS11_CKG_MGF1_SHA256			= 0x0002,
1293 	PKCS11_CKG_MGF1_SHA384			= 0x0003,
1294 	PKCS11_CKG_MGF1_SHA512			= 0x0004,
1295 	/* Vendor extension: reserved for undefined ID (~0U) */
1296 	PKCS11_CKG_UNDEFINED_ID			= PKCS11_UNDEFINED_ID,
1297 };
1298 
1299 /*
1300  * Valid values for RSA PKCS/OAEP source type identifier
1301  * PKCS11_CKZ_<x> reflects CryptoKi client API source type IDs CKZ_<x>.
1302  */
1303 #define PKCS11_CKZ_DATA_SPECIFIED		0x0001
1304 
1305 #endif /*PKCS11_TA_H*/
1306