Print this page
5045 use atomic_{inc,dec}_* instead of atomic_add_*
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/sys/crypto/impl.h
+++ new/usr/src/uts/common/sys/crypto/impl.h
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21 /*
22 22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23 23 */
24 24
25 25 #ifndef _SYS_CRYPTO_IMPL_H
26 26 #define _SYS_CRYPTO_IMPL_H
27 27
28 28 /*
29 29 * Kernel Cryptographic Framework private implementation definitions.
30 30 */
31 31
32 32 #include <sys/types.h>
33 33 #include <sys/param.h>
34 34
35 35 #ifdef _KERNEL
36 36 #include <sys/crypto/common.h>
37 37 #include <sys/crypto/api.h>
38 38 #include <sys/crypto/spi.h>
39 39 #include <sys/crypto/ioctl.h>
40 40 #include <sys/tnf_probe.h>
41 41 #include <sys/atomic.h>
42 42 #include <sys/project.h>
43 43 #include <sys/taskq.h>
44 44 #include <sys/rctl.h>
45 45 #include <sys/cpuvar.h>
46 46 #endif /* _KERNEL */
47 47
48 48 #ifdef __cplusplus
49 49 extern "C" {
50 50 #endif
51 51
52 52 #ifdef _KERNEL
53 53
54 54 /*
55 55 * Prefixes convention: structures internal to the kernel cryptographic
56 56 * framework start with 'kcf_'. Exposed structure start with 'crypto_'.
57 57 */
58 58
59 59 /* Provider stats. Not protected. */
60 60 typedef struct kcf_prov_stats {
61 61 kstat_named_t ps_ops_total;
62 62 kstat_named_t ps_ops_passed;
63 63 kstat_named_t ps_ops_failed;
64 64 kstat_named_t ps_ops_busy_rval;
65 65 } kcf_prov_stats_t;
66 66
67 67 /* Various kcf stats. Not protected. */
68 68 typedef struct kcf_stats {
69 69 kstat_named_t ks_thrs_in_pool;
70 70 kstat_named_t ks_idle_thrs;
71 71 kstat_named_t ks_minthrs;
72 72 kstat_named_t ks_maxthrs;
73 73 kstat_named_t ks_swq_njobs;
74 74 kstat_named_t ks_swq_maxjobs;
75 75 kstat_named_t ks_taskq_threads;
76 76 kstat_named_t ks_taskq_minalloc;
77 77 kstat_named_t ks_taskq_maxalloc;
78 78 } kcf_stats_t;
79 79
80 80 #define CPU_SEQID (CPU->cpu_seqid)
81 81
82 82 typedef struct kcf_lock_withpad {
83 83 kmutex_t kl_lock;
84 84 uint8_t kl_pad[64 - sizeof (kmutex_t)];
85 85 } kcf_lock_withpad_t;
86 86
87 87 /*
88 88 * Per-CPU structure used by a provider to keep track of
89 89 * various counters.
90 90 */
91 91 typedef struct kcf_prov_cpu {
92 92 kmutex_t kp_lock;
93 93 int kp_holdcnt; /* can go negative! */
94 94 uint_t kp_jobcnt;
95 95
96 96 uint64_t kp_ndispatches;
97 97 uint64_t kp_nfails;
98 98 uint64_t kp_nbusy_rval;
99 99 kcondvar_t kp_cv;
100 100
101 101 uint8_t kp_pad[64 - sizeof (kmutex_t) - 2 * sizeof (int) -
102 102 3 * sizeof (uint64_t) - sizeof (kcondvar_t)];
103 103 } kcf_prov_cpu_t;
104 104
105 105 /*
106 106 * kcf_get_refcnt(pd) is the number of inflight requests to the
107 107 * provider. So, it is a good measure of the load on a provider when
108 108 * it is not in a busy state. Once a provider notifies it is busy, requests
109 109 * backup in the taskq. So, we use tq_nalloc in that case which gives
110 110 * the number of task entries in the task queue. Note that we do not
111 111 * acquire any locks here as it is not critical to get the exact number
112 112 * and the lock contention is too costly for this code path.
113 113 */
114 114 #define KCF_PROV_LOAD(pd) ((pd)->pd_state != KCF_PROV_BUSY ? \
115 115 kcf_get_refcnt(pd, B_FALSE) : (pd)->pd_taskq->tq_nalloc)
116 116
117 117
118 118 /*
119 119 * The following two macros should be
120 120 * #define KCF_OPS_CLASSSIZE (KCF_LAST_OPSCLASS - KCF_FIRST_OPSCLASS + 2)
121 121 * #define KCF_MAXMECHTAB KCF_MAXCIPHER
122 122 *
123 123 * However, doing that would involve reorganizing the header file a bit.
124 124 * When impl.h is broken up (bug# 4703218), this will be done. For now,
125 125 * we hardcode these values.
126 126 */
127 127 #define KCF_OPS_CLASSSIZE 8
128 128 #define KCF_MAXMECHTAB 32
129 129
130 130 /*
131 131 * Valid values for the state of a provider. The order of
132 132 * the elements is important.
133 133 *
134 134 * Routines which get a provider or the list of providers
135 135 * should pick only those that are either in KCF_PROV_READY state
136 136 * or in KCF_PROV_BUSY state.
137 137 */
138 138 typedef enum {
139 139 KCF_PROV_ALLOCATED = 1,
140 140 KCF_PROV_UNVERIFIED,
141 141 KCF_PROV_UNVERIFIED_FIPS140,
142 142 KCF_PROV_VERIFICATION_FAILED,
143 143 /*
144 144 * state < KCF_PROV_READY means the provider can not
145 145 * be used at all.
146 146 */
147 147 KCF_PROV_READY,
148 148 KCF_PROV_BUSY,
149 149 /*
150 150 * state > KCF_PROV_BUSY means the provider can not
151 151 * be used for new requests.
152 152 */
153 153 KCF_PROV_FAILED,
154 154 /*
155 155 * Threads setting the following two states should do so only
156 156 * if the current state < KCF_PROV_DISABLED.
157 157 */
158 158 KCF_PROV_DISABLED,
159 159 KCF_PROV_UNREGISTERING,
160 160 KCF_PROV_UNREGISTERED
161 161 } kcf_prov_state_t;
162 162
163 163 #define KCF_IS_PROV_UNVERIFIED(pd) ((pd)->pd_state == KCF_PROV_UNVERIFIED)
164 164 #define KCF_IS_PROV_USABLE(pd) ((pd)->pd_state == KCF_PROV_READY || \
165 165 (pd)->pd_state == KCF_PROV_BUSY)
166 166 #define KCF_IS_PROV_REMOVED(pd) ((pd)->pd_state >= KCF_PROV_UNREGISTERING)
167 167
168 168 /* Internal flags valid for pd_flags field */
169 169 #define KCF_LPROV_MEMBER 0x80000000 /* is member of a logical provider */
170 170
171 171 /*
172 172 * A provider descriptor structure. There is one such structure per
173 173 * provider. It is allocated and initialized at registration time and
174 174 * freed when the provider unregisters.
175 175 *
176 176 * pd_prov_type: Provider type, hardware or software
177 177 * pd_sid: Session ID of the provider used by kernel clients.
178 178 * This is valid only for session-oriented providers.
179 179 * pd_taskq: taskq used to dispatch crypto requests
180 180 * pd_nbins: number of bins in pd_percpu_bins
181 181 * pd_percpu_bins: Pointer to an array of per-CPU structures
182 182 * containing a lock, a cv and various counters.
183 183 * pd_lock: lock protects pd_state and pd_provider_list
184 184 * pd_state: State value of the provider
185 185 * pd_provider_list: Used to cross-reference logical providers and their
186 186 * members. Not used for software providers.
187 187 * pd_resume_cv: cv to wait for state to change from KCF_PROV_BUSY
188 188 * pd_prov_handle: Provider handle specified by provider
189 189 * pd_ops_vector: The ops vector specified by Provider
190 190 * pd_mech_indx: Lookup table which maps a core framework mechanism
191 191 * number to an index in pd_mechanisms array
192 192 * pd_mechanisms: Array of mechanisms supported by the provider, specified
193 193 * by the provider during registration
194 194 * pd_mech_list_count: The number of entries in pi_mechanisms, specified
195 195 * by the provider during registration
196 196 * pd_name: Device name or module name
197 197 * pd_instance: Device instance
198 198 * pd_module_id: Module ID returned by modload
199 199 * pd_mctlp: Pointer to modctl structure for this provider
200 200 * pd_description: Provider description string
201 201 * pd_flags: bitwise OR of pi_flags from crypto_provider_info_t
202 202 * and other internal flags defined above.
203 203 * pd_hash_limit: Maximum data size that hash mechanisms of this provider
204 204 * can support.
205 205 * pd_hmac_limit: Maximum data size that HMAC mechanisms of this provider
206 206 * can support.
207 207 * pd_kcf_prov_handle: KCF-private handle assigned by KCF
208 208 * pd_prov_id: Identification # assigned by KCF to provider
209 209 * pd_kstat: kstat associated with the provider
210 210 * pd_ks_data: kstat data
211 211 */
212 212 typedef struct kcf_provider_desc {
213 213 crypto_provider_type_t pd_prov_type;
214 214 crypto_session_id_t pd_sid;
215 215 taskq_t *pd_taskq;
216 216 uint_t pd_nbins;
217 217 kcf_prov_cpu_t *pd_percpu_bins;
218 218 kmutex_t pd_lock;
219 219 kcf_prov_state_t pd_state;
220 220 struct kcf_provider_list *pd_provider_list;
221 221 kcondvar_t pd_resume_cv;
222 222 crypto_provider_handle_t pd_prov_handle;
223 223 crypto_ops_t *pd_ops_vector;
224 224 ushort_t pd_mech_indx[KCF_OPS_CLASSSIZE]\
225 225 [KCF_MAXMECHTAB];
226 226 crypto_mech_info_t *pd_mechanisms;
227 227 uint_t pd_mech_list_count;
228 228 char *pd_name;
229 229 uint_t pd_instance;
230 230 int pd_module_id;
231 231 struct modctl *pd_mctlp;
232 232 char *pd_description;
233 233 uint_t pd_flags;
234 234 uint_t pd_hash_limit;
235 235 uint_t pd_hmac_limit;
236 236 crypto_kcf_provider_handle_t pd_kcf_prov_handle;
237 237 crypto_provider_id_t pd_prov_id;
238 238 kstat_t *pd_kstat;
239 239 kcf_prov_stats_t pd_ks_data;
240 240 } kcf_provider_desc_t;
241 241
242 242 /* useful for making a list of providers */
243 243 typedef struct kcf_provider_list {
244 244 struct kcf_provider_list *pl_next;
245 245 struct kcf_provider_desc *pl_provider;
246 246 } kcf_provider_list_t;
247 247
248 248 /*
249 249 * If a component has a reference to a kcf_provider_desc_t,
250 250 * it REFHOLD()s. A new provider descriptor which is referenced only
251 251 * by the providers table has a reference counter of one.
252 252 */
253 253 #define KCF_PROV_REFHOLD(desc) { \
254 254 kcf_prov_cpu_t *mp; \
255 255 \
256 256 mp = &((desc)->pd_percpu_bins[CPU_SEQID]); \
257 257 mutex_enter(&mp->kp_lock); \
258 258 mp->kp_holdcnt++; \
259 259 mutex_exit(&mp->kp_lock); \
260 260 }
261 261
262 262 #define KCF_PROV_REFRELE(desc) { \
263 263 kcf_prov_cpu_t *mp; \
264 264 \
265 265 mp = &((desc)->pd_percpu_bins[CPU_SEQID]); \
266 266 mutex_enter(&mp->kp_lock); \
267 267 mp->kp_holdcnt--; \
268 268 mutex_exit(&mp->kp_lock); \
269 269 }
270 270
271 271 #define KCF_PROV_REFHELD(desc) (kcf_get_refcnt(desc, B_TRUE) >= 1)
272 272
273 273 /*
274 274 * The JOB macros are used only for a hardware provider.
275 275 * Hardware providers can have holds that stay forever.
276 276 * So, the job counter is used to check if it is safe to
277 277 * unregister a provider.
278 278 */
279 279 #define KCF_PROV_JOB_HOLD(mp) { \
280 280 mutex_enter(&(mp)->kp_lock); \
281 281 (mp)->kp_jobcnt++; \
282 282 mutex_exit(&(mp)->kp_lock); \
283 283 }
284 284
285 285 #define KCF_PROV_JOB_RELE(mp) { \
286 286 mutex_enter(&(mp)->kp_lock); \
287 287 (mp)->kp_jobcnt--; \
288 288 if ((mp)->kp_jobcnt == 0) \
289 289 cv_signal(&(mp)->kp_cv); \
290 290 mutex_exit(&(mp)->kp_lock); \
291 291 }
292 292
293 293 #define KCF_PROV_JOB_RELE_STAT(mp, doincr) { \
294 294 if (doincr) \
295 295 (mp)->kp_nfails++; \
296 296 KCF_PROV_JOB_RELE(mp); \
297 297 }
298 298
299 299 #define KCF_PROV_INCRSTATS(pd, error) { \
300 300 kcf_prov_cpu_t *mp; \
301 301 \
302 302 mp = &((pd)->pd_percpu_bins[CPU_SEQID]); \
303 303 mp->kp_ndispatches++; \
304 304 if ((error) == CRYPTO_BUSY) \
305 305 mp->kp_nbusy_rval++; \
306 306 else if ((error) != CRYPTO_SUCCESS && (error) != CRYPTO_QUEUED) \
307 307 mp->kp_nfails++; \
308 308 }
309 309
310 310 /* list of crypto_mech_info_t valid as the second mech in a dual operation */
311 311
312 312 typedef struct crypto_mech_info_list {
313 313 struct crypto_mech_info_list *ml_next;
314 314 crypto_mech_type_t ml_kcf_mechid; /* KCF's id */
315 315 crypto_mech_info_t ml_mech_info;
316 316 } crypto_mech_info_list_t;
317 317
318 318 /*
319 319 * An element in a mechanism provider descriptors chain.
320 320 * The kcf_prov_mech_desc_t is duplicated in every chain the provider belongs
321 321 * to. This is a small tradeoff memory vs mutex spinning time to access the
322 322 * common provider field.
323 323 */
324 324
325 325 typedef struct kcf_prov_mech_desc {
326 326 struct kcf_mech_entry *pm_me; /* Back to the head */
327 327 struct kcf_prov_mech_desc *pm_next; /* Next in the chain */
328 328 crypto_mech_info_t pm_mech_info; /* Provider mech info */
329 329 crypto_mech_info_list_t *pm_mi_list; /* list for duals */
330 330 kcf_provider_desc_t *pm_prov_desc; /* Common desc. */
331 331 } kcf_prov_mech_desc_t;
332 332
333 333 /* and the notation shortcuts ... */
334 334 #define pm_provider_type pm_prov_desc.pd_provider_type
335 335 #define pm_provider_handle pm_prov_desc.pd_provider_handle
336 336 #define pm_ops_vector pm_prov_desc.pd_ops_vector
337 337
338 338 extern kcf_lock_withpad_t *me_mutexes;
339 339
340 340 #define KCF_CPU_PAD (128 - sizeof (crypto_mech_name_t) - \
341 341 sizeof (crypto_mech_type_t) - \
342 342 2 * sizeof (kcf_prov_mech_desc_t *) - \
343 343 sizeof (int) - sizeof (uint32_t) - sizeof (size_t))
344 344
345 345 /*
346 346 * A mechanism entry in an xxx_mech_tab[]. KCF_CPU_PAD needs
347 347 * to be adjusted if this structure is changed.
348 348 */
349 349 typedef struct kcf_mech_entry {
350 350 crypto_mech_name_t me_name; /* mechanism name */
351 351 crypto_mech_type_t me_mechid; /* Internal id for mechanism */
352 352 kcf_prov_mech_desc_t *me_hw_prov_chain; /* list of HW providers */
353 353 kcf_prov_mech_desc_t *me_sw_prov; /* SW provider */
354 354 /*
355 355 * Number of HW providers in the chain. There is only one
356 356 * SW provider. So, we need only a count of HW providers.
357 357 */
358 358 int me_num_hwprov;
359 359 /*
360 360 * When a SW provider is present, this is the generation number that
361 361 * ensures no objects from old SW providers are used in the new one
362 362 */
363 363 uint32_t me_gen_swprov;
364 364 /*
365 365 * threshold for using hardware providers for this mech
366 366 */
367 367 size_t me_threshold;
368 368 uint8_t me_pad[KCF_CPU_PAD];
369 369 } kcf_mech_entry_t;
370 370
371 371 /*
372 372 * A policy descriptor structure. It is allocated and initialized
373 373 * when administrative ioctls load disabled mechanisms.
374 374 *
375 375 * pd_prov_type: Provider type, hardware or software
376 376 * pd_name: Device name or module name.
377 377 * pd_instance: Device instance.
378 378 * pd_refcnt: Reference counter for this policy descriptor
379 379 * pd_mutex: Protects array and count of disabled mechanisms.
380 380 * pd_disabled_count: Count of disabled mechanisms.
381 381 * pd_disabled_mechs: Array of disabled mechanisms.
382 382 */
383 383 typedef struct kcf_policy_desc {
384 384 crypto_provider_type_t pd_prov_type;
385 385 char *pd_name;
386 386 uint_t pd_instance;
387 387 uint_t pd_refcnt;
388 388 kmutex_t pd_mutex;
|
↓ open down ↓ |
388 lines elided |
↑ open up ↑ |
389 389 uint_t pd_disabled_count;
390 390 crypto_mech_name_t *pd_disabled_mechs;
391 391 } kcf_policy_desc_t;
392 392
393 393 /*
394 394 * If a component has a reference to a kcf_policy_desc_t,
395 395 * it REFHOLD()s. A new policy descriptor which is referenced only
396 396 * by the policy table has a reference count of one.
397 397 */
398 398 #define KCF_POLICY_REFHOLD(desc) { \
399 - atomic_add_32(&(desc)->pd_refcnt, 1); \
399 + atomic_inc_32(&(desc)->pd_refcnt); \
400 400 ASSERT((desc)->pd_refcnt != 0); \
401 401 }
402 402
403 403 /*
404 404 * Releases a reference to a policy descriptor. When the last
405 405 * reference is released, the descriptor is freed.
406 406 */
407 407 #define KCF_POLICY_REFRELE(desc) { \
408 408 ASSERT((desc)->pd_refcnt != 0); \
409 409 membar_exit(); \
410 - if (atomic_add_32_nv(&(desc)->pd_refcnt, -1) == 0) \
410 + if (atomic_dec_32_nv(&(desc)->pd_refcnt) == 0) \
411 411 kcf_policy_free_desc(desc); \
412 412 }
413 413
414 414 /*
415 415 * This entry stores the name of a software module and its
416 416 * mechanisms. The mechanisms are 'hints' that are used to
417 417 * trigger loading of the module.
418 418 */
419 419 typedef struct kcf_soft_conf_entry {
420 420 struct kcf_soft_conf_entry *ce_next;
421 421 char *ce_name;
422 422 crypto_mech_name_t *ce_mechs;
423 423 uint_t ce_count;
424 424 } kcf_soft_conf_entry_t;
425 425
426 426 extern kmutex_t soft_config_mutex;
427 427 extern kcf_soft_conf_entry_t *soft_config_list;
428 428
429 429 /*
430 430 * Global tables. The sizes are from the predefined PKCS#11 v2.20 mechanisms,
431 431 * with a margin of few extra empty entry points
432 432 */
433 433
434 434 #define KCF_MAXDIGEST 16 /* Digests */
435 435 #define KCF_MAXCIPHER 64 /* Ciphers */
436 436 #define KCF_MAXMAC 40 /* Message authentication codes */
437 437 #define KCF_MAXSIGN 24 /* Sign/Verify */
438 438 #define KCF_MAXKEYOPS 116 /* Key generation and derivation */
439 439 #define KCF_MAXMISC 16 /* Others ... */
440 440
441 441 #define KCF_MAXMECHS KCF_MAXDIGEST + KCF_MAXCIPHER + KCF_MAXMAC + \
442 442 KCF_MAXSIGN + KCF_MAXKEYOPS + \
443 443 KCF_MAXMISC
444 444
445 445 extern kcf_mech_entry_t kcf_digest_mechs_tab[];
446 446 extern kcf_mech_entry_t kcf_cipher_mechs_tab[];
447 447 extern kcf_mech_entry_t kcf_mac_mechs_tab[];
448 448 extern kcf_mech_entry_t kcf_sign_mechs_tab[];
449 449 extern kcf_mech_entry_t kcf_keyops_mechs_tab[];
450 450 extern kcf_mech_entry_t kcf_misc_mechs_tab[];
451 451
452 452 extern kmutex_t kcf_mech_tabs_lock;
453 453
454 454 typedef enum {
455 455 KCF_DIGEST_CLASS = 1,
456 456 KCF_CIPHER_CLASS,
457 457 KCF_MAC_CLASS,
458 458 KCF_SIGN_CLASS,
459 459 KCF_KEYOPS_CLASS,
460 460 KCF_MISC_CLASS
461 461 } kcf_ops_class_t;
462 462
463 463 #define KCF_FIRST_OPSCLASS KCF_DIGEST_CLASS
464 464 #define KCF_LAST_OPSCLASS KCF_MISC_CLASS
465 465
466 466 /* The table of all the kcf_xxx_mech_tab[]s, indexed by kcf_ops_class */
467 467
468 468 typedef struct kcf_mech_entry_tab {
469 469 int met_size; /* Size of the met_tab[] */
470 470 kcf_mech_entry_t *met_tab; /* the table */
471 471 } kcf_mech_entry_tab_t;
472 472
473 473 extern kcf_mech_entry_tab_t kcf_mech_tabs_tab[];
474 474
475 475 #define KCF_MECHID(class, index) \
476 476 (((crypto_mech_type_t)(class) << 32) | (crypto_mech_type_t)(index))
477 477
478 478 #define KCF_MECH2CLASS(mech_type) ((kcf_ops_class_t)((mech_type) >> 32))
479 479
480 480 #define KCF_MECH2INDEX(mech_type) ((int)(mech_type))
481 481
482 482 #define KCF_TO_PROV_MECH_INDX(pd, mech_type) \
483 483 ((pd)->pd_mech_indx[KCF_MECH2CLASS(mech_type)] \
484 484 [KCF_MECH2INDEX(mech_type)])
485 485
486 486 #define KCF_TO_PROV_MECHINFO(pd, mech_type) \
487 487 ((pd)->pd_mechanisms[KCF_TO_PROV_MECH_INDX(pd, mech_type)])
488 488
489 489 #define KCF_TO_PROV_MECHNUM(pd, mech_type) \
490 490 (KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_number)
491 491
492 492 #define KCF_CAN_SHARE_OPSTATE(pd, mech_type) \
493 493 ((KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_flags) & \
494 494 CRYPTO_CAN_SHARE_OPSTATE)
495 495
496 496 /* ps_refcnt is protected by cm_lock in the crypto_minor structure */
497 497 typedef struct crypto_provider_session {
498 498 struct crypto_provider_session *ps_next;
499 499 crypto_session_id_t ps_session;
500 500 kcf_provider_desc_t *ps_provider;
501 501 kcf_provider_desc_t *ps_real_provider;
502 502 uint_t ps_refcnt;
503 503 } crypto_provider_session_t;
504 504
505 505 typedef struct crypto_session_data {
506 506 kmutex_t sd_lock;
507 507 kcondvar_t sd_cv;
508 508 uint32_t sd_flags;
509 509 int sd_pre_approved_amount;
510 510 crypto_ctx_t *sd_digest_ctx;
511 511 crypto_ctx_t *sd_encr_ctx;
512 512 crypto_ctx_t *sd_decr_ctx;
513 513 crypto_ctx_t *sd_sign_ctx;
514 514 crypto_ctx_t *sd_verify_ctx;
515 515 crypto_ctx_t *sd_sign_recover_ctx;
516 516 crypto_ctx_t *sd_verify_recover_ctx;
517 517 kcf_provider_desc_t *sd_provider;
518 518 void *sd_find_init_cookie;
519 519 crypto_provider_session_t *sd_provider_session;
520 520 } crypto_session_data_t;
521 521
522 522 #define CRYPTO_SESSION_IN_USE 0x00000001
523 523 #define CRYPTO_SESSION_IS_BUSY 0x00000002
524 524 #define CRYPTO_SESSION_IS_CLOSED 0x00000004
525 525
526 526 #define KCF_MAX_PIN_LEN 1024
527 527
528 528 /*
529 529 * Per-minor info.
530 530 *
531 531 * cm_lock protects everything in this structure except for cm_refcnt.
532 532 */
533 533 typedef struct crypto_minor {
534 534 uint_t cm_refcnt;
535 535 kmutex_t cm_lock;
536 536 kcondvar_t cm_cv;
537 537 crypto_session_data_t **cm_session_table;
538 538 uint_t cm_session_table_count;
539 539 kcf_provider_desc_t **cm_provider_array;
540 540 uint_t cm_provider_count;
541 541 crypto_provider_session_t *cm_provider_session;
542 542 } crypto_minor_t;
543 543
544 544 /* resource control framework handle used by /dev/crypto */
545 545 extern rctl_hndl_t rc_project_crypto_mem;
546 546 /*
547 547 * Return codes for internal functions
548 548 */
549 549 #define KCF_SUCCESS 0x0 /* Successful call */
550 550 #define KCF_INVALID_MECH_NUMBER 0x1 /* invalid mechanism number */
551 551 #define KCF_INVALID_MECH_NAME 0x2 /* invalid mechanism name */
552 552 #define KCF_INVALID_MECH_CLASS 0x3 /* invalid mechanism class */
553 553 #define KCF_MECH_TAB_FULL 0x4 /* Need more room in the mech tabs. */
554 554 #define KCF_INVALID_INDX ((ushort_t)-1)
555 555
556 556 /*
557 557 * kCF internal mechanism and function group for tracking RNG providers.
558 558 */
559 559 #define SUN_RANDOM "random"
560 560 #define CRYPTO_FG_RANDOM 0x80000000 /* generate_random() */
561 561
562 562 /*
563 563 * Wrappers for ops vectors. In the wrapper definitions below, the pd
564 564 * argument always corresponds to a pointer to a provider descriptor
565 565 * of type kcf_prov_desc_t.
566 566 */
567 567
568 568 #define KCF_PROV_CONTROL_OPS(pd) ((pd)->pd_ops_vector->co_control_ops)
569 569 #define KCF_PROV_CTX_OPS(pd) ((pd)->pd_ops_vector->co_ctx_ops)
570 570 #define KCF_PROV_DIGEST_OPS(pd) ((pd)->pd_ops_vector->co_digest_ops)
571 571 #define KCF_PROV_CIPHER_OPS(pd) ((pd)->pd_ops_vector->co_cipher_ops)
572 572 #define KCF_PROV_MAC_OPS(pd) ((pd)->pd_ops_vector->co_mac_ops)
573 573 #define KCF_PROV_SIGN_OPS(pd) ((pd)->pd_ops_vector->co_sign_ops)
574 574 #define KCF_PROV_VERIFY_OPS(pd) ((pd)->pd_ops_vector->co_verify_ops)
575 575 #define KCF_PROV_DUAL_OPS(pd) ((pd)->pd_ops_vector->co_dual_ops)
576 576 #define KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) \
577 577 ((pd)->pd_ops_vector->co_dual_cipher_mac_ops)
578 578 #define KCF_PROV_RANDOM_OPS(pd) ((pd)->pd_ops_vector->co_random_ops)
579 579 #define KCF_PROV_SESSION_OPS(pd) ((pd)->pd_ops_vector->co_session_ops)
580 580 #define KCF_PROV_OBJECT_OPS(pd) ((pd)->pd_ops_vector->co_object_ops)
581 581 #define KCF_PROV_KEY_OPS(pd) ((pd)->pd_ops_vector->co_key_ops)
582 582 #define KCF_PROV_PROVIDER_OPS(pd) ((pd)->pd_ops_vector->co_provider_ops)
583 583 #define KCF_PROV_MECH_OPS(pd) ((pd)->pd_ops_vector->co_mech_ops)
584 584 #define KCF_PROV_NOSTORE_KEY_OPS(pd) \
585 585 ((pd)->pd_ops_vector->co_nostore_key_ops)
586 586 #define KCF_PROV_FIPS140_OPS(pd) ((pd)->pd_ops_vector->co_fips140_ops)
587 587 #define KCF_PROV_PROVMGMT_OPS(pd) ((pd)->pd_ops_vector->co_provider_ops)
588 588
589 589 /*
590 590 * Wrappers for crypto_control_ops(9S) entry points.
591 591 */
592 592
593 593 #define KCF_PROV_STATUS(pd, status) ( \
594 594 (KCF_PROV_CONTROL_OPS(pd) && \
595 595 KCF_PROV_CONTROL_OPS(pd)->provider_status) ? \
596 596 KCF_PROV_CONTROL_OPS(pd)->provider_status( \
597 597 (pd)->pd_prov_handle, status) : \
598 598 CRYPTO_NOT_SUPPORTED)
599 599
600 600 /*
601 601 * Wrappers for crypto_ctx_ops(9S) entry points.
602 602 */
603 603
604 604 #define KCF_PROV_CREATE_CTX_TEMPLATE(pd, mech, key, template, size, req) ( \
605 605 (KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->create_ctx_template) ? \
606 606 KCF_PROV_CTX_OPS(pd)->create_ctx_template( \
607 607 (pd)->pd_prov_handle, mech, key, template, size, req) : \
608 608 CRYPTO_NOT_SUPPORTED)
609 609
610 610 #define KCF_PROV_FREE_CONTEXT(pd, ctx) ( \
611 611 (KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->free_context) ? \
612 612 KCF_PROV_CTX_OPS(pd)->free_context(ctx) : CRYPTO_NOT_SUPPORTED)
613 613
614 614 #define KCF_PROV_COPYIN_MECH(pd, umech, kmech, errorp, mode) ( \
615 615 (KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->copyin_mechanism) ? \
616 616 KCF_PROV_MECH_OPS(pd)->copyin_mechanism( \
617 617 (pd)->pd_prov_handle, umech, kmech, errorp, mode) : \
618 618 CRYPTO_NOT_SUPPORTED)
619 619
620 620 #define KCF_PROV_COPYOUT_MECH(pd, kmech, umech, errorp, mode) ( \
621 621 (KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->copyout_mechanism) ? \
622 622 KCF_PROV_MECH_OPS(pd)->copyout_mechanism( \
623 623 (pd)->pd_prov_handle, kmech, umech, errorp, mode) : \
624 624 CRYPTO_NOT_SUPPORTED)
625 625
626 626 #define KCF_PROV_FREE_MECH(pd, prov_mech) ( \
627 627 (KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->free_mechanism) ? \
628 628 KCF_PROV_MECH_OPS(pd)->free_mechanism( \
629 629 (pd)->pd_prov_handle, prov_mech) : CRYPTO_NOT_SUPPORTED)
630 630
631 631 /*
632 632 * Wrappers for crypto_digest_ops(9S) entry points.
633 633 */
634 634
635 635 #define KCF_PROV_DIGEST_INIT(pd, ctx, mech, req) ( \
636 636 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_init) ? \
637 637 KCF_PROV_DIGEST_OPS(pd)->digest_init(ctx, mech, req) : \
638 638 CRYPTO_NOT_SUPPORTED)
639 639
640 640 /*
641 641 * The _ (underscore) in _digest is needed to avoid replacing the
642 642 * function digest().
643 643 */
644 644 #define KCF_PROV_DIGEST(pd, ctx, data, _digest, req) ( \
645 645 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest) ? \
646 646 KCF_PROV_DIGEST_OPS(pd)->digest(ctx, data, _digest, req) : \
647 647 CRYPTO_NOT_SUPPORTED)
648 648
649 649 #define KCF_PROV_DIGEST_UPDATE(pd, ctx, data, req) ( \
650 650 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_update) ? \
651 651 KCF_PROV_DIGEST_OPS(pd)->digest_update(ctx, data, req) : \
652 652 CRYPTO_NOT_SUPPORTED)
653 653
654 654 #define KCF_PROV_DIGEST_KEY(pd, ctx, key, req) ( \
655 655 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_key) ? \
656 656 KCF_PROV_DIGEST_OPS(pd)->digest_key(ctx, key, req) : \
657 657 CRYPTO_NOT_SUPPORTED)
658 658
659 659 #define KCF_PROV_DIGEST_FINAL(pd, ctx, digest, req) ( \
660 660 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_final) ? \
661 661 KCF_PROV_DIGEST_OPS(pd)->digest_final(ctx, digest, req) : \
662 662 CRYPTO_NOT_SUPPORTED)
663 663
664 664 #define KCF_PROV_DIGEST_ATOMIC(pd, session, mech, data, digest, req) ( \
665 665 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_atomic) ? \
666 666 KCF_PROV_DIGEST_OPS(pd)->digest_atomic( \
667 667 (pd)->pd_prov_handle, session, mech, data, digest, req) : \
668 668 CRYPTO_NOT_SUPPORTED)
669 669
670 670 /*
671 671 * Wrappers for crypto_cipher_ops(9S) entry points.
672 672 */
673 673
674 674 #define KCF_PROV_ENCRYPT_INIT(pd, ctx, mech, key, template, req) ( \
675 675 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_init) ? \
676 676 KCF_PROV_CIPHER_OPS(pd)->encrypt_init(ctx, mech, key, template, \
677 677 req) : \
678 678 CRYPTO_NOT_SUPPORTED)
679 679
680 680 #define KCF_PROV_ENCRYPT(pd, ctx, plaintext, ciphertext, req) ( \
681 681 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt) ? \
682 682 KCF_PROV_CIPHER_OPS(pd)->encrypt(ctx, plaintext, ciphertext, req) : \
683 683 CRYPTO_NOT_SUPPORTED)
684 684
685 685 #define KCF_PROV_ENCRYPT_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \
686 686 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_update) ? \
687 687 KCF_PROV_CIPHER_OPS(pd)->encrypt_update(ctx, plaintext, \
688 688 ciphertext, req) : \
689 689 CRYPTO_NOT_SUPPORTED)
690 690
691 691 #define KCF_PROV_ENCRYPT_FINAL(pd, ctx, ciphertext, req) ( \
692 692 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_final) ? \
693 693 KCF_PROV_CIPHER_OPS(pd)->encrypt_final(ctx, ciphertext, req) : \
694 694 CRYPTO_NOT_SUPPORTED)
695 695
696 696 #define KCF_PROV_ENCRYPT_ATOMIC(pd, session, mech, key, plaintext, ciphertext, \
697 697 template, req) ( \
698 698 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic) ? \
699 699 KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic( \
700 700 (pd)->pd_prov_handle, session, mech, key, plaintext, ciphertext, \
701 701 template, req) : \
702 702 CRYPTO_NOT_SUPPORTED)
703 703
704 704 #define KCF_PROV_DECRYPT_INIT(pd, ctx, mech, key, template, req) ( \
705 705 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_init) ? \
706 706 KCF_PROV_CIPHER_OPS(pd)->decrypt_init(ctx, mech, key, template, \
707 707 req) : \
708 708 CRYPTO_NOT_SUPPORTED)
709 709
710 710 #define KCF_PROV_DECRYPT(pd, ctx, ciphertext, plaintext, req) ( \
711 711 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt) ? \
712 712 KCF_PROV_CIPHER_OPS(pd)->decrypt(ctx, ciphertext, plaintext, req) : \
713 713 CRYPTO_NOT_SUPPORTED)
714 714
715 715 #define KCF_PROV_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \
716 716 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_update) ? \
717 717 KCF_PROV_CIPHER_OPS(pd)->decrypt_update(ctx, ciphertext, \
718 718 plaintext, req) : \
719 719 CRYPTO_NOT_SUPPORTED)
720 720
721 721 #define KCF_PROV_DECRYPT_FINAL(pd, ctx, plaintext, req) ( \
722 722 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_final) ? \
723 723 KCF_PROV_CIPHER_OPS(pd)->decrypt_final(ctx, plaintext, req) : \
724 724 CRYPTO_NOT_SUPPORTED)
725 725
726 726 #define KCF_PROV_DECRYPT_ATOMIC(pd, session, mech, key, ciphertext, plaintext, \
727 727 template, req) ( \
728 728 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic) ? \
729 729 KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic( \
730 730 (pd)->pd_prov_handle, session, mech, key, ciphertext, plaintext, \
731 731 template, req) : \
732 732 CRYPTO_NOT_SUPPORTED)
733 733
734 734 /*
735 735 * Wrappers for crypto_mac_ops(9S) entry points.
736 736 */
737 737
738 738 #define KCF_PROV_MAC_INIT(pd, ctx, mech, key, template, req) ( \
739 739 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_init) ? \
740 740 KCF_PROV_MAC_OPS(pd)->mac_init(ctx, mech, key, template, req) \
741 741 : CRYPTO_NOT_SUPPORTED)
742 742
743 743 /*
744 744 * The _ (underscore) in _mac is needed to avoid replacing the
745 745 * function mac().
746 746 */
747 747 #define KCF_PROV_MAC(pd, ctx, data, _mac, req) ( \
748 748 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac) ? \
749 749 KCF_PROV_MAC_OPS(pd)->mac(ctx, data, _mac, req) : \
750 750 CRYPTO_NOT_SUPPORTED)
751 751
752 752 #define KCF_PROV_MAC_UPDATE(pd, ctx, data, req) ( \
753 753 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_update) ? \
754 754 KCF_PROV_MAC_OPS(pd)->mac_update(ctx, data, req) : \
755 755 CRYPTO_NOT_SUPPORTED)
756 756
757 757 #define KCF_PROV_MAC_FINAL(pd, ctx, mac, req) ( \
758 758 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_final) ? \
759 759 KCF_PROV_MAC_OPS(pd)->mac_final(ctx, mac, req) : \
760 760 CRYPTO_NOT_SUPPORTED)
761 761
762 762 #define KCF_PROV_MAC_ATOMIC(pd, session, mech, key, data, mac, template, \
763 763 req) ( \
764 764 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_atomic) ? \
765 765 KCF_PROV_MAC_OPS(pd)->mac_atomic( \
766 766 (pd)->pd_prov_handle, session, mech, key, data, mac, template, \
767 767 req) : \
768 768 CRYPTO_NOT_SUPPORTED)
769 769
770 770 #define KCF_PROV_MAC_VERIFY_ATOMIC(pd, session, mech, key, data, mac, \
771 771 template, req) ( \
772 772 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_verify_atomic) ? \
773 773 KCF_PROV_MAC_OPS(pd)->mac_verify_atomic( \
774 774 (pd)->pd_prov_handle, session, mech, key, data, mac, template, \
775 775 req) : \
776 776 CRYPTO_NOT_SUPPORTED)
777 777
778 778 /*
779 779 * Wrappers for crypto_sign_ops(9S) entry points.
780 780 */
781 781
782 782 #define KCF_PROV_SIGN_INIT(pd, ctx, mech, key, template, req) ( \
783 783 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_init) ? \
784 784 KCF_PROV_SIGN_OPS(pd)->sign_init( \
785 785 ctx, mech, key, template, req) : CRYPTO_NOT_SUPPORTED)
786 786
787 787 #define KCF_PROV_SIGN(pd, ctx, data, sig, req) ( \
788 788 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign) ? \
789 789 KCF_PROV_SIGN_OPS(pd)->sign(ctx, data, sig, req) : \
790 790 CRYPTO_NOT_SUPPORTED)
791 791
792 792 #define KCF_PROV_SIGN_UPDATE(pd, ctx, data, req) ( \
793 793 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_update) ? \
794 794 KCF_PROV_SIGN_OPS(pd)->sign_update(ctx, data, req) : \
795 795 CRYPTO_NOT_SUPPORTED)
796 796
797 797 #define KCF_PROV_SIGN_FINAL(pd, ctx, sig, req) ( \
798 798 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_final) ? \
799 799 KCF_PROV_SIGN_OPS(pd)->sign_final(ctx, sig, req) : \
800 800 CRYPTO_NOT_SUPPORTED)
801 801
802 802 #define KCF_PROV_SIGN_ATOMIC(pd, session, mech, key, data, template, \
803 803 sig, req) ( \
804 804 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_atomic) ? \
805 805 KCF_PROV_SIGN_OPS(pd)->sign_atomic( \
806 806 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \
807 807 req) : CRYPTO_NOT_SUPPORTED)
808 808
809 809 #define KCF_PROV_SIGN_RECOVER_INIT(pd, ctx, mech, key, template, \
810 810 req) ( \
811 811 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover_init) ? \
812 812 KCF_PROV_SIGN_OPS(pd)->sign_recover_init(ctx, mech, key, template, \
813 813 req) : CRYPTO_NOT_SUPPORTED)
814 814
815 815 #define KCF_PROV_SIGN_RECOVER(pd, ctx, data, sig, req) ( \
816 816 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover) ? \
817 817 KCF_PROV_SIGN_OPS(pd)->sign_recover(ctx, data, sig, req) : \
818 818 CRYPTO_NOT_SUPPORTED)
819 819
820 820 #define KCF_PROV_SIGN_RECOVER_ATOMIC(pd, session, mech, key, data, template, \
821 821 sig, req) ( \
822 822 (KCF_PROV_SIGN_OPS(pd) && \
823 823 KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic) ? \
824 824 KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic( \
825 825 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \
826 826 req) : CRYPTO_NOT_SUPPORTED)
827 827
828 828 /*
829 829 * Wrappers for crypto_verify_ops(9S) entry points.
830 830 */
831 831
832 832 #define KCF_PROV_VERIFY_INIT(pd, ctx, mech, key, template, req) ( \
833 833 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_init) ? \
834 834 KCF_PROV_VERIFY_OPS(pd)->verify_init(ctx, mech, key, template, \
835 835 req) : CRYPTO_NOT_SUPPORTED)
836 836
837 837 #define KCF_PROV_VERIFY(pd, ctx, data, sig, req) ( \
838 838 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify) ? \
839 839 KCF_PROV_VERIFY_OPS(pd)->verify(ctx, data, sig, req) : \
840 840 CRYPTO_NOT_SUPPORTED)
841 841
842 842 #define KCF_PROV_VERIFY_UPDATE(pd, ctx, data, req) ( \
843 843 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_update) ? \
844 844 KCF_PROV_VERIFY_OPS(pd)->verify_update(ctx, data, req) : \
845 845 CRYPTO_NOT_SUPPORTED)
846 846
847 847 #define KCF_PROV_VERIFY_FINAL(pd, ctx, sig, req) ( \
848 848 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_final) ? \
849 849 KCF_PROV_VERIFY_OPS(pd)->verify_final(ctx, sig, req) : \
850 850 CRYPTO_NOT_SUPPORTED)
851 851
852 852 #define KCF_PROV_VERIFY_ATOMIC(pd, session, mech, key, data, template, sig, \
853 853 req) ( \
854 854 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_atomic) ? \
855 855 KCF_PROV_VERIFY_OPS(pd)->verify_atomic( \
856 856 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \
857 857 req) : CRYPTO_NOT_SUPPORTED)
858 858
859 859 #define KCF_PROV_VERIFY_RECOVER_INIT(pd, ctx, mech, key, template, \
860 860 req) ( \
861 861 (KCF_PROV_VERIFY_OPS(pd) && \
862 862 KCF_PROV_VERIFY_OPS(pd)->verify_recover_init) ? \
863 863 KCF_PROV_VERIFY_OPS(pd)->verify_recover_init(ctx, mech, key, \
864 864 template, req) : CRYPTO_NOT_SUPPORTED)
865 865
866 866 /* verify_recover() CSPI routine has different argument order than verify() */
867 867 #define KCF_PROV_VERIFY_RECOVER(pd, ctx, sig, data, req) ( \
868 868 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_recover) ? \
869 869 KCF_PROV_VERIFY_OPS(pd)->verify_recover(ctx, sig, data, req) : \
870 870 CRYPTO_NOT_SUPPORTED)
871 871
872 872 /*
873 873 * verify_recover_atomic() CSPI routine has different argument order
874 874 * than verify_atomic().
875 875 */
876 876 #define KCF_PROV_VERIFY_RECOVER_ATOMIC(pd, session, mech, key, sig, \
877 877 template, data, req) ( \
878 878 (KCF_PROV_VERIFY_OPS(pd) && \
879 879 KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic) ? \
880 880 KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic( \
881 881 (pd)->pd_prov_handle, session, mech, key, sig, data, template, \
882 882 req) : CRYPTO_NOT_SUPPORTED)
883 883
884 884 /*
885 885 * Wrappers for crypto_dual_ops(9S) entry points.
886 886 */
887 887
888 888 #define KCF_PROV_DIGEST_ENCRYPT_UPDATE(digest_ctx, encrypt_ctx, plaintext, \
889 889 ciphertext, req) ( \
890 890 (KCF_PROV_DUAL_OPS(pd) && \
891 891 KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update) ? \
892 892 KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update( \
893 893 digest_ctx, encrypt_ctx, plaintext, ciphertext, req) : \
894 894 CRYPTO_NOT_SUPPORTED)
895 895
896 896 #define KCF_PROV_DECRYPT_DIGEST_UPDATE(decrypt_ctx, digest_ctx, ciphertext, \
897 897 plaintext, req) ( \
898 898 (KCF_PROV_DUAL_OPS(pd) && \
899 899 KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update) ? \
900 900 KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update( \
901 901 decrypt_ctx, digest_ctx, ciphertext, plaintext, req) : \
902 902 CRYPTO_NOT_SUPPORTED)
903 903
904 904 #define KCF_PROV_SIGN_ENCRYPT_UPDATE(sign_ctx, encrypt_ctx, plaintext, \
905 905 ciphertext, req) ( \
906 906 (KCF_PROV_DUAL_OPS(pd) && \
907 907 KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update) ? \
908 908 KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update( \
909 909 sign_ctx, encrypt_ctx, plaintext, ciphertext, req) : \
910 910 CRYPTO_NOT_SUPPORTED)
911 911
912 912 #define KCF_PROV_DECRYPT_VERIFY_UPDATE(decrypt_ctx, verify_ctx, ciphertext, \
913 913 plaintext, req) ( \
914 914 (KCF_PROV_DUAL_OPS(pd) && \
915 915 KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update) ? \
916 916 KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update( \
917 917 decrypt_ctx, verify_ctx, ciphertext, plaintext, req) : \
918 918 CRYPTO_NOT_SUPPORTED)
919 919
920 920 /*
921 921 * Wrappers for crypto_dual_cipher_mac_ops(9S) entry points.
922 922 */
923 923
924 924 #define KCF_PROV_ENCRYPT_MAC_INIT(pd, ctx, encr_mech, encr_key, mac_mech, \
925 925 mac_key, encr_ctx_template, mac_ctx_template, req) ( \
926 926 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
927 927 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init) ? \
928 928 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init( \
929 929 ctx, encr_mech, encr_key, mac_mech, mac_key, encr_ctx_template, \
930 930 mac_ctx_template, req) : \
931 931 CRYPTO_NOT_SUPPORTED)
932 932
933 933 #define KCF_PROV_ENCRYPT_MAC(pd, ctx, plaintext, ciphertext, mac, req) ( \
934 934 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
935 935 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac) ? \
936 936 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac( \
937 937 ctx, plaintext, ciphertext, mac, req) : \
938 938 CRYPTO_NOT_SUPPORTED)
939 939
940 940 #define KCF_PROV_ENCRYPT_MAC_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \
941 941 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
942 942 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update) ? \
943 943 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update( \
944 944 ctx, plaintext, ciphertext, req) : \
945 945 CRYPTO_NOT_SUPPORTED)
946 946
947 947 #define KCF_PROV_ENCRYPT_MAC_FINAL(pd, ctx, ciphertext, mac, req) ( \
948 948 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
949 949 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final) ? \
950 950 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final( \
951 951 ctx, ciphertext, mac, req) : \
952 952 CRYPTO_NOT_SUPPORTED)
953 953
954 954 #define KCF_PROV_ENCRYPT_MAC_ATOMIC(pd, session, encr_mech, encr_key, \
955 955 mac_mech, mac_key, plaintext, ciphertext, mac, \
956 956 encr_ctx_template, mac_ctx_template, req) ( \
957 957 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
958 958 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic) ? \
959 959 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic( \
960 960 (pd)->pd_prov_handle, session, encr_mech, encr_key, \
961 961 mac_mech, mac_key, plaintext, ciphertext, mac, \
962 962 encr_ctx_template, mac_ctx_template, req) : \
963 963 CRYPTO_NOT_SUPPORTED)
964 964
965 965 #define KCF_PROV_MAC_DECRYPT_INIT(pd, ctx, mac_mech, mac_key, decr_mech, \
966 966 decr_key, mac_ctx_template, decr_ctx_template, req) ( \
967 967 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
968 968 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init) ? \
969 969 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init( \
970 970 ctx, mac_mech, mac_key, decr_mech, decr_key, mac_ctx_template, \
971 971 decr_ctx_template, req) : \
972 972 CRYPTO_NOT_SUPPORTED)
973 973
974 974 #define KCF_PROV_MAC_DECRYPT(pd, ctx, ciphertext, mac, plaintext, req) ( \
975 975 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
976 976 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt) ? \
977 977 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt( \
978 978 ctx, ciphertext, mac, plaintext, req) : \
979 979 CRYPTO_NOT_SUPPORTED)
980 980
981 981 #define KCF_PROV_MAC_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \
982 982 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
983 983 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update) ? \
984 984 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update( \
985 985 ctx, ciphertext, plaintext, req) : \
986 986 CRYPTO_NOT_SUPPORTED)
987 987
988 988 #define KCF_PROV_MAC_DECRYPT_FINAL(pd, ctx, mac, plaintext, req) ( \
989 989 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
990 990 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final) ? \
991 991 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final( \
992 992 ctx, mac, plaintext, req) : \
993 993 CRYPTO_NOT_SUPPORTED)
994 994
995 995 #define KCF_PROV_MAC_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \
996 996 decr_mech, decr_key, ciphertext, mac, plaintext, \
997 997 mac_ctx_template, decr_ctx_template, req) ( \
998 998 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
999 999 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic) ? \
1000 1000 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic( \
1001 1001 (pd)->pd_prov_handle, session, mac_mech, mac_key, \
1002 1002 decr_mech, decr_key, ciphertext, mac, plaintext, \
1003 1003 mac_ctx_template, decr_ctx_template, req) : \
1004 1004 CRYPTO_NOT_SUPPORTED)
1005 1005
1006 1006 #define KCF_PROV_MAC_VERIFY_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \
1007 1007 decr_mech, decr_key, ciphertext, mac, plaintext, \
1008 1008 mac_ctx_template, decr_ctx_template, req) ( \
1009 1009 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
1010 1010 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic \
1011 1011 != NULL) ? \
1012 1012 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic( \
1013 1013 (pd)->pd_prov_handle, session, mac_mech, mac_key, \
1014 1014 decr_mech, decr_key, ciphertext, mac, plaintext, \
1015 1015 mac_ctx_template, decr_ctx_template, req) : \
1016 1016 CRYPTO_NOT_SUPPORTED)
1017 1017
1018 1018 /*
1019 1019 * Wrappers for crypto_random_number_ops(9S) entry points.
1020 1020 */
1021 1021
1022 1022 #define KCF_PROV_SEED_RANDOM(pd, session, buf, len, est, flags, req) ( \
1023 1023 (KCF_PROV_RANDOM_OPS(pd) && KCF_PROV_RANDOM_OPS(pd)->seed_random) ? \
1024 1024 KCF_PROV_RANDOM_OPS(pd)->seed_random((pd)->pd_prov_handle, \
1025 1025 session, buf, len, est, flags, req) : CRYPTO_NOT_SUPPORTED)
1026 1026
1027 1027 #define KCF_PROV_GENERATE_RANDOM(pd, session, buf, len, req) ( \
1028 1028 (KCF_PROV_RANDOM_OPS(pd) && \
1029 1029 KCF_PROV_RANDOM_OPS(pd)->generate_random) ? \
1030 1030 KCF_PROV_RANDOM_OPS(pd)->generate_random((pd)->pd_prov_handle, \
1031 1031 session, buf, len, req) : CRYPTO_NOT_SUPPORTED)
1032 1032
1033 1033 /*
1034 1034 * Wrappers for crypto_session_ops(9S) entry points.
1035 1035 *
1036 1036 * ops_pd is the provider descriptor that supplies the ops_vector.
1037 1037 * pd is the descriptor that supplies the provider handle.
1038 1038 * Only session open/close needs two handles.
1039 1039 */
1040 1040
1041 1041 #define KCF_PROV_SESSION_OPEN(ops_pd, session, req, pd) ( \
1042 1042 (KCF_PROV_SESSION_OPS(ops_pd) && \
1043 1043 KCF_PROV_SESSION_OPS(ops_pd)->session_open) ? \
1044 1044 KCF_PROV_SESSION_OPS(ops_pd)->session_open((pd)->pd_prov_handle, \
1045 1045 session, req) : CRYPTO_NOT_SUPPORTED)
1046 1046
1047 1047 #define KCF_PROV_SESSION_CLOSE(ops_pd, session, req, pd) ( \
1048 1048 (KCF_PROV_SESSION_OPS(ops_pd) && \
1049 1049 KCF_PROV_SESSION_OPS(ops_pd)->session_close) ? \
1050 1050 KCF_PROV_SESSION_OPS(ops_pd)->session_close((pd)->pd_prov_handle, \
1051 1051 session, req) : CRYPTO_NOT_SUPPORTED)
1052 1052
1053 1053 #define KCF_PROV_SESSION_LOGIN(pd, session, user_type, pin, len, req) ( \
1054 1054 (KCF_PROV_SESSION_OPS(pd) && \
1055 1055 KCF_PROV_SESSION_OPS(pd)->session_login) ? \
1056 1056 KCF_PROV_SESSION_OPS(pd)->session_login((pd)->pd_prov_handle, \
1057 1057 session, user_type, pin, len, req) : CRYPTO_NOT_SUPPORTED)
1058 1058
1059 1059 #define KCF_PROV_SESSION_LOGOUT(pd, session, req) ( \
1060 1060 (KCF_PROV_SESSION_OPS(pd) && \
1061 1061 KCF_PROV_SESSION_OPS(pd)->session_logout) ? \
1062 1062 KCF_PROV_SESSION_OPS(pd)->session_logout((pd)->pd_prov_handle, \
1063 1063 session, req) : CRYPTO_NOT_SUPPORTED)
1064 1064
1065 1065 /*
1066 1066 * Wrappers for crypto_object_ops(9S) entry points.
1067 1067 */
1068 1068
1069 1069 #define KCF_PROV_OBJECT_CREATE(pd, session, template, count, object, req) ( \
1070 1070 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_create) ? \
1071 1071 KCF_PROV_OBJECT_OPS(pd)->object_create((pd)->pd_prov_handle, \
1072 1072 session, template, count, object, req) : CRYPTO_NOT_SUPPORTED)
1073 1073
1074 1074 #define KCF_PROV_OBJECT_COPY(pd, session, object, template, count, \
1075 1075 new_object, req) ( \
1076 1076 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_copy) ? \
1077 1077 KCF_PROV_OBJECT_OPS(pd)->object_copy((pd)->pd_prov_handle, \
1078 1078 session, object, template, count, new_object, req) : \
1079 1079 CRYPTO_NOT_SUPPORTED)
1080 1080
1081 1081 #define KCF_PROV_OBJECT_DESTROY(pd, session, object, req) ( \
1082 1082 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_destroy) ? \
1083 1083 KCF_PROV_OBJECT_OPS(pd)->object_destroy((pd)->pd_prov_handle, \
1084 1084 session, object, req) : CRYPTO_NOT_SUPPORTED)
1085 1085
1086 1086 #define KCF_PROV_OBJECT_GET_SIZE(pd, session, object, size, req) ( \
1087 1087 (KCF_PROV_OBJECT_OPS(pd) && \
1088 1088 KCF_PROV_OBJECT_OPS(pd)->object_get_size) ? \
1089 1089 KCF_PROV_OBJECT_OPS(pd)->object_get_size((pd)->pd_prov_handle, \
1090 1090 session, object, size, req) : CRYPTO_NOT_SUPPORTED)
1091 1091
1092 1092 #define KCF_PROV_OBJECT_GET_ATTRIBUTE_VALUE(pd, session, object, template, \
1093 1093 count, req) ( \
1094 1094 (KCF_PROV_OBJECT_OPS(pd) && \
1095 1095 KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value) ? \
1096 1096 KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value( \
1097 1097 (pd)->pd_prov_handle, session, object, template, count, req) : \
1098 1098 CRYPTO_NOT_SUPPORTED)
1099 1099
1100 1100 #define KCF_PROV_OBJECT_SET_ATTRIBUTE_VALUE(pd, session, object, template, \
1101 1101 count, req) ( \
1102 1102 (KCF_PROV_OBJECT_OPS(pd) && \
1103 1103 KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value) ? \
1104 1104 KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value( \
1105 1105 (pd)->pd_prov_handle, session, object, template, count, req) : \
1106 1106 CRYPTO_NOT_SUPPORTED)
1107 1107
1108 1108 #define KCF_PROV_OBJECT_FIND_INIT(pd, session, template, count, ppriv, \
1109 1109 req) ( \
1110 1110 (KCF_PROV_OBJECT_OPS(pd) && \
1111 1111 KCF_PROV_OBJECT_OPS(pd)->object_find_init) ? \
1112 1112 KCF_PROV_OBJECT_OPS(pd)->object_find_init((pd)->pd_prov_handle, \
1113 1113 session, template, count, ppriv, req) : CRYPTO_NOT_SUPPORTED)
1114 1114
1115 1115 #define KCF_PROV_OBJECT_FIND(pd, ppriv, objects, max_objects, object_count, \
1116 1116 req) ( \
1117 1117 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_find) ? \
1118 1118 KCF_PROV_OBJECT_OPS(pd)->object_find( \
1119 1119 (pd)->pd_prov_handle, ppriv, objects, max_objects, object_count, \
1120 1120 req) : CRYPTO_NOT_SUPPORTED)
1121 1121
1122 1122 #define KCF_PROV_OBJECT_FIND_FINAL(pd, ppriv, req) ( \
1123 1123 (KCF_PROV_OBJECT_OPS(pd) && \
1124 1124 KCF_PROV_OBJECT_OPS(pd)->object_find_final) ? \
1125 1125 KCF_PROV_OBJECT_OPS(pd)->object_find_final( \
1126 1126 (pd)->pd_prov_handle, ppriv, req) : CRYPTO_NOT_SUPPORTED)
1127 1127
1128 1128 /*
1129 1129 * Wrappers for crypto_key_ops(9S) entry points.
1130 1130 */
1131 1131
1132 1132 #define KCF_PROV_KEY_GENERATE(pd, session, mech, template, count, object, \
1133 1133 req) ( \
1134 1134 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate) ? \
1135 1135 KCF_PROV_KEY_OPS(pd)->key_generate((pd)->pd_prov_handle, \
1136 1136 session, mech, template, count, object, req) : \
1137 1137 CRYPTO_NOT_SUPPORTED)
1138 1138
1139 1139 #define KCF_PROV_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \
1140 1140 pub_count, priv_template, priv_count, pub_key, priv_key, req) ( \
1141 1141 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate_pair) ? \
1142 1142 KCF_PROV_KEY_OPS(pd)->key_generate_pair((pd)->pd_prov_handle, \
1143 1143 session, mech, pub_template, pub_count, priv_template, \
1144 1144 priv_count, pub_key, priv_key, req) : \
1145 1145 CRYPTO_NOT_SUPPORTED)
1146 1146
1147 1147 #define KCF_PROV_KEY_WRAP(pd, session, mech, wrapping_key, key, wrapped_key, \
1148 1148 wrapped_key_len, req) ( \
1149 1149 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_wrap) ? \
1150 1150 KCF_PROV_KEY_OPS(pd)->key_wrap((pd)->pd_prov_handle, \
1151 1151 session, mech, wrapping_key, key, wrapped_key, wrapped_key_len, \
1152 1152 req) : \
1153 1153 CRYPTO_NOT_SUPPORTED)
1154 1154
1155 1155 #define KCF_PROV_KEY_UNWRAP(pd, session, mech, unwrapping_key, wrapped_key, \
1156 1156 wrapped_key_len, template, count, key, req) ( \
1157 1157 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_unwrap) ? \
1158 1158 KCF_PROV_KEY_OPS(pd)->key_unwrap((pd)->pd_prov_handle, \
1159 1159 session, mech, unwrapping_key, wrapped_key, wrapped_key_len, \
1160 1160 template, count, key, req) : \
1161 1161 CRYPTO_NOT_SUPPORTED)
1162 1162
1163 1163 #define KCF_PROV_KEY_DERIVE(pd, session, mech, base_key, template, count, \
1164 1164 key, req) ( \
1165 1165 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_derive) ? \
1166 1166 KCF_PROV_KEY_OPS(pd)->key_derive((pd)->pd_prov_handle, \
1167 1167 session, mech, base_key, template, count, key, req) : \
1168 1168 CRYPTO_NOT_SUPPORTED)
1169 1169
1170 1170 #define KCF_PROV_KEY_CHECK(pd, mech, key) ( \
1171 1171 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_check) ? \
1172 1172 KCF_PROV_KEY_OPS(pd)->key_check((pd)->pd_prov_handle, mech, key) : \
1173 1173 CRYPTO_NOT_SUPPORTED)
1174 1174
1175 1175 /*
1176 1176 * Wrappers for crypto_provider_management_ops(9S) entry points.
1177 1177 *
1178 1178 * ops_pd is the provider descriptor that supplies the ops_vector.
1179 1179 * pd is the descriptor that supplies the provider handle.
1180 1180 * Only ext_info needs two handles.
1181 1181 */
1182 1182
1183 1183 #define KCF_PROV_EXT_INFO(ops_pd, provext_info, req, pd) ( \
1184 1184 (KCF_PROV_PROVIDER_OPS(ops_pd) && \
1185 1185 KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info) ? \
1186 1186 KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info((pd)->pd_prov_handle, \
1187 1187 provext_info, req) : CRYPTO_NOT_SUPPORTED)
1188 1188
1189 1189 #define KCF_PROV_INIT_TOKEN(pd, pin, pin_len, label, req) ( \
1190 1190 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_token) ? \
1191 1191 KCF_PROV_PROVIDER_OPS(pd)->init_token((pd)->pd_prov_handle, \
1192 1192 pin, pin_len, label, req) : CRYPTO_NOT_SUPPORTED)
1193 1193
1194 1194 #define KCF_PROV_INIT_PIN(pd, session, pin, pin_len, req) ( \
1195 1195 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_pin) ? \
1196 1196 KCF_PROV_PROVIDER_OPS(pd)->init_pin((pd)->pd_prov_handle, \
1197 1197 session, pin, pin_len, req) : CRYPTO_NOT_SUPPORTED)
1198 1198
1199 1199 #define KCF_PROV_SET_PIN(pd, session, old_pin, old_len, new_pin, new_len, \
1200 1200 req) ( \
1201 1201 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->set_pin) ? \
1202 1202 KCF_PROV_PROVIDER_OPS(pd)->set_pin((pd)->pd_prov_handle, \
1203 1203 session, old_pin, old_len, new_pin, new_len, req) : \
1204 1204 CRYPTO_NOT_SUPPORTED)
1205 1205
1206 1206 /*
1207 1207 * Wrappers for crypto_nostore_key_ops(9S) entry points.
1208 1208 */
1209 1209
1210 1210 #define KCF_PROV_NOSTORE_KEY_GENERATE(pd, session, mech, template, count, \
1211 1211 out_template, out_count, req) ( \
1212 1212 (KCF_PROV_NOSTORE_KEY_OPS(pd) && \
1213 1213 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate) ? \
1214 1214 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate( \
1215 1215 (pd)->pd_prov_handle, session, mech, template, count, \
1216 1216 out_template, out_count, req) : CRYPTO_NOT_SUPPORTED)
1217 1217
1218 1218 #define KCF_PROV_NOSTORE_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \
1219 1219 pub_count, priv_template, priv_count, out_pub_template, \
1220 1220 out_pub_count, out_priv_template, out_priv_count, req) ( \
1221 1221 (KCF_PROV_NOSTORE_KEY_OPS(pd) && \
1222 1222 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate_pair) ? \
1223 1223 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate_pair( \
1224 1224 (pd)->pd_prov_handle, session, mech, pub_template, pub_count, \
1225 1225 priv_template, priv_count, out_pub_template, out_pub_count, \
1226 1226 out_priv_template, out_priv_count, req) : CRYPTO_NOT_SUPPORTED)
1227 1227
1228 1228 #define KCF_PROV_NOSTORE_KEY_DERIVE(pd, session, mech, base_key, template, \
1229 1229 count, out_template, out_count, req) ( \
1230 1230 (KCF_PROV_NOSTORE_KEY_OPS(pd) && \
1231 1231 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_derive) ? \
1232 1232 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_derive( \
1233 1233 (pd)->pd_prov_handle, session, mech, base_key, template, count, \
1234 1234 out_template, out_count, req) : CRYPTO_NOT_SUPPORTED)
1235 1235
1236 1236 /*
1237 1237 * The following routines are exported by the kcf module (/kernel/misc/kcf)
1238 1238 * to the crypto and cryptoadmin modules.
1239 1239 */
1240 1240
1241 1241 /* Digest/mac/cipher entry points that take a provider descriptor and session */
1242 1242 extern int crypto_digest_single(crypto_context_t, crypto_data_t *,
1243 1243 crypto_data_t *, crypto_call_req_t *);
1244 1244
1245 1245 extern int crypto_mac_single(crypto_context_t, crypto_data_t *,
1246 1246 crypto_data_t *, crypto_call_req_t *);
1247 1247
1248 1248 extern int crypto_encrypt_single(crypto_context_t, crypto_data_t *,
1249 1249 crypto_data_t *, crypto_call_req_t *);
1250 1250
1251 1251 extern int crypto_decrypt_single(crypto_context_t, crypto_data_t *,
1252 1252 crypto_data_t *, crypto_call_req_t *);
1253 1253
1254 1254
1255 1255 /* Other private digest/mac/cipher entry points not exported through k-API */
1256 1256 extern int crypto_digest_key_prov(crypto_context_t, crypto_key_t *,
1257 1257 crypto_call_req_t *);
1258 1258
1259 1259 /* Private sign entry points exported by KCF */
1260 1260 extern int crypto_sign_single(crypto_context_t, crypto_data_t *,
1261 1261 crypto_data_t *, crypto_call_req_t *);
1262 1262
1263 1263 extern int crypto_sign_recover_single(crypto_context_t, crypto_data_t *,
1264 1264 crypto_data_t *, crypto_call_req_t *);
1265 1265
1266 1266 /* Private verify entry points exported by KCF */
1267 1267 extern int crypto_verify_single(crypto_context_t, crypto_data_t *,
1268 1268 crypto_data_t *, crypto_call_req_t *);
1269 1269
1270 1270 extern int crypto_verify_recover_single(crypto_context_t, crypto_data_t *,
1271 1271 crypto_data_t *, crypto_call_req_t *);
1272 1272
1273 1273 /* Private dual operations entry points exported by KCF */
1274 1274 extern int crypto_digest_encrypt_update(crypto_context_t, crypto_context_t,
1275 1275 crypto_data_t *, crypto_data_t *, crypto_call_req_t *);
1276 1276 extern int crypto_decrypt_digest_update(crypto_context_t, crypto_context_t,
1277 1277 crypto_data_t *, crypto_data_t *, crypto_call_req_t *);
1278 1278 extern int crypto_sign_encrypt_update(crypto_context_t, crypto_context_t,
1279 1279 crypto_data_t *, crypto_data_t *, crypto_call_req_t *);
1280 1280 extern int crypto_decrypt_verify_update(crypto_context_t, crypto_context_t,
1281 1281 crypto_data_t *, crypto_data_t *, crypto_call_req_t *);
1282 1282
1283 1283 /* Random Number Generation */
1284 1284 int crypto_seed_random(crypto_provider_handle_t provider, uchar_t *buf,
1285 1285 size_t len, crypto_call_req_t *req);
1286 1286 int crypto_generate_random(crypto_provider_handle_t provider, uchar_t *buf,
1287 1287 size_t len, crypto_call_req_t *req);
1288 1288
1289 1289 /* Provider Management */
1290 1290 int crypto_get_provider_info(crypto_provider_id_t id,
1291 1291 crypto_provider_info_t **info, crypto_call_req_t *req);
1292 1292 int crypto_get_provider_mechanisms(crypto_minor_t *, crypto_provider_id_t id,
1293 1293 uint_t *count, crypto_mech_name_t **list);
1294 1294 int crypto_init_token(crypto_provider_handle_t provider, char *pin,
1295 1295 size_t pin_len, char *label, crypto_call_req_t *);
1296 1296 int crypto_init_pin(crypto_provider_handle_t provider, char *pin,
1297 1297 size_t pin_len, crypto_call_req_t *req);
1298 1298 int crypto_set_pin(crypto_provider_handle_t provider, char *old_pin,
1299 1299 size_t old_len, char *new_pin, size_t new_len, crypto_call_req_t *req);
1300 1300 void crypto_free_provider_list(crypto_provider_entry_t *list, uint_t count);
1301 1301 void crypto_free_provider_info(crypto_provider_info_t *info);
1302 1302
1303 1303 /* Administrative */
1304 1304 int crypto_get_dev_list(uint_t *count, crypto_dev_list_entry_t **list);
1305 1305 int crypto_get_soft_list(uint_t *count, char **list, size_t *len);
1306 1306 int crypto_get_dev_info(char *name, uint_t instance, uint_t *count,
1307 1307 crypto_mech_name_t **list);
1308 1308 int crypto_get_soft_info(caddr_t name, uint_t *count,
1309 1309 crypto_mech_name_t **list);
1310 1310 int crypto_load_dev_disabled(char *name, uint_t instance, uint_t count,
1311 1311 crypto_mech_name_t *list);
1312 1312 int crypto_load_soft_disabled(caddr_t name, uint_t count,
1313 1313 crypto_mech_name_t *list);
1314 1314 int crypto_unload_soft_module(caddr_t path);
1315 1315 int crypto_load_soft_config(caddr_t name, uint_t count,
1316 1316 crypto_mech_name_t *list);
1317 1317 int crypto_load_door(uint_t did);
1318 1318 void crypto_free_mech_list(crypto_mech_name_t *list, uint_t count);
1319 1319 void crypto_free_dev_list(crypto_dev_list_entry_t *list, uint_t count);
1320 1320 extern void kcf_activate();
1321 1321
1322 1322 /* Miscellaneous */
1323 1323 int crypto_get_mechanism_number(caddr_t name, crypto_mech_type_t *number);
1324 1324 int crypto_get_function_list(crypto_provider_id_t id,
1325 1325 crypto_function_list_t **list, int kmflag);
1326 1326 void crypto_free_function_list(crypto_function_list_t *list);
1327 1327 int crypto_build_permitted_mech_names(kcf_provider_desc_t *,
1328 1328 crypto_mech_name_t **, uint_t *, int);
1329 1329 extern void kcf_init_mech_tabs(void);
1330 1330 extern int kcf_add_mech_provider(short, kcf_provider_desc_t *,
1331 1331 kcf_prov_mech_desc_t **);
1332 1332 extern void kcf_remove_mech_provider(char *, kcf_provider_desc_t *);
1333 1333 extern int kcf_get_mech_entry(crypto_mech_type_t, kcf_mech_entry_t **);
1334 1334 extern kcf_provider_desc_t *kcf_alloc_provider_desc(crypto_provider_info_t *);
1335 1335 extern void kcf_free_provider_desc(kcf_provider_desc_t *);
1336 1336 extern void kcf_soft_config_init(void);
1337 1337 extern int get_sw_provider_for_mech(crypto_mech_name_t, char **);
1338 1338 extern crypto_mech_type_t crypto_mech2id_common(char *, boolean_t);
1339 1339 extern void undo_register_provider(kcf_provider_desc_t *, boolean_t);
1340 1340 extern void redo_register_provider(kcf_provider_desc_t *);
1341 1341 extern void kcf_rnd_init();
1342 1342 extern boolean_t kcf_rngprov_check(void);
1343 1343 extern int kcf_rnd_get_pseudo_bytes(uint8_t *, size_t);
1344 1344 extern int kcf_rnd_get_bytes(uint8_t *, size_t, boolean_t);
1345 1345 extern int random_add_pseudo_entropy(uint8_t *, size_t, uint_t);
1346 1346 extern void kcf_rnd_chpoll(short, int, short *, struct pollhead **);
1347 1347 extern int crypto_uio_data(crypto_data_t *, uchar_t *, int, cmd_type_t,
1348 1348 void *, void (*update)());
1349 1349 extern int crypto_mblk_data(crypto_data_t *, uchar_t *, int, cmd_type_t,
1350 1350 void *, void (*update)());
1351 1351 extern int crypto_put_output_data(uchar_t *, crypto_data_t *, int);
1352 1352 extern int crypto_get_input_data(crypto_data_t *, uchar_t **, uchar_t *);
1353 1353 extern int crypto_copy_key_to_ctx(crypto_key_t *, crypto_key_t **, size_t *,
1354 1354 int kmflag);
1355 1355 extern int crypto_digest_data(crypto_data_t *, void *, uchar_t *,
1356 1356 void (*update)(), void (*final)(), uchar_t);
1357 1357 extern int crypto_update_iov(void *, crypto_data_t *, crypto_data_t *,
1358 1358 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *),
1359 1359 void (*copy_block)(uint8_t *, uint64_t *));
1360 1360 extern int crypto_update_uio(void *, crypto_data_t *, crypto_data_t *,
1361 1361 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *),
1362 1362 void (*copy_block)(uint8_t *, uint64_t *));
1363 1363 extern int crypto_update_mp(void *, crypto_data_t *, crypto_data_t *,
1364 1364 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *),
1365 1365 void (*copy_block)(uint8_t *, uint64_t *));
1366 1366 extern int crypto_get_key_attr(crypto_key_t *, crypto_attr_type_t, uchar_t **,
1367 1367 ssize_t *);
1368 1368
1369 1369 /* Access to the provider's table */
1370 1370 extern void kcf_prov_tab_init(void);
1371 1371 extern int kcf_prov_tab_add_provider(kcf_provider_desc_t *);
1372 1372 extern int kcf_prov_tab_rem_provider(crypto_provider_id_t);
1373 1373 extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_name(char *);
1374 1374 extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_dev(char *, uint_t);
1375 1375 extern int kcf_get_hw_prov_tab(uint_t *, kcf_provider_desc_t ***, int,
1376 1376 char *, uint_t, boolean_t);
1377 1377 extern int kcf_get_slot_list(uint_t *, kcf_provider_desc_t ***, boolean_t);
1378 1378 extern void kcf_free_provider_tab(uint_t, kcf_provider_desc_t **);
1379 1379 extern kcf_provider_desc_t *kcf_prov_tab_lookup(crypto_provider_id_t);
1380 1380 extern int kcf_get_sw_prov(crypto_mech_type_t, kcf_provider_desc_t **,
1381 1381 kcf_mech_entry_t **, boolean_t);
1382 1382
1383 1383 extern kmutex_t prov_tab_mutex;
1384 1384 extern boolean_t kcf_need_provtab_walk;
1385 1385 extern int kcf_get_refcnt(kcf_provider_desc_t *, boolean_t);
1386 1386
1387 1387 /* Access to the policy table */
1388 1388 extern boolean_t is_mech_disabled(kcf_provider_desc_t *, crypto_mech_name_t);
1389 1389 extern boolean_t is_mech_disabled_byname(crypto_provider_type_t, char *,
1390 1390 uint_t, crypto_mech_name_t);
1391 1391 extern void kcf_policy_tab_init(void);
1392 1392 extern void kcf_policy_free_desc(kcf_policy_desc_t *);
1393 1393 extern void kcf_policy_remove_by_name(char *, uint_t *, crypto_mech_name_t **);
1394 1394 extern void kcf_policy_remove_by_dev(char *, uint_t, uint_t *,
1395 1395 crypto_mech_name_t **);
1396 1396 extern kcf_policy_desc_t *kcf_policy_lookup_by_name(char *);
1397 1397 extern kcf_policy_desc_t *kcf_policy_lookup_by_dev(char *, uint_t);
1398 1398 extern int kcf_policy_load_soft_disabled(char *, uint_t, crypto_mech_name_t *,
1399 1399 uint_t *, crypto_mech_name_t **);
1400 1400 extern int kcf_policy_load_dev_disabled(char *, uint_t, uint_t,
1401 1401 crypto_mech_name_t *, uint_t *, crypto_mech_name_t **);
1402 1402 extern void remove_soft_config(char *);
1403 1403
1404 1404 #endif /* _KERNEL */
1405 1405
1406 1406 #ifdef __cplusplus
1407 1407 }
1408 1408 #endif
1409 1409
1410 1410 #endif /* _SYS_CRYPTO_IMPL_H */
|
↓ open down ↓ |
990 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX