1 // SPDX-License-Identifier: CDDL-1.0 2 /* 3 * CDDL HEADER START 4 * 5 * The contents of this file are subject to the terms of the 6 * Common Development and Distribution License (the "License"). 7 * You may not use this file except in compliance with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or https://opensource.org/licenses/CDDL-1.0. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #ifndef _SYS_CRYPTO_IMPL_H 28 #define _SYS_CRYPTO_IMPL_H 29 30 /* 31 * Kernel Cryptographic Framework private implementation definitions. 32 */ 33 34 #include <sys/zfs_context.h> 35 #include <sys/crypto/common.h> 36 #include <sys/crypto/api.h> 37 #include <sys/crypto/spi.h> 38 #include <sys/avl.h> 39 40 #ifdef __cplusplus 41 extern "C" { 42 #endif 43 44 /* 45 * Prefixes convention: structures internal to the kernel cryptographic 46 * framework start with 'kcf_'. Exposed structure start with 'crypto_'. 47 */ 48 49 50 /* 51 * The following two macros should be 52 * #define KCF_OPS_CLASSSIZE (KCF_LAST_OPSCLASS - KCF_FIRST_OPSCLASS + 2) 53 * #define KCF_MAXMECHTAB KCF_MAXCIPHER 54 * 55 * However, doing that would involve reorganizing the header file a bit. 56 * When impl.h is broken up (bug# 4703218), this will be done. For now, 57 * we hardcode these values. 58 */ 59 #define KCF_OPS_CLASSSIZE 3 60 #define KCF_MAXMECHTAB 32 61 62 /* 63 * Valid values for the state of a provider. The order of 64 * the elements is important. 65 * 66 * Routines which get a provider or the list of providers 67 * should pick only those that are in KCF_PROV_READY state. 68 */ 69 typedef enum { 70 KCF_PROV_ALLOCATED = 1, 71 /* 72 * state < KCF_PROV_READY means the provider can not 73 * be used at all. 74 */ 75 KCF_PROV_READY, 76 /* 77 * state > KCF_PROV_READY means the provider can not 78 * be used for new requests. 79 */ 80 KCF_PROV_FAILED, 81 /* 82 * Threads setting the following two states should do so only 83 * if the current state < KCF_PROV_DISABLED. 84 */ 85 KCF_PROV_DISABLED, 86 KCF_PROV_REMOVED, 87 KCF_PROV_FREED 88 } kcf_prov_state_t; 89 90 #define KCF_IS_PROV_USABLE(pd) ((pd)->pd_state == KCF_PROV_READY) 91 #define KCF_IS_PROV_REMOVED(pd) ((pd)->pd_state >= KCF_PROV_REMOVED) 92 93 /* 94 * A provider descriptor structure. There is one such structure per 95 * provider. It is allocated and initialized at registration time and 96 * freed when the provider unregisters. 97 * 98 * pd_refcnt: Reference counter to this provider descriptor 99 * pd_irefcnt: References held by the framework internal structs 100 * pd_lock: lock protects pd_state 101 * pd_state: State value of the provider 102 * pd_ops_vector: The ops vector specified by Provider 103 * pd_mech_indx: Lookup table which maps a core framework mechanism 104 * number to an index in pd_mechanisms array 105 * pd_mechanisms: Array of mechanisms supported by the provider, specified 106 * by the provider during registration 107 * pd_mech_list_count: The number of entries in pi_mechanisms, specified 108 * by the provider during registration 109 * pd_remove_cv: cv to wait on while the provider queue drains 110 * pd_description: Provider description string 111 * pd_kcf_prov_handle: KCF-private handle assigned by KCF 112 * pd_prov_id: Identification # assigned by KCF to provider 113 */ 114 typedef struct kcf_provider_desc { 115 uint_t pd_refcnt; 116 uint_t pd_irefcnt; 117 kmutex_t pd_lock; 118 kcf_prov_state_t pd_state; 119 const crypto_ops_t *pd_ops_vector; 120 ushort_t pd_mech_indx[KCF_OPS_CLASSSIZE]\ 121 [KCF_MAXMECHTAB]; 122 const crypto_mech_info_t *pd_mechanisms; 123 uint_t pd_mech_list_count; 124 kcondvar_t pd_remove_cv; 125 const char *pd_description; 126 crypto_kcf_provider_handle_t pd_kcf_prov_handle; 127 crypto_provider_id_t pd_prov_id; 128 } kcf_provider_desc_t; 129 130 /* 131 * If a component has a reference to a kcf_provider_desc_t, 132 * it REFHOLD()s. A new provider descriptor which is referenced only 133 * by the providers table has a reference counter of one. 134 */ 135 #define KCF_PROV_REFHOLD(desc) { \ 136 int newval = atomic_add_32_nv(&(desc)->pd_refcnt, 1); \ 137 ASSERT(newval != 0); \ 138 } 139 140 #define KCF_PROV_IREFHOLD(desc) { \ 141 int newval = atomic_add_32_nv(&(desc)->pd_irefcnt, 1); \ 142 ASSERT(newval != 0); \ 143 } 144 145 #define KCF_PROV_IREFRELE(desc) { \ 146 membar_producer(); \ 147 int newval = atomic_add_32_nv(&(desc)->pd_irefcnt, -1); \ 148 ASSERT(newval != -1); \ 149 if (newval == 0) { \ 150 cv_broadcast(&(desc)->pd_remove_cv); \ 151 } \ 152 } 153 154 #define KCF_PROV_REFHELD(desc) ((desc)->pd_refcnt >= 1) 155 156 #define KCF_PROV_REFRELE(desc) { \ 157 membar_producer(); \ 158 int newval = atomic_add_32_nv(&(desc)->pd_refcnt, -1); \ 159 ASSERT(newval != -1); \ 160 if (newval == 0) { \ 161 kcf_provider_zero_refcnt((desc)); \ 162 } \ 163 } 164 165 166 /* 167 * An element in a mechanism provider descriptors chain. 168 * The kcf_prov_mech_desc_t is duplicated in every chain the provider belongs 169 * to. This is a small tradeoff memory vs mutex spinning time to access the 170 * common provider field. 171 */ 172 173 typedef struct kcf_prov_mech_desc { 174 struct kcf_mech_entry *pm_me; /* Back to the head */ 175 struct kcf_prov_mech_desc *pm_next; /* Next in the chain */ 176 crypto_mech_info_t pm_mech_info; /* Provider mech info */ 177 kcf_provider_desc_t *pm_prov_desc; /* Common desc. */ 178 } kcf_prov_mech_desc_t; 179 180 /* 181 * A mechanism entry in an xxx_mech_tab[]. me_pad was deemed 182 * to be unnecessary and removed. 183 */ 184 typedef struct kcf_mech_entry { 185 crypto_mech_name_t me_name; /* mechanism name */ 186 crypto_mech_type_t me_mechid; /* Internal id for mechanism */ 187 kcf_prov_mech_desc_t *me_sw_prov; /* provider */ 188 avl_node_t me_node; 189 } kcf_mech_entry_t; 190 191 /* 192 * Global tables. The sizes are from the predefined PKCS#11 v2.20 mechanisms, 193 * with a margin of few extra empty entry points 194 */ 195 196 #define KCF_MAXDIGEST 16 /* Digests */ 197 #define KCF_MAXCIPHER 32 /* Ciphers */ 198 #define KCF_MAXMAC 40 /* Message authentication codes */ 199 200 _Static_assert(KCF_MAXCIPHER == KCF_MAXMECHTAB, 201 "KCF_MAXCIPHER != KCF_MAXMECHTAB"); /* See KCF_MAXMECHTAB comment */ 202 203 typedef enum { 204 KCF_CIPHER_CLASS = 1, 205 KCF_MAC_CLASS, 206 } kcf_ops_class_t; 207 208 #define KCF_FIRST_OPSCLASS KCF_CIPHER_CLASS 209 #define KCF_LAST_OPSCLASS KCF_MAC_CLASS 210 _Static_assert( 211 KCF_OPS_CLASSSIZE == (KCF_LAST_OPSCLASS - KCF_FIRST_OPSCLASS + 2), 212 "KCF_OPS_CLASSSIZE doesn't match kcf_ops_class_t!"); 213 214 /* The table of all the kcf_xxx_mech_tab[]s, indexed by kcf_ops_class */ 215 216 typedef struct kcf_mech_entry_tab { 217 int met_size; /* Size of the met_tab[] */ 218 kcf_mech_entry_t *met_tab; /* the table */ 219 } kcf_mech_entry_tab_t; 220 221 extern const kcf_mech_entry_tab_t kcf_mech_tabs_tab[]; 222 223 #define KCF_MECHID(class, index) \ 224 (((crypto_mech_type_t)(class) << 32) | (crypto_mech_type_t)(index)) 225 226 #define KCF_MECH2CLASS(mech_type) ((kcf_ops_class_t)((mech_type) >> 32)) 227 228 #define KCF_MECH2INDEX(mech_type) ((int)((mech_type) & 0xFFFFFFFF)) 229 230 #define KCF_TO_PROV_MECH_INDX(pd, mech_type) \ 231 ((pd)->pd_mech_indx[KCF_MECH2CLASS(mech_type)] \ 232 [KCF_MECH2INDEX(mech_type)]) 233 234 #define KCF_TO_PROV_MECHINFO(pd, mech_type) \ 235 ((pd)->pd_mechanisms[KCF_TO_PROV_MECH_INDX(pd, mech_type)]) 236 237 #define KCF_TO_PROV_MECHNUM(pd, mech_type) \ 238 (KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_number) 239 240 /* 241 * Return codes for internal functions 242 */ 243 #define KCF_SUCCESS 0x0 /* Successful call */ 244 #define KCF_INVALID_MECH_NUMBER 0x1 /* invalid mechanism number */ 245 #define KCF_INVALID_MECH_NAME 0x2 /* invalid mechanism name */ 246 #define KCF_INVALID_MECH_CLASS 0x3 /* invalid mechanism class */ 247 #define KCF_MECH_TAB_FULL 0x4 /* Need more room in the mech tabs. */ 248 #define KCF_INVALID_INDX ((ushort_t)-1) 249 250 /* 251 * Wrappers for ops vectors. In the wrapper definitions below, the pd 252 * argument always corresponds to a pointer to a provider descriptor 253 * of type kcf_prov_desc_t. 254 */ 255 256 #define KCF_PROV_CIPHER_OPS(pd) ((pd)->pd_ops_vector->co_cipher_ops) 257 #define KCF_PROV_MAC_OPS(pd) ((pd)->pd_ops_vector->co_mac_ops) 258 #define KCF_PROV_CTX_OPS(pd) ((pd)->pd_ops_vector->co_ctx_ops) 259 260 /* 261 * Wrappers for crypto_cipher_ops(9S) entry points. 262 */ 263 264 #define KCF_PROV_ENCRYPT_ATOMIC(pd, mech, key, plaintext, ciphertext, \ 265 template) ( \ 266 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic) ? \ 267 KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic( \ 268 mech, key, plaintext, ciphertext, template) : \ 269 CRYPTO_NOT_SUPPORTED) 270 271 #define KCF_PROV_DECRYPT_ATOMIC(pd, mech, key, ciphertext, plaintext, \ 272 template) ( \ 273 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic) ? \ 274 KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic( \ 275 mech, key, ciphertext, plaintext, template) : \ 276 CRYPTO_NOT_SUPPORTED) 277 278 /* 279 * Wrappers for crypto_mac_ops(9S) entry points. 280 */ 281 282 #define KCF_PROV_MAC_INIT(pd, ctx, mech, key, template) ( \ 283 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_init) ? \ 284 KCF_PROV_MAC_OPS(pd)->mac_init(ctx, mech, key, template) \ 285 : CRYPTO_NOT_SUPPORTED) 286 287 /* 288 * The _ (underscore) in _mac is needed to avoid replacing the 289 * function mac(). 290 */ 291 #define KCF_PROV_MAC_UPDATE(pd, ctx, data) ( \ 292 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_update) ? \ 293 KCF_PROV_MAC_OPS(pd)->mac_update(ctx, data) : \ 294 CRYPTO_NOT_SUPPORTED) 295 296 #define KCF_PROV_MAC_FINAL(pd, ctx, mac) ( \ 297 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_final) ? \ 298 KCF_PROV_MAC_OPS(pd)->mac_final(ctx, mac) : \ 299 CRYPTO_NOT_SUPPORTED) 300 301 #define KCF_PROV_MAC_ATOMIC(pd, mech, key, data, mac, template) ( \ 302 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_atomic) ? \ 303 KCF_PROV_MAC_OPS(pd)->mac_atomic( \ 304 mech, key, data, mac, template) : \ 305 CRYPTO_NOT_SUPPORTED) 306 307 /* 308 * Wrappers for crypto_ctx_ops(9S) entry points. 309 */ 310 311 #define KCF_PROV_CREATE_CTX_TEMPLATE(pd, mech, key, template, size) ( \ 312 (KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->create_ctx_template) ? \ 313 KCF_PROV_CTX_OPS(pd)->create_ctx_template( \ 314 mech, key, template, size) : \ 315 CRYPTO_NOT_SUPPORTED) 316 317 #define KCF_PROV_FREE_CONTEXT(pd, ctx) ( \ 318 (KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->free_context) ? \ 319 KCF_PROV_CTX_OPS(pd)->free_context(ctx) : CRYPTO_NOT_SUPPORTED) 320 321 322 /* Miscellaneous */ 323 extern void kcf_destroy_mech_tabs(void); 324 extern void kcf_init_mech_tabs(void); 325 extern int kcf_add_mech_provider(short, kcf_provider_desc_t *, 326 kcf_prov_mech_desc_t **); 327 extern void kcf_remove_mech_provider(const char *, kcf_provider_desc_t *); 328 extern int kcf_get_mech_entry(crypto_mech_type_t, kcf_mech_entry_t **); 329 extern kcf_provider_desc_t *kcf_alloc_provider_desc(void); 330 extern void kcf_provider_zero_refcnt(kcf_provider_desc_t *); 331 extern void kcf_free_provider_desc(kcf_provider_desc_t *); 332 extern void undo_register_provider(kcf_provider_desc_t *, boolean_t); 333 extern int crypto_put_output_data(uchar_t *, crypto_data_t *, int); 334 extern int crypto_update_iov(void *, crypto_data_t *, crypto_data_t *, 335 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *)); 336 extern int crypto_update_uio(void *, crypto_data_t *, crypto_data_t *, 337 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *)); 338 339 /* Access to the provider's table */ 340 extern void kcf_prov_tab_destroy(void); 341 extern void kcf_prov_tab_init(void); 342 extern int kcf_prov_tab_add_provider(kcf_provider_desc_t *); 343 extern int kcf_prov_tab_rem_provider(crypto_provider_id_t); 344 extern kcf_provider_desc_t *kcf_prov_tab_lookup(crypto_provider_id_t); 345 extern int kcf_get_sw_prov(crypto_mech_type_t, kcf_provider_desc_t **, 346 kcf_mech_entry_t **, boolean_t); 347 348 349 #ifdef __cplusplus 350 } 351 #endif 352 353 #endif /* _SYS_CRYPTO_IMPL_H */ 354